Analysis
-
max time kernel
1984s -
max time network
1984s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-es -
resource tags
arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
29-11-2022 08:21
Static task
static1
General
-
Target
m.png
-
Size
27KB
-
MD5
c68b317152e8958dbaf191a41cee9d91
-
SHA1
0b41509d3e80d47cb890a784ad5b27c37694afb6
-
SHA256
b8aa7341d47088c57856c6709de7ffb6ad1b9d922af4c1827562b7a14a621fe4
-
SHA512
1c52c040032a8d703ecd09727137aa451378bd9867d7bf8fd02daa74de17bf974820e5d869337d6c42348d73aabc9f23a5fa9b5ef052d4b4b0fb7c5c0b7a0b6a
-
SSDEEP
384:C78+NH0Z6Ts3A1vZMthIYVVOkYszmIbejonFuXVep80AqPFfsivzddLHbzSYLAQA:C71N/mhnV49sqIaEFu0AqP1sETLbzZG
Malware Config
Extracted
C:\Program Files\WinRAR\Rar.txt
Extracted
C:\Program Files\WinRAR\WhatsNew.txt
https
http
http://weirdsgn.com
http://icondesignlab.com
https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar
https://technet.microsoft.com/en-us/library/security/ms14-064.aspx
http://rarlab.com/vuln_sfx_html2.htm
Signatures
-
Modifies system executable filetype association 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUninstaller\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUninstaller\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}" isrbfr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Advanced SystemCare\ = "{2803063F-4B8D-4dc6-8874-D1802487FE2D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUninstaller regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\PDFMenu\ = "{C9860A7C-5A19-4066-96C3-577EFF8B6EE3}" Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\PDFMenu Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUninstaller isrbfr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Advanced SystemCare regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUninstaller isrbfr.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 6288 created 5472 6288 svchost.exe 1030 -
Blocklisted process makes network request 1 IoCs
flow pid Process 1387 4860 schtasks.exe -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 30 IoCs
description ioc Process File created C:\Windows\system32\DRIVERS\SETC651.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETDD27.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SET2D8E.tmp AVGBrowser.exe File opened for modification C:\Windows\system32\DRIVERS\SETCE9F.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETDF1D.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETC651.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SETCE9F.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SETDD27.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SETDDE3.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\idmwfp.sys AVGBrowser.exe File opened for modification C:\Windows\system32\DRIVERS\SET8307.tmp RunDLL32.Exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SET2D8E.tmp AVGBrowser.exe File created C:\Windows\system32\DRIVERS\SET4C55.tmp RUNDLL32.EXE File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup-0009996.0009996-consumer.exe File opened for modification C:\Windows\system32\DRIVERS\SETDDE3.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\mwac.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\SETE25A.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\mbam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SET4C55.tmp RUNDLL32.EXE File opened for modification C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\farflt.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\bddci.sys RunDLL32.Exe File created C:\Windows\system32\drivers\mbae64.sys MBAMInstallerService.exe File opened for modification C:\Windows\system32\DRIVERS\SETE25A.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SET8307.tmp RunDLL32.Exe File created C:\Windows\system32\DRIVERS\SETDF1D.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\idmwfp.sys RUNDLL32.EXE -
Executes dropped EXE 64 IoCs
pid Process 5888 utorrent_installer.exe 2684 utorrent_installer.tmp 5564 uTorrent.exe 5732 saBSI.exe 5508 avg_secure_browser_setup.exe 5344 saBSI.exe 3040 AVGBrowserUpdateSetup.exe 4988 AVGBrowserUpdate.exe 1712 AVGBrowserUpdate.exe 1156 installer.exe 2476 AVGBrowserUpdate.exe 4064 AVGBrowserUpdateComRegisterShell64.exe 4872 AVGBrowserUpdateComRegisterShell64.exe 4756 installer.exe 5816 AVGBrowserUpdateComRegisterShell64.exe 4368 AVGBrowserUpdate.exe 1660 AVGBrowserUpdate.exe 4180 AVGBrowserUpdate.exe 888 ServiceHost.exe 2348 UIHost.exe 5164 AVGBrowserInstaller.exe 1460 setup.exe 5624 setup.exe 4460 updater.exe 4484 uTorrent.exe 688 utorrentie.exe 5520 utorrentie.exe 432 winrar-x64-602.exe 3372 helper.exe 208 setup.exe 3248 setup.exe 5364 DllHost.exe 4284 AVGBrowser.exe 408 setup.exe 5720 setup.exe 2284 AVGBrowserCrashHandler.exe 5772 AVGBrowserCrashHandler64.exe 1472 uninstall.exe 5308 advanced-systemcare-setup.exe 3364 advanced-systemcare-setup.tmp 4468 Setup.exe 4708 advanced-systemcare-setup.exe 5964 advanced-systemcare-setup.tmp 2364 ASCUpgrade.exe 4872 ASCUpgrade.exe 3440 LocalLang.exe 2352 ASCInit.exe 1764 PPUninstaller.exe 1272 RealTimeProtector.exe 4372 DiskDefrag.exe 6008 RealTimeProtector.exe 3356 Register.exe 3652 ASCService.exe 536 smBootTimebase.exe 2372 UninstallInfo.exe 3944 ICONPIN64.exe 740 BrowserCleaner.exe 2644 PrivacyShield.exe 3176 smBootTime.exe 3988 smBootTime.exe 2188 RealTimeProtector.exe 3488 Display.exe 5404 AutoSweep.exe 4256 BrowserProtect.exe -
Modifies Installed Components in the registry 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\ = "AVG Secure Browser" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\StubPath = "\"C:\\Program Files (x86)\\AVG\\Browser\\Application\\107.0.19254.108\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Localized Name = "AVG Secure Browser" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} setup.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ThreadingModel = "Apartment" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32\ThreadingModel = "Apartment" DCIService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\downlWithIDM64.dll" DCIService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32\ = "C:\\Program Files (x86)\\IObit\\IObit Uninstaller\\IUMenuRight.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\downlWithIDM64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\IDMShellExt64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32 DllHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\IDMShellExt64.dll" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\downlWithIDM64.dll" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32 MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\IDMIECC64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32\ThreadingModel = "Apartment" DCIService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32\ThreadingModel = "Apartment" DCIService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1018A8C2-3B2E-405E-BC0F-06AECA5BF715}\InProcServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9860A7C-5A19-4066-96C3-577EFF8B6EE3}\InprocServer32\ = "C:\\Program Files\\iTop PDF\\PDFShellExtension.dll" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32 DllHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\IDMShellExt64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32\ThreadingModel = "Apartment" DllHost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32 MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32 DCIService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32 MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ThreadingModel = "Apartment" AUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32 DCIService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\IDMIECC64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1207.2\\psmachine_64.dll" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ = "C:\\Program Files (x86)\\Internet Download Manager\\IDMShellExt64.dll" Conhost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32 MBAMService.exe -
Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe\DisableExceptionChainValidation = "0" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe AVGBrowserUpdate.exe -
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMChameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe -
Stops running service(s) 3 TTPs
-
resource yara_rule behavioral1/memory/5564-166-0x0000000000400000-0x000000000098F000-memory.dmp upx behavioral1/memory/5564-167-0x0000000000400000-0x000000000098F000-memory.dmp upx behavioral1/memory/4484-287-0x0000000000400000-0x000000000098F000-memory.dmp upx behavioral1/memory/4484-293-0x0000000000400000-0x000000000098F000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion avg_secure_browser_setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion avg_secure_browser_setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mb-support.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mb-support.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation ASCInit.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation smBootTime.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation iScrInit.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation advanced-systemcare-setup.tmp Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation iTopVPNMini.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation IDMan.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation advanced-systemcare-setup.tmp Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation iTopPDF.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation IDMan.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation FreeBigupgrade161.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation GTGCAPI.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation WebCompanionInstaller.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation IObitUninstaler.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation utorrent_installer.tmp Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AutoUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation iScrInit.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation iScrInit.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation IObitLiveUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation ISRSetup.tmp Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation iTopPDF.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation iScrInit.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation winrar-x64-602.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation iScrRec.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation isrSetup.exe.tmp Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation iTopVPN.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Uninstall.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation iScrInit.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation WebCompanion.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation ASC.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Uninstall.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation GoogleUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation iScrInit.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation IObitDownloader.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Lavasoft.WCAssistant.WinService.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation MediumILStart.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation iTop Data Recovery_Setup_IU.tmp Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AutoUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation iScrRec.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Carrier.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation iobituninstaller.tmp Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation iScrRec.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AVGBrowser.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Wine bittorrent.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Wine uTorrent.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Wine uTorrent.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Wine uTorrent.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Wine uTorrent.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Wine bittorrent.exe -
Loads dropped DLL 64 IoCs
pid Process 2684 utorrent_installer.tmp 2684 utorrent_installer.tmp 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 4988 AVGBrowserUpdate.exe 1712 AVGBrowserUpdate.exe 2476 AVGBrowserUpdate.exe 4064 AVGBrowserUpdateComRegisterShell64.exe 2476 AVGBrowserUpdate.exe 4872 AVGBrowserUpdateComRegisterShell64.exe 2476 AVGBrowserUpdate.exe 5816 AVGBrowserUpdateComRegisterShell64.exe 2476 AVGBrowserUpdate.exe 4988 AVGBrowserUpdate.exe 4988 AVGBrowserUpdate.exe 4368 AVGBrowserUpdate.exe 1660 AVGBrowserUpdate.exe 4180 AVGBrowserUpdate.exe 4180 AVGBrowserUpdate.exe 1660 AVGBrowserUpdate.exe 4180 AVGBrowserUpdate.exe 1256 regsvr32.exe 6132 regsvr32.exe 5444 regsvr32.exe 888 ServiceHost.exe 888 ServiceHost.exe 888 ServiceHost.exe 888 ServiceHost.exe 888 ServiceHost.exe 888 ServiceHost.exe 888 ServiceHost.exe 3924 regsvr32.exe 2348 UIHost.exe 2348 UIHost.exe 5364 DllHost.exe 4284 AVGBrowser.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 2352 ASCInit.exe 2352 ASCInit.exe 2352 ASCInit.exe 2352 ASCInit.exe 2352 ASCInit.exe 2352 ASCInit.exe 2352 ASCInit.exe 2352 ASCInit.exe 1764 PPUninstaller.exe 1764 PPUninstaller.exe 1764 PPUninstaller.exe 1764 PPUninstaller.exe 1764 PPUninstaller.exe 1764 PPUninstaller.exe 1764 PPUninstaller.exe 1764 PPUninstaller.exe 1272 RealTimeProtector.exe 1272 RealTimeProtector.exe 1272 RealTimeProtector.exe 1272 RealTimeProtector.exe 1272 RealTimeProtector.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 21 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVGBrowserAutoLaunch_2539D9FFF1F40C0A976762D6C815D3E3 = "\"C:\\Program Files (x86)\\AVG\\Browser\\Application\\AVGBrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"Default\"" AVGBrowser.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVGBrowserAutoLaunch_2539D9FFF1F40C0A976762D6C815D3E3 = "\"C:\\Program Files (x86)\\AVG\\Browser\\Application\\AVGBrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"Default\"" AVGBrowser.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run bittorrent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" RUNDLL32.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" AVGBrowser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" RunDLL32.Exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Web Companion = "C:\\Program Files (x86)\\Lavasoft\\Web Companion\\Application\\WebCompanion.exe --minimize " WebCompanion.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run AVGBrowser.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ut = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" /MINIMIZED" uTorrent.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Advanced SystemCare = "\"C:\\Program Files (x86)\\IObit\\Advanced SystemCare\\ASCTray.exe\" /Auto" ASCInit.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run AVGBrowser.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run IDMan.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run AVGBrowser.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVGBrowserAutoLaunch_2539D9FFF1F40C0A976762D6C815D3E3 = "\"C:\\Program Files (x86)\\AVG\\Browser\\Application\\AVGBrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"Default\"" AVGBrowser.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run uTorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ut = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe /MINIMIZED" uTorrent.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run uTorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Program Files (x86)\\Internet Download Manager\\IDMan.exe /onboot" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bt = "C:\\Users\\Admin\\AppData\\Roaming\\BitTorrent\\BitTorrent.exe /MINIMIZED" bittorrent.exe -
Checks for any installed AV software in registry 1 TTPs 17 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast AVGBrowser.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version bittorrent_installer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir bittorrent_installer.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast AVGBrowser.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV bittorrent_installer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV bittorrent_installer.exe Key opened \REGISTRY\MACHINE\Software\Avast Software\Avast bittorrent_installer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast bittorrent_installer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version bittorrent_installer.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast AVGBrowser.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast AVGBrowser.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast AVGBrowser.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast AVGBrowser.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast bittorrent_installer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir bittorrent_installer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA avg_secure_browser_setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GTGCAPI.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini WebCompanion.exe File opened for modification C:\Windows\assembly\Desktop.ini WebCompanion.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\F: MBAMInstallerService.exe File opened (read-only) \??\W: MonitorDisk.exe File opened (read-only) \??\X: MonitorDisk.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\K: MonitorDisk.exe File opened (read-only) \??\P: MonitorDisk.exe File opened (read-only) \??\Y: MonitorDisk.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\V: MonitorDisk.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\M: MonitorDisk.exe File opened (read-only) \??\T: MonitorDisk.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\Q: MonitorDisk.exe File opened (read-only) \??\U: MonitorDisk.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\J: MonitorDisk.exe File opened (read-only) \??\R: MonitorDisk.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\L: MonitorDisk.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: MBAMInstallerService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\A: MonitorDisk.exe File opened (read-only) \??\E: MonitorDisk.exe File opened (read-only) \??\N: MonitorDisk.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\F: MBAMService.exe File opened (read-only) \??\O: MonitorDisk.exe -
Installs/modifies Browser Helper Object 2 TTPs 12 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}\ = "ExplorerWnd Helper" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}\NoInternetExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" IDM1.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" IDM1.tmp Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects IDM1.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" IDM1.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}\NewTime = "2022-11-29 09:32:34:574" regsvr32.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1073 ipinfo.io 1386 ipinfo.io 1505 ipinfo.io -
Maps connected drives based on registry 3 TTPs 9 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum Monitor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count Monitor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Monitor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count GTGCAPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum GTGCAPI.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum GTGCAPI.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\NextInstance GTGCAPI.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 9 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 ASC.exe File opened for modification \??\PhysicalDrive0 Monitor.exe File opened for modification \??\PhysicalDrive0 AVGBrowser.exe File opened for modification \??\PhysicalDrive0 AVGBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 AVGBrowser.exe File opened for modification \??\PhysicalDrive0 AVGBrowser.exe File opened for modification \??\PhysicalDrive0 avg_secure_browser_setup.exe File opened for modification \??\PhysicalDrive0 AVGBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 AVGBrowserUpdate.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\wldap32.pdb DCIService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_B8B0186C9B133401FFC361A79ABA98AC MBAMService.exe File opened for modification C:\Windows\System32\dll\ntdll.pdb DCIService.exe File opened for modification C:\Windows\System32\rpcrt4.pdb DCIService.exe File opened for modification C:\Windows\System32\symbols\dll\gdi32.pdb DCIService.exe File opened for modification C:\Windows\System32\bcryptprimitives.pdb DCIService.exe File opened for modification C:\Windows\System32\bddci_core.pdb DCIService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5BF987767EE121EB773E3E93D13C2F30_03CD2299090C0BB356909F3191F4A097 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A7611428D62805A3E4E5BC4103D82E4_5DFDB51029B86E246C6BBA4B4F208E9A MBAMService.exe File opened for modification C:\Windows\System32\dll\sechost.pdb DCIService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_66F532634EB780F86B16CC279B9366A2 MBAMService.exe File opened for modification C:\Windows\System32\symbols\exe\DCIService.pdb DCIService.exe File opened for modification C:\Windows\System32\symbols\dll\sechost.pdb DCIService.exe File opened for modification C:\Windows\System32\dll\shell32.pdb DCIService.exe File opened for modification C:\Windows\System32\dll\bcrypt.pdb DCIService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE MBAMService.exe File opened for modification C:\Windows\System32\dll\wldap32.pdb DCIService.exe File opened for modification C:\Windows\System32\dll\user32.pdb DCIService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0F7788E201A03EF5036E7C8BF55432CB_BDA62707BA70CB0111D9E81215C5BF30 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_122A192BE2E6D823EC0310A5EDCCFF70 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_7AA1872B10F7F2428A1288E96F0B99FA MBAMService.exe File opened for modification C:\Windows\System32\symbols\dll\msvcp140.amd64.pdb DCIService.exe File opened for modification C:\Windows\System32\dll\shlwapi.pdb DCIService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFEAE42B75BFF187FD82F1175ED61E4E_FBD4B93BAA2ADCDDAD1BF4FBA8787C37 MBAMService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare\Startup Manager\OptimizeRecord.ini smBootTimebase.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EE44ECA143B76F2B9F2A5AA75B5D1EC6_5BFB72FAE1BB9D1928D1C5C92F52E8EA MBAMService.exe File opened for modification C:\Windows\System32\apphelp.pdb DCIService.exe File opened for modification C:\Windows\System32\dll\msvcp_win.pdb DCIService.exe File opened for modification C:\Windows\System32\symbols\dll\WLDP.pdb DCIService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\79841F8EF00FBA86D33CC5A47696F165 MBAMService.exe File opened for modification C:\Windows\System32\dll\crypt32.pdb DCIService.exe File opened for modification C:\Windows\System32\dll\vcruntime140_1.amd64.pdb DCIService.exe File opened for modification C:\Windows\System32\kernelbase.pdb DCIService.exe File opened for modification C:\Windows\System32\ucrtbase.pdb DCIService.exe File opened for modification C:\Windows\System32\vcruntime140.amd64.pdb DCIService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B71FF43BF9E2EAAE097B5C6FB09A3BC7 MBAMService.exe File opened for modification C:\Windows\System32\symbols\dll\kernelbase.pdb DCIService.exe File opened for modification C:\Windows\System32\dll\ws2_32.pdb DCIService.exe File opened for modification C:\Windows\System32\sechost.pdb DCIService.exe File opened for modification C:\Windows\System32\shcore.pdb DCIService.exe File opened for modification C:\Windows\System32\symbols\dll\msvcrt.pdb DCIService.exe File opened for modification C:\Windows\System32\symbols\dll\version.pdb DCIService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9A19ADAD9D098E039450ABBEDD5616EB_C4166D05E1A1F251430F506C16FDCA3D MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\74BFD122C0875EC75DBE5C6DB4C59019 MBAMService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare\Startup Manager\OptFailed.ini smBootTimebase.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DE0101390D8E4B74E3DD39ACA5B00000_C17E05C51BAFC50FB9AA37503F88FFE8 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB MBAMService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\IObit\IObit Uninstaller\DistrustPlugin.ini smBootTimebase.exe File opened for modification C:\Windows\System32\dll\combase.pdb DCIService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5F26A2159BA21EA573A1C5E3DE2CF211_7541962669C96CEAB06421EC12621007 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_7A728661069CA772B49C024BDC70E82F MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EA5A12DFB61A04911CAB3605AD9FAD9_F3FB8768F94DA47D7D016A63A2340CA9 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_FD0723D657636FF4074BCCACA38E92A5 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\79841F8EF00FBA86D33CC5A47696F165 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\229169D96B9C20761B929D428962A0A2_FC65190A8D1232A1711F16F9F20C5149 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DE0101390D8E4B74E3DD39ACA5B00000_C17E05C51BAFC50FB9AA37503F88FFE8 MBAMService.exe File opened for modification C:\Windows\System32\dll\advapi32.pdb DCIService.exe File opened for modification C:\Windows\System32\Kernel.Appcore.pdb DCIService.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\download.jpg" Explorer.EXE -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-nl-NL.js installer.exe File created C:\Program Files (x86)\iTop VPN\Flag\[email protected] iTopVPN.exe File created C:\Program Files\iTop Screen Recorder\res\effects\is-6KVRF.tmp isrSetup.exe.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\CircularButtonStyle.qml MBAMInstallerService.exe File created C:\Program Files\iTop Screen Recorder\res\stickers\is-8TOJF.tmp ISRSetup.tmp File created C:\Program Files\iTop Screen Recorder\res\stickers\thumbs\1x\is-O3F7P.tmp cmd.exe File created C:\Program Files (x86)\GUME094.tmp\psmachine.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\IObit\Advanced SystemCare\Surfing Protection\BrowerProtect\images\is-VLHHK.tmp advanced-systemcare-setup.tmp File created C:\Program Files\iTop Screen Recorder\is-QLF61.tmp isrSetup.exe.tmp File created C:\Program Files\iTop Screen Recorder\res\stickers\is-F22K4.tmp isrSetup.exe.tmp File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1207.2\goopdateres_ja.dll AVGBrowserUpdate.exe File opened for modification C:\Program Files\McAfee\Temp1781269283\browserhost.cab installer.exe File created C:\Program Files (x86)\PhotoScape\icon\cartoon\cartoon051.png PhotoScapeSetup_V3.7.exe File created C:\Program Files (x86)\IObit\Advanced SystemCare\Update\SoftUpdater.ini AutoUpdate.exe File created C:\Program Files\iTop Screen Recorder\res\stickers\thumbs\1x\is-VDMHO.tmp ISRSetup.tmp File created C:\Program Files\iTop PDF\resources\app\.webpack\renderer\assets\language\is-1PE94.tmp PDFSetup.tmp File created C:\Program Files\iTop Screen Recorder\res\stickers\is-VMUKD.tmp isrSetup.exe.tmp File created C:\Program Files (x86)\PhotoScape\icon\number\d_01.png PhotoScapeSetup_V3.7.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe.config WebCompanionInstaller.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ko-KR.js installer.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source1460_1481800273\Safer-bin\107.0.19254.108\Locales\ml.pak setup.exe File created C:\Program Files\iTop Screen Recorder\Language\is-QJP41.tmp ISRSetup.tmp File created C:\Program Files\iTop Screen Recorder\res\stickers\thumbs\2x\is-T5JHE.tmp ISRSetup.tmp File created C:\Program Files\iTop PDF\is-A06LF.tmp PDFSetup.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-crt-private-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files (x86)\PhotoScape\icon\stamp\stamp010.png PhotoScapeSetup_V3.7.exe File created C:\Program Files\McAfee\Temp1781269283\mfw-webadvisor.cab installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-es-ES.js installer.exe File created C:\Program Files\iTop PDF\resources\app\.webpack\renderer\assets\webviewer\core\pdf\full\is-R9L3A.tmp PDFSetup.tmp File created C:\Program Files\iTop Screen Recorder\res\transitions\is-IHSUA.tmp cmd.exe File created C:\Program Files\iTop Screen Recorder\res\stickers\is-8OSJS.tmp isrSetup.exe.tmp File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-es-MX.js installer.exe File created C:\Program Files\iTop Screen Recorder\res\stickers\thumbs\2x\is-9O4IE.tmp cmd.exe File created C:\Program Files\iTop Screen Recorder\res\stickers\thumbs\1x\is-9705K.tmp isrSetup.exe.tmp File created C:\Program Files (x86)\PhotoScape\icon\travel\t_022.png PhotoScapeSetup_V3.7.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\MenuSeparator.qml MBAMInstallerService.exe File created C:\Program Files (x86)\IObit\Advanced SystemCare\drivers\wnet_x86\is-I6D90.tmp advanced-systemcare-setup.tmp File created C:\Program Files\iTop Screen Recorder\res\stickers\thumbs\2x\is-JO6ME.tmp ISRSetup.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\DelayButton.qml MBAMInstallerService.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-sr-Latn-CS.js installer.exe File created C:\Program Files (x86)\PhotoScape\frame\antique_frame04.psi PhotoScapeSetup_V3.7.exe File created C:\Program Files\iTop Screen Recorder\res\stickers\thumbs\1x\is-3RC8U.tmp isrSetup.exe.tmp File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\vcruntime140d.dll WebCompanionInstaller.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\ComboBox.qml MBAMInstallerService.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source1460_1481800273\Safer-bin\107.0.19254.108\Extensions\external_extensions.json setup.exe File opened for modification C:\Program Files (x86)\Common Files\IObit\Advanced SystemCare\License.ini register.exe File created C:\Program Files (x86)\PhotoScape\icon\cartoon\text003.png PhotoScapeSetup_V3.7.exe File created C:\Program Files (x86)\PhotoScape\icon\number\i_19.png PhotoScapeSetup_V3.7.exe File created C:\Program Files\McAfee\Temp1781269283\jslang\eula-ko-KR.txt installer.exe File created C:\Program Files (x86)\IObit\Advanced SystemCare\ascbfo.exe AutoUpdate.exe File created C:\Program Files (x86)\PhotoScape\balloon\sculpture_02.psb PhotoScapeSetup_V3.7.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\FocusFrame.qml MBAMInstallerService.exe File created C:\Program Files (x86)\iTop VPN\is-V0DQV.tmp iTopSetup.tmp File created C:\Program Files\iTop PDF\language\is-B383D.tmp PDFSetup.tmp File created C:\Program Files (x86)\PhotoScape\frame\clip01.png PhotoScapeSetup_V3.7.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\StatusBarStyle.qml MBAMInstallerService.exe File opened for modification C:\Program Files (x86)\IObit\IObit Uninstaller\Database\SoftPM.dbd IObitUninstaler.exe File created C:\Program Files\iTop Screen Recorder\res\stickers\is-1KK73.tmp isrSetup.exe.tmp File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-it-IT.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\searchterm.luc installer.exe File created C:\Program Files (x86)\iTop Data Recovery\is-F537M.tmp iTop Data Recovery_Setup_IU.tmp File created C:\Program Files\iTop Screen Recorder\is-B1LKC.tmp isrSetup.exe.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\style.js MBAMInstallerService.exe -
Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\INF\audioendpoint.PNF ASC.exe File opened for modification C:\Windows\INF\vhdmp.PNF ASC.exe File created C:\Windows\INF\c_volume.PNF ASC.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e639023.msi msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new WebCompanion.exe File created C:\Windows\INF\c_monitor.PNF ASC.exe File opened for modification C:\Windows\Installer\e639020.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new Lavasoft.Search.exe File opened for modification C:\Windows\INF\netrtl64.PNF ASC.exe File opened for modification C:\Windows\INF\c_swdevice.PNF ASC.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI9679.tmp msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new WebCompanionInstaller.exe File created C:\Windows\INF\c_media.PNF ASC.exe File opened for modification C:\Windows\INF\cpu.PNF ASC.exe File created C:\Windows\Installer\SourceHash{EDB7AEE7-E932-4836-AE50-D3B0B7766CB5} msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new WebCompanion.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new WebCompanionInstaller.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new Lavasoft.Search.exe File opened for modification C:\Windows\INF\kdnic.PNF ASC.exe File created C:\Windows\INF\c_diskdrive.PNF ASC.exe File created C:\Windows\Installer\e639020.msi msiexec.exe File created C:\Windows\assembly\Desktop.ini WebCompanion.exe File opened for modification C:\Windows\assembly\Desktop.ini WebCompanion.exe File opened for modification C:\Windows\security\logs\scecomp.log MBAMService.exe File opened for modification C:\Windows\INF\printqueue.PNF ASC.exe File opened for modification C:\Windows\INF\disk.PNF ASC.exe File created C:\Windows\INF\c_display.PNF ASC.exe File created C:\Windows\INF\c_processor.PNF ASC.exe File opened for modification C:\Windows\assembly WebCompanion.exe -
Launches sc.exe 23 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5384 sc.exe 4256 sc.exe 2268 sc.exe 5944 sc.exe 3664 sc.exe 5992 sc.exe 624 sc.exe 5584 sc.exe 3968 sc.exe 5320 sc.exe 808 sc.exe 5852 sc.exe 2956 sc.exe 2592 sc.exe 4352 sc.exe 5172 sc.exe 6748 sc.exe 5388 sc.exe 816 sc.exe 5052 sc.exe 4772 sc.exe 3480 sc.exe 5476 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 6344 5836 WerFault.exe 914 -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 ASC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID GpuCheck.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ GpuCheck.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs ASC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 ASC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ ASC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 ASC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ ASC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UINumber GTGCAPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 ASC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ GpuCheck.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Device Parameters\Storport\InitialTimestamp GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceType ASC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 ASC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 ASC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ GpuCheck.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags ASC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 ASC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ ASC.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Address GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceType GpuCheck.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\DiskId GTGCAPI.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Storport GTGCAPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 ASC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ ASC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ GpuCheck.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg GpuCheck.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ GpuCheck.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceCharacteristics GpuCheck.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Mfg GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver GTGCAPI.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003\ ASC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc GpuCheck.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI GTGCAPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ContainerID GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID ASC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceCharacteristics ASC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 GpuCheck.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ GpuCheck.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002\ GpuCheck.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc GTGCAPI.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Device Parameters\Storport GTGCAPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Storport GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceType ASC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 GpuCheck.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc GpuCheck.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg ASC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceType ASC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties GTGCAPI.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr GTGCAPI.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM GTGCAPI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ContainerID GTGCAPI.exe -
Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 utorrent_installer.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ utorrent_installer.tmp Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Conhost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature chrome.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Conhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 4420 timeout.exe 2080 timeout.exe -
Enumerates system info in registry 2 TTPs 27 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AVGBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AVGBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AVGBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AVGBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AVGBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AVGBrowser.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4512 ipconfig.exe -
Kills process with taskkill 9 IoCs
pid Process 7152 taskkill.exe 4512 taskkill.exe 5152 taskkill.exe 4260 taskkill.exe 2052 taskkill.exe 5844 taskkill.exe 6524 taskkill.exe 6360 taskkill.exe 116 taskkill.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B}\AppName = "IDMan.exe" IDM1.tmp Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Low Rights idmBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B}\Policy = "3" idmBroker.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Descargar con IDM todos los enlaces IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B851AF-A4B9-43EF-97D3-28E1B4A5DB9B} idmBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "IDMan.exe" IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" Explorer.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\Policy = "3" AVGBrowserUpdate.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights IDM1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" IDM1.tmp Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B} IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" IDM1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" IDMan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Low Rights IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\utorrentie.exe = "1" uTorrent.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION uTorrent.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights IDM1.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" IDM1.tmp Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy IDM1.tmp Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy IDM1.tmp Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Descargar con IDM\contexts = "243" IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Descargar con IDM todos los enlaces \ = "C:\\Program Files (x86)\\Internet Download Manager\\IEGetAll.htm" IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Toolbar Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} IDM1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" IDM1.tmp Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy idmBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1207.2" AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} IDM1.tmp Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "IDMan.exe" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Descargar con IDM todos los enlaces \contexts = "243" IDMan.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" IDMan.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} IDMan.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "IDMan.exe" IDM1.tmp Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Descargar con IDM todos los enlaces IDMan.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Low Rights IDMan.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\Policy = "3" AVGBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{F6E1B27E-F2DA-4919-9DBD-CAB90A1D662B}\Policy = "3" IDM1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" IDMan.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "IDMan.exe" IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Program Files (x86)\\Internet Download Manager" IDM1.tmp Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop IDMan.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel IDMan.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} IDMan.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} IDMan.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Descargar con IDM IDMan.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077} AVGBrowserUpdate.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION uTorrent.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates ServiceHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 8eab5d6f33a88fffa2adf7c901659a2862be2c6a2367e6e9b46e1e75c258b238 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MBAMService.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office MBAMInstallerService.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust updater.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates Lavasoft.WCAssistant.WinService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates updater.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = a410000060c46b00d603d901 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Lavasoft.WCAssistant.WinService.exe Key deleted \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs updater.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\endpoint = "update.avgbrowser.com" AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" AVGBrowserUpdate.exe Key deleted \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs ServiceHost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MBAMService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@C:\Windows\System32\AppxPackaging.dll,-1001 = "Trusted Packaged App Installation Authorities" certutil.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MBAMService.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" AVGBrowserUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191}\ProxyStubClsid32 AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7B73E65-20BA-407F-8A89-DF649EF82559}\ProxyStubClsid32\ = "{1018A8C2-3B2E-405E-BC0F-06AECA5BF715}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\.xhtml\ = "AvgHTML" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2223E76A-0894-4502-841F-0CF7517A713B}\TypeLib\Version = "1.0" idmBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94E6A9DF-4AAB-48E7-8A94-65CA2481D1F6}\TypeLib\Version = "1.0" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31BF2366-C6DB-49F1-96A5-8026B9DF4152}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB785069-B832-4423-B813-47F7422BA6E5}\NumMethods\ = "4" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{356E6235-B055-46D9-8B32-BDC2266C9DAB} IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB30855D-36DF-41BD-9EEE-03BA7E8E70B7}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E64B3CF-7D56-4F76-8B9F-A6CD0D3393AE}\ = "IScanControllerV18" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1F91DE-30AF-469B-9A09-FCF176207F0F}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADCD8BEB-8924-4876-AE14-2438FF14FA17} MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7EEA7BDE239E6384EA053D0B7B67C65B\Version = "17302711" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{61964EBA-D9C0-4834-B01C-A6133F432BB1}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\.btsearch\OpenWithProgids\uTorrent uTorrent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\TypeLib IDMan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DA5CFCA-E804-4A2F-8B93-F5431D233D54}\ = "IMWACControllerV16" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\Programmable MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FF168C7-A609-4237-A076-E461334BF4EA} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3F656FD9-2597-4587-8F05-781C11710867}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{108E7F3D-FB06-4024-94FB-3B8E687587E4} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D57ACF19-30E3-4B7E-BCDD-6EEB8E57AF27}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4163399F-AB08-4E5E-BE28-6B9440393AD3}\ = "IMWACControllerV13" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{557ADCF9-0496-46F6-A580-FF8EC1441050}\TypeLib\Version = "1.0" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44ACF635-5275-4730-95E5-03E4D192D8C8} MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9185897A-76F4-4083-A02C-5FFC2A51F6D4}\TypeLib MBAMService.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\.btskin\ = "uTorrent" uTorrent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FBDC15B-BBCD-402B-A45F-1853B01A9E3C} AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAF0374A-11AB-4E4E-B141-663E77D63E4C}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55D0C28B-2BF3-4230-B48D-DB2C2D7BF6F8}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44ACF635-5275-4730-95E5-03E4D192D8C8}\ = "ILicenseControllerV8" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2DEBAD4E-3BAF-44F0-9150-BCCCC3801CF9}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CoreMachineClass.1 AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADCD8BEB-8924-4876-AE14-2438FF14FA17}\TypeLib\Version = "1.0" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F14F58B-B908-4644-830F-5ACF8542D27F}\ProxyStubClsid32 MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{77AD284A-4686-413D-AA76-BDFC1DF52A19}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r21\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EE5DE88-B879-438E-9ED1-271C0C313341}\1.0\FLAGS Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1691A7E8-B8D1-46D5-BB29-3A4DB2D809C6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D57ACF19-30E3-4B7E-BCDD-6EEB8E57AF27}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97EB7268-0D7B-43F6-9C11-337287F960DF}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{46AEAC9A-C091-4B63-926C-37CFBD9D244F}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83D0C30B-ECF4-40C5-80EC-21BB47F898A9} MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3641B831-731C-4963-B50B-D84902285C26}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3641B831-731C-4963-B50B-D84902285C26}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA248A19-F84E-4407-ADD3-8563AFD81269}\TypeLib MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32 MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DA5636E-CD8F-4F2D-9351-4270985E1EB3}\ProxyStubClsid32 MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4412646D-16F5-4F3C-8348-0744CDEBCCBF}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}\TypeLib IDM1.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10DAE713-FD88-4ADB-9406-04CB574D543C}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2870643-0645-41F9-BCCB-F5969386162C} MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49F6AC60-2104-42C6-8F71-B3916D5AA732} MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB586AB4-56F2-4EFA-9756-EE9A399B44DE} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{553B1C62-BE94-4CE0-8041-EB3BC1329D20}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F275D775-3A22-4C5A-B9AD-6FE8008304D0}\ = "_IMWACControllerEventsV4" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21EA9E3C-6507-4725-8F4F-ED4DDDE7A709}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F275D775-3A22-4C5A-B9AD-6FE8008304D0}\TypeLib MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\TypeLib MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA1D4FDD-C9C8-4575-A2A1-4179C3A3473D}\ProxyStubClsid32 MBAMService.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 0f000000010000002000000071b437f087f3700ffd4e2fa46f42b6b810d7bf19adfedf951c023edd65b50b05030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob = 0f00000001000000100000005f3d1aa6f471a760663eb7ef254281ef53000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c0620000000100000020000000ab7036365c7154aa29c2c29f5d4191163b162a2225011357d56d07ffa7bc1f72090000000100000016000000301406082b0601050507030306082b060105050703011400000001000000140000005ff3246c8f9124af9b5f3eb0346af42d5ca85dcc1d0000000100000010000000d4803ac36c256817d4ec5936f29bc4e70b000000010000000e00000074006800610077007400650000006800000001000000080000000000876ace99d101030000000100000014000000627f8d7827656399d27d7f9044c9feb3f33efa9a20000000010000002b0300003082032730820290a003020102020101300d06092a864886f70d01010405003081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d301e170d3936303830313030303030305a170d3230313233313233353935395a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d236366a8bd7c25b9eda8141628f38ee490455d6d0ef1c1b951647ef1848353a52f42b6a068f3b2fea56e3af868d9e17f79eb46575024defcb09a22151d89bd067d0ba0d92061473d493cb972a009c5c4e0cbcfa1552fcf2446eda114a6e089f2f2de3f9aa3a8673b6465358c88905bd8311b8733faa078df4424de7409d1c370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810026482c16c258fae816740caaaa5f543ff2d7c978605e5e6e37632277367eb217c434b9f50885fcc90138ff4dbef2164243e7bb5a46fbc1c6111ff14ab02846c9c3c4427dbcfaab596ed5b7518811e3a485196b824ca40c12ade9a4ae3ff1c349659a8cc5c83e25b79499bb92327107f0865eed5027a60da623f9bbcba6071442 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob = 040000000100000010000000069f6979166690021b8c8ca2c3076f3a0f00000001000000100000005f3d1aa6f471a760663eb7ef254281ef53000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c0620000000100000020000000ab7036365c7154aa29c2c29f5d4191163b162a2225011357d56d07ffa7bc1f72090000000100000016000000301406082b0601050507030306082b060105050703011400000001000000140000005ff3246c8f9124af9b5f3eb0346af42d5ca85dcc1d0000000100000010000000d4803ac36c256817d4ec5936f29bc4e70b000000010000000e00000074006800610077007400650000006800000001000000080000000000876ace99d101030000000100000014000000627f8d7827656399d27d7f9044c9feb3f33efa9a1900000001000000100000005dc45e2cd1845791bdde7600050af51020000000010000002b0300003082032730820290a003020102020101300d06092a864886f70d01010405003081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d301e170d3936303830313030303030305a170d3230313233313233353935395a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d236366a8bd7c25b9eda8141628f38ee490455d6d0ef1c1b951647ef1848353a52f42b6a068f3b2fea56e3af868d9e17f79eb46575024defcb09a22151d89bd067d0ba0d92061473d493cb972a009c5c4e0cbcfa1552fcf2446eda114a6e089f2f2de3f9aa3a8673b6465358c88905bd8311b8733faa078df4424de7409d1c370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810026482c16c258fae816740caaaa5f543ff2d7c978605e5e6e37632277367eb217c434b9f50885fcc90138ff4dbef2164243e7bb5a46fbc1c6111ff14ab02846c9c3c4427dbcfaab596ed5b7518811e3a485196b824ca40c12ade9a4ae3ff1c349659a8cc5c83e25b79499bb92327107f0865eed5027a60da623f9bbcba6071442 MBAMService.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB AVGBrowser.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 saBSI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\28903A635B5280FAE6774C0B6DA7D6BAA64AF2E8\Blob = 040000000100000010000000ebf59d290d61f9421f7cc2ba6de315090f00000001000000140000001b8b713e8748912a4b073db0c8e9e3e5c0962d985300000001000000930000003081903022060c2b06010401f578010301330230123010060a2b0601040182373c0101030200c03022060c2b06010401f578010301330430123010060a2b0601040182373c0101030200c03022060c2b06010401f578010302050230123010060a2b0601040182373c0101030200c03022060c2b06010401f578010302330230123010060a2b0601040182373c0101030200c00b00000001000000660000004100670065006e00630069006100200043006100740061006c0061006e0061002000640065002000430065007200740069006600690063006100630069006f00200028004e0049004600200051002d0030003800300031003100370036002d0049002900000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030862000000010000002000000088497f01602f3154246ae28c4d5aef10f1d87ebb76626f4ae0b7f95ba79687997f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000a0c38b44aa37a545bf97805ad1f178a29be95d8d1d00000001000000100000003475b6ae07580528b505a98d7f0fe1f47e00000001000000080000000000cf97a737d60103000000010000001400000028903a635b5280fae6774c0b6da7d6baa64af2e81900000001000000100000004fca18b530ab2d3765b8830436884be620000000010000005a050000308205563082043ea0030201020210ee2b3debd421de14a862ac04f3ddc401300d06092a864886f70d01010505003081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d414343301e170d3033303130373233303030305a170d3331303130373232353935395a3081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d41434330820122300d06092a864886f70d01010105000382010f003082010a0282010100b322c74fe297429588478340f61d17f38373241e51f3988ac392b8ff409005708760c900a9b5946519221517c2436c66449a0d043e396fa54b7aaa63b78a449dd963918466e0280fba42e36e8ef714279369ee910ea35f0eb1eb66a2724f121386657a3edb4f07f4a70960da3a4299c7b27fb316951cc7f934b59485d5995ea048a07ee71765b8a275b81ef3e5427dafedf38a48645d821493d8c0e4ffb35072f276f6b35d425079d0943e6b0c00bed86b0e4e2aec3ed2cc82a218653313779e9a5d1a13d8c3db3dc8977aee70eda7e67cdb71cf2d9462df6dd6f538be3fa5850a19b8a8d809754270c4eaefcb0ec834a81222980cb81394b64becf0d090e7270203010001a381e33081e0301d0603551d1104163014811265635f61636340636174636572742e6e6574300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414a0c38b44aa37a545bf97805ad1f178a29be95d8d307f0603551d20047830763074060b2b06010401f5780103010a3065302c06082b06010505070201162068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c303506082b0601050507020230291a2756656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20300d06092a864886f70d01010505000382010100a0485b8201f64d48b83955359c807a5399d55affb1713bcc3909945ed6daefbe015b5dd31ed8fd7d4fcda041e03493bfcbe2869c379290561cdceb2905e5c49ec735df8a0ccdc52143e9aa88e535c01942635a025ea448183a856fdc9dbc3f9d9cc187b87a6108e9770b7f70ab7addd9972c641e85bfbc7496a1c37a12ec0c1a6e830c3ce872469ffb48d55e97e6b1a1f8e4ef4625949c89db6938beec5c0e56c76551e5508888bf42d52b3de5f9ba9e2eb3caf47392020bbe4c66eb20feb9cbb5997fe6b613faca4b4dd9ee5346063bc64ead935a817e6c2a4b6a05458cf221a43190876c659c9da560953a527ff5d1ab086ef3ee5bf9883d7eb86f6e03e442 AutoUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\28903A635B5280FAE6774C0B6DA7D6BAA64AF2E8\Blob = 5c0000000100000004000000000800001900000001000000100000004fca18b530ab2d3765b8830436884be603000000010000001400000028903a635b5280fae6774c0b6da7d6baa64af2e87e00000001000000080000000000cf97a737d6011d00000001000000100000003475b6ae07580528b505a98d7f0fe1f4140000000100000014000000a0c38b44aa37a545bf97805ad1f178a29be95d8d7f0000000100000016000000301406082b0601050507030306082b0601050507030962000000010000002000000088497f01602f3154246ae28c4d5aef10f1d87ebb76626f4ae0b7f95ba796879909000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b00000001000000660000004100670065006e00630069006100200043006100740061006c0061006e0061002000640065002000430065007200740069006600690063006100630069006f00200028004e0049004600200051002d0030003800300031003100370036002d004900290000005300000001000000930000003081903022060c2b06010401f578010301330230123010060a2b0601040182373c0101030200c03022060c2b06010401f578010301330430123010060a2b0601040182373c0101030200c03022060c2b06010401f578010302050230123010060a2b0601040182373c0101030200c03022060c2b06010401f578010302330230123010060a2b0601040182373c0101030200c00f00000001000000140000001b8b713e8748912a4b073db0c8e9e3e5c0962d98040000000100000010000000ebf59d290d61f9421f7cc2ba6de3150920000000010000005a050000308205563082043ea0030201020210ee2b3debd421de14a862ac04f3ddc401300d06092a864886f70d01010505003081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d414343301e170d3033303130373233303030305a170d3331303130373232353935395a3081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d41434330820122300d06092a864886f70d01010105000382010f003082010a0282010100b322c74fe297429588478340f61d17f38373241e51f3988ac392b8ff409005708760c900a9b5946519221517c2436c66449a0d043e396fa54b7aaa63b78a449dd963918466e0280fba42e36e8ef714279369ee910ea35f0eb1eb66a2724f121386657a3edb4f07f4a70960da3a4299c7b27fb316951cc7f934b59485d5995ea048a07ee71765b8a275b81ef3e5427dafedf38a48645d821493d8c0e4ffb35072f276f6b35d425079d0943e6b0c00bed86b0e4e2aec3ed2cc82a218653313779e9a5d1a13d8c3db3dc8977aee70eda7e67cdb71cf2d9462df6dd6f538be3fa5850a19b8a8d809754270c4eaefcb0ec834a81222980cb81394b64becf0d090e7270203010001a381e33081e0301d0603551d1104163014811265635f61636340636174636572742e6e6574300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414a0c38b44aa37a545bf97805ad1f178a29be95d8d307f0603551d20047830763074060b2b06010401f5780103010a3065302c06082b06010505070201162068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c303506082b0601050507020230291a2756656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20300d06092a864886f70d01010505000382010100a0485b8201f64d48b83955359c807a5399d55affb1713bcc3909945ed6daefbe015b5dd31ed8fd7d4fcda041e03493bfcbe2869c379290561cdceb2905e5c49ec735df8a0ccdc52143e9aa88e535c01942635a025ea448183a856fdc9dbc3f9d9cc187b87a6108e9770b7f70ab7addd9972c641e85bfbc7496a1c37a12ec0c1a6e830c3ce872469ffb48d55e97e6b1a1f8e4ef4625949c89db6938beec5c0e56c76551e5508888bf42d52b3de5f9ba9e2eb3caf47392020bbe4c66eb20feb9cbb5997fe6b613faca4b4dd9ee5346063bc64ead935a817e6c2a4b6a05458cf221a43190876c659c9da560953a527ff5d1ab086ef3ee5bf9883d7eb86f6e03e442 AutoUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 0f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c000000010000000400000000100000040000000100000010000000be954f16012122448ca8bc279602acf50f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb965c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf5900000001000000160000005200530041002f0053004800410033003800340000004b0000000100000044000000300037004300450046003200460036003500340045003300450044003600300035003000460046004300390042003600450042003800340034003200350030005f00000020000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f AVGBrowser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431 uTorrent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\28903A635B5280FAE6774C0B6DA7D6BAA64AF2E8 AutoUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e AutoUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 1900000001000000100000009f687581f7ef744ecfc12b9cee6238f1140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e2000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 19000000010000001000000091fad483f14848a8a69b18b805cdbb3a030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d34317e000000010000000800000000c001b39667d6011d0000000100000010000000e871723e266f38af5d49cda2a502669c14000000010000001400000055e481d11180bed889b908a331f9a1240916b9700b000000010000001e00000045006e0074007200750073007400200028003200300034003800290000006200000001000000200000006dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb1777f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d820000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 uTorrent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\28903A635B5280FAE6774C0B6DA7D6BAA64AF2E8\Blob = 0f00000001000000140000001b8b713e8748912a4b073db0c8e9e3e5c0962d985300000001000000930000003081903022060c2b06010401f578010301330230123010060a2b0601040182373c0101030200c03022060c2b06010401f578010301330430123010060a2b0601040182373c0101030200c03022060c2b06010401f578010302050230123010060a2b0601040182373c0101030200c03022060c2b06010401f578010302330230123010060a2b0601040182373c0101030200c00b00000001000000660000004100670065006e00630069006100200043006100740061006c0061006e0061002000640065002000430065007200740069006600690063006100630069006f00200028004e0049004600200051002d0030003800300031003100370036002d0049002900000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030862000000010000002000000088497f01602f3154246ae28c4d5aef10f1d87ebb76626f4ae0b7f95ba79687997f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000a0c38b44aa37a545bf97805ad1f178a29be95d8d1d00000001000000100000003475b6ae07580528b505a98d7f0fe1f47e00000001000000080000000000cf97a737d60103000000010000001400000028903a635b5280fae6774c0b6da7d6baa64af2e820000000010000005a050000308205563082043ea0030201020210ee2b3debd421de14a862ac04f3ddc401300d06092a864886f70d01010505003081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d414343301e170d3033303130373233303030305a170d3331303130373232353935395a3081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d41434330820122300d06092a864886f70d01010105000382010f003082010a0282010100b322c74fe297429588478340f61d17f38373241e51f3988ac392b8ff409005708760c900a9b5946519221517c2436c66449a0d043e396fa54b7aaa63b78a449dd963918466e0280fba42e36e8ef714279369ee910ea35f0eb1eb66a2724f121386657a3edb4f07f4a70960da3a4299c7b27fb316951cc7f934b59485d5995ea048a07ee71765b8a275b81ef3e5427dafedf38a48645d821493d8c0e4ffb35072f276f6b35d425079d0943e6b0c00bed86b0e4e2aec3ed2cc82a218653313779e9a5d1a13d8c3db3dc8977aee70eda7e67cdb71cf2d9462df6dd6f538be3fa5850a19b8a8d809754270c4eaefcb0ec834a81222980cb81394b64becf0d090e7270203010001a381e33081e0301d0603551d1104163014811265635f61636340636174636572742e6e6574300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414a0c38b44aa37a545bf97805ad1f178a29be95d8d307f0603551d20047830763074060b2b06010401f5780103010a3065302c06082b06010505070201162068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c303506082b0601050507020230291a2756656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20300d06092a864886f70d01010505000382010100a0485b8201f64d48b83955359c807a5399d55affb1713bcc3909945ed6daefbe015b5dd31ed8fd7d4fcda041e03493bfcbe2869c379290561cdceb2905e5c49ec735df8a0ccdc52143e9aa88e535c01942635a025ea448183a856fdc9dbc3f9d9cc187b87a6108e9770b7f70ab7addd9972c641e85bfbc7496a1c37a12ec0c1a6e830c3ce872469ffb48d55e97e6b1a1f8e4ef4625949c89db6938beec5c0e56c76551e5508888bf42d52b3de5f9ba9e2eb3caf47392020bbe4c66eb20feb9cbb5997fe6b613faca4b4dd9ee5346063bc64ead935a817e6c2a4b6a05458cf221a43190876c659c9da560953a527ff5d1ab086ef3ee5bf9883d7eb86f6e03e442 AutoUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 AutoUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e atud.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 saBSI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 saBSI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob = 1900000001000000100000005dc45e2cd1845791bdde7600050af510030000000100000014000000627f8d7827656399d27d7f9044c9feb3f33efa9a6800000001000000080000000000876ace99d1010b000000010000000e00000074006800610077007400650000001d0000000100000010000000d4803ac36c256817d4ec5936f29bc4e71400000001000000140000005ff3246c8f9124af9b5f3eb0346af42d5ca85dcc090000000100000016000000301406082b0601050507030306082b06010505070301620000000100000020000000ab7036365c7154aa29c2c29f5d4191163b162a2225011357d56d07ffa7bc1f7253000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c00f00000001000000100000005f3d1aa6f471a760663eb7ef254281ef20000000010000002b0300003082032730820290a003020102020101300d06092a864886f70d01010405003081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d301e170d3936303830313030303030305a170d3230313233313233353935395a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d236366a8bd7c25b9eda8141628f38ee490455d6d0ef1c1b951647ef1848353a52f42b6a068f3b2fea56e3af868d9e17f79eb46575024defcb09a22151d89bd067d0ba0d92061473d493cb972a009c5c4e0cbcfa1552fcf2446eda114a6e089f2f2de3f9aa3a8673b6465358c88905bd8311b8733faa078df4424de7409d1c370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810026482c16c258fae816740caaaa5f543ff2d7c978605e5e6e37632277367eb217c434b9f50885fcc90138ff4dbef2164243e7bb5a46fbc1c6111ff14ab02846c9c3c4427dbcfaab596ed5b7518811e3a485196b824ca40c12ade9a4ae3ff1c349659a8cc5c83e25b79499bb92327107f0865eed5027a60da623f9bbcba6071442 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 19000000010000001000000060e2dc65295f1062e558f3fef235ed3c0f000000010000002000000071b437f087f3700ffd4e2fa46f42b6b810d7bf19adfedf951c023edd65b50b05030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e1400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b272000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 5c00000001000000040000000008000019000000010000001000000091fad483f14848a8a69b18b805cdbb3a030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d34317e000000010000000800000000c001b39667d6011d0000000100000010000000e871723e266f38af5d49cda2a502669c14000000010000001400000055e481d11180bed889b908a331f9a1240916b9700b000000010000001e00000045006e0074007200750073007400200028003200300034003800290000006200000001000000200000006dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb1777f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d8040000000100000010000000ee2931bc327e9ae6e8b5f751b434719020000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 uTorrent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e AutoUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 1400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b27030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e0f000000010000002000000071b437f087f3700ffd4e2fa46f42b6b810d7bf19adfedf951c023edd65b50b052000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob = 5c0000000100000004000000000400001900000001000000100000005dc45e2cd1845791bdde7600050af510030000000100000014000000627f8d7827656399d27d7f9044c9feb3f33efa9a6800000001000000080000000000876ace99d1010b000000010000000e00000074006800610077007400650000001d0000000100000010000000d4803ac36c256817d4ec5936f29bc4e71400000001000000140000005ff3246c8f9124af9b5f3eb0346af42d5ca85dcc090000000100000016000000301406082b0601050507030306082b06010505070301620000000100000020000000ab7036365c7154aa29c2c29f5d4191163b162a2225011357d56d07ffa7bc1f7253000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c00f00000001000000100000005f3d1aa6f471a760663eb7ef254281ef040000000100000010000000069f6979166690021b8c8ca2c3076f3a20000000010000002b0300003082032730820290a003020102020101300d06092a864886f70d01010405003081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d301e170d3936303830313030303030305a170d3230313233313233353935395a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d236366a8bd7c25b9eda8141628f38ee490455d6d0ef1c1b951647ef1848353a52f42b6a068f3b2fea56e3af868d9e17f79eb46575024defcb09a22151d89bd067d0ba0d92061473d493cb972a009c5c4e0cbcfa1552fcf2446eda114a6e089f2f2de3f9aa3a8673b6465358c88905bd8311b8733faa078df4424de7409d1c370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810026482c16c258fae816740caaaa5f543ff2d7c978605e5e6e37632277367eb217c434b9f50885fcc90138ff4dbef2164243e7bb5a46fbc1c6111ff14ab02846c9c3c4427dbcfaab596ed5b7518811e3a485196b824ca40c12ade9a4ae3ff1c349659a8cc5c83e25b79499bb92327107f0865eed5027a60da623f9bbcba6071442 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 saBSI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 saBSI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 0f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d8090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b060105050703076200000001000000200000006dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb1770b000000010000001e00000045006e00740072007500730074002000280032003000340038002900000014000000010000001400000055e481d11180bed889b908a331f9a1240916b9701d0000000100000010000000e871723e266f38af5d49cda2a502669c7e000000010000000800000000c001b39667d601030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343120000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 uTorrent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 040000000100000010000000ee2931bc327e9ae6e8b5f751b43471900f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d8090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b060105050703076200000001000000200000006dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb1770b000000010000001e00000045006e00740072007500730074002000280032003000340038002900000014000000010000001400000055e481d11180bed889b908a331f9a1240916b9701d0000000100000010000000e871723e266f38af5d49cda2a502669c7e000000010000000800000000c001b39667d601030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343119000000010000001000000091fad483f14848a8a69b18b805cdbb3a20000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551 uTorrent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\28903A635B5280FAE6774C0B6DA7D6BAA64AF2E8\Blob = 1900000001000000100000004fca18b530ab2d3765b8830436884be603000000010000001400000028903a635b5280fae6774c0b6da7d6baa64af2e87e00000001000000080000000000cf97a737d6011d00000001000000100000003475b6ae07580528b505a98d7f0fe1f4140000000100000014000000a0c38b44aa37a545bf97805ad1f178a29be95d8d7f0000000100000016000000301406082b0601050507030306082b0601050507030962000000010000002000000088497f01602f3154246ae28c4d5aef10f1d87ebb76626f4ae0b7f95ba796879909000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b00000001000000660000004100670065006e00630069006100200043006100740061006c0061006e0061002000640065002000430065007200740069006600690063006100630069006f00200028004e0049004600200051002d0030003800300031003100370036002d004900290000005300000001000000930000003081903022060c2b06010401f578010301330230123010060a2b0601040182373c0101030200c03022060c2b06010401f578010301330430123010060a2b0601040182373c0101030200c03022060c2b06010401f578010302050230123010060a2b0601040182373c0101030200c03022060c2b06010401f578010302330230123010060a2b0601040182373c0101030200c00f00000001000000140000001b8b713e8748912a4b073db0c8e9e3e5c0962d9820000000010000005a050000308205563082043ea0030201020210ee2b3debd421de14a862ac04f3ddc401300d06092a864886f70d01010505003081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d414343301e170d3033303130373233303030305a170d3331303130373232353935395a3081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d41434330820122300d06092a864886f70d01010105000382010f003082010a0282010100b322c74fe297429588478340f61d17f38373241e51f3988ac392b8ff409005708760c900a9b5946519221517c2436c66449a0d043e396fa54b7aaa63b78a449dd963918466e0280fba42e36e8ef714279369ee910ea35f0eb1eb66a2724f121386657a3edb4f07f4a70960da3a4299c7b27fb316951cc7f934b59485d5995ea048a07ee71765b8a275b81ef3e5427dafedf38a48645d821493d8c0e4ffb35072f276f6b35d425079d0943e6b0c00bed86b0e4e2aec3ed2cc82a218653313779e9a5d1a13d8c3db3dc8977aee70eda7e67cdb71cf2d9462df6dd6f538be3fa5850a19b8a8d809754270c4eaefcb0ec834a81222980cb81394b64becf0d090e7270203010001a381e33081e0301d0603551d1104163014811265635f61636340636174636572742e6e6574300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414a0c38b44aa37a545bf97805ad1f178a29be95d8d307f0603551d20047830763074060b2b06010401f5780103010a3065302c06082b06010505070201162068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c303506082b0601050507020230291a2756656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20300d06092a864886f70d01010505000382010100a0485b8201f64d48b83955359c807a5399d55affb1713bcc3909945ed6daefbe015b5dd31ed8fd7d4fcda041e03493bfcbe2869c379290561cdceb2905e5c49ec735df8a0ccdc52143e9aa88e535c01942635a025ea448183a856fdc9dbc3f9d9cc187b87a6108e9770b7f70ab7addd9972c641e85bfbc7496a1c37a12ec0c1a6e830c3ce872469ffb48d55e97e6b1a1f8e4ef4625949c89db6938beec5c0e56c76551e5508888bf42d52b3de5f9ba9e2eb3caf47392020bbe4c66eb20feb9cbb5997fe6b613faca4b4dd9ee5346063bc64ead935a817e6c2a4b6a05458cf221a43190876c659c9da560953a527ff5d1ab086ef3ee5bf9883d7eb86f6e03e442 AutoUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 atud.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e atud.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf50f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe -
Runs net.exe
-
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 582 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 584 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 588 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 590 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 6 IoCs
pid Process 2828 Explorer.EXE 2828 Explorer.EXE 4056 mbamtray.exe 6940 mbam.exe 3316 mbam.exe 4980 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4488 chrome.exe 4488 chrome.exe 4976 chrome.exe 4976 chrome.exe 1076 chrome.exe 1076 chrome.exe 100 chrome.exe 100 chrome.exe 3436 chrome.exe 3436 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5712 chrome.exe 5312 chrome.exe 5312 chrome.exe 5640 chrome.exe 5640 chrome.exe 4492 chrome.exe 4492 chrome.exe 4852 chrome.exe 4852 chrome.exe 4652 chrome.exe 4652 chrome.exe 1796 chrome.exe 1796 chrome.exe 5160 chrome.exe 5160 chrome.exe 4952 chrome.exe 4952 chrome.exe 3908 chrome.exe 3908 chrome.exe 5248 chrome.exe 5248 chrome.exe 5732 saBSI.exe 5732 saBSI.exe 5732 saBSI.exe 5732 saBSI.exe 5732 saBSI.exe 5732 saBSI.exe 5732 saBSI.exe 5732 saBSI.exe 5732 saBSI.exe 5732 saBSI.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5344 saBSI.exe 5344 saBSI.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe 5508 avg_secure_browser_setup.exe -
Suspicious behavior: GetForegroundWindowSpam 7 IoCs
pid Process 4484 uTorrent.exe 2828 Explorer.EXE 7148 PhotoScapeSetup_V3.7.exe 4056 mbamtray.exe 6940 mbam.exe 984 taskmgr.exe 4980 explorer.exe -
Suspicious behavior: LoadsDriver 29 IoCs
pid Process 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
pid Process 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 5472 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5472 AUDIODG.EXE Token: SeManageVolumePrivilege 5564 uTorrent.exe Token: SeDebugPrivilege 4988 AVGBrowserUpdate.exe Token: SeDebugPrivilege 4988 AVGBrowserUpdate.exe Token: SeDebugPrivilege 4988 AVGBrowserUpdate.exe Token: 33 5164 AVGBrowserInstaller.exe Token: SeIncBasePriorityPrivilege 5164 AVGBrowserInstaller.exe Token: SeManageVolumePrivilege 4484 uTorrent.exe Token: 33 2284 AVGBrowserCrashHandler.exe Token: SeIncBasePriorityPrivilege 2284 AVGBrowserCrashHandler.exe Token: SeDebugPrivilege 4988 AVGBrowserUpdate.exe Token: 33 5772 AVGBrowserCrashHandler64.exe Token: SeIncBasePriorityPrivilege 5772 AVGBrowserCrashHandler64.exe Token: SeDebugPrivilege 2364 ASCUpgrade.exe Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: 33 3652 ASCService.exe Token: SeIncBasePriorityPrivilege 3652 ASCService.exe Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeDebugPrivilege 2300 Monitor.exe Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeLoadDriverPrivilege 2300 Monitor.exe Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE Token: SeCreatePagefilePrivilege 2828 Explorer.EXE Token: SeShutdownPrivilege 2828 Explorer.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4484 uTorrent.exe 4484 uTorrent.exe 4484 uTorrent.exe 4484 uTorrent.exe 4468 Setup.exe 4468 Setup.exe 4468 Setup.exe 4468 Setup.exe 4468 Setup.exe 5404 AutoSweep.exe 5404 AutoSweep.exe 5404 AutoSweep.exe 5404 AutoSweep.exe 5404 AutoSweep.exe 4744 ActionCenterDownloader.exe 4744 ActionCenterDownloader.exe 4744 ActionCenterDownloader.exe 4744 ActionCenterDownloader.exe 4744 ActionCenterDownloader.exe 4744 ActionCenterDownloader.exe 4744 ActionCenterDownloader.exe 4744 ActionCenterDownloader.exe 5508 ASCTray.exe 5508 ASCTray.exe 5508 ASCTray.exe 5508 ASCTray.exe 5508 ASCTray.exe 5508 ASCTray.exe 5508 ASCTray.exe 5508 ASCTray.exe 5508 ASCTray.exe 5508 ASCTray.exe 5508 ASCTray.exe 5508 ASCTray.exe 5508 ASCTray.exe 5508 ASCTray.exe 5508 ASCTray.exe 4744 ActionCenterDownloader.exe 3932 AutoCare.exe 3932 AutoCare.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 432 winrar-x64-602.exe 432 winrar-x64-602.exe 432 winrar-x64-602.exe 1472 uninstall.exe 2828 Explorer.EXE 2828 Explorer.EXE 4924 idman638build3.exe 3812 IDM1.tmp 4608 idmBroker.exe 6064 IDMan.exe 2828 Explorer.EXE 2828 Explorer.EXE 6064 IDMan.exe 6064 IDMan.exe 6064 IDMan.exe 2020 iScrInit.exe 1752 Conhost.exe 6348 AUpdate.exe 2828 Explorer.EXE 2828 Explorer.EXE 3944 Uninstall.exe 6064 IDMan.exe 2828 Explorer.EXE 2828 Explorer.EXE 6064 IDMan.exe 6064 IDMan.exe 3744 MediumILStart.exe 6032 IDMan.exe 6032 IDMan.exe 6032 IDMan.exe 2520 Uninstall.exe 6032 IDMan.exe 6032 IDMan.exe 6032 IDMan.exe 6032 IDMan.exe 6032 IDMan.exe 1436 IEMonitor.exe 1436 IEMonitor.exe 1436 IEMonitor.exe 5556 get-graphics-offsets64.exe 6176 get-graphics-offsets32.exe 4060 AUpdate.exe 1176 get-graphics-offsets64.exe 6040 get-graphics-offsets32.exe 3244 AUpdate.exe 2828 Explorer.EXE 2828 Explorer.EXE 2828 Explorer.EXE 6032 IDMan.exe 6032 IDMan.exe 6032 IDMan.exe 1488 bittorrent_installer.exe 4764 Carrier.exe 540 bittorrent.exe 2628 u4vmpt3n.n4w.exe 4056 xybbujjh.fxf.exe 2828 Explorer.EXE 2828 Explorer.EXE 2828 Explorer.EXE 2828 Explorer.EXE 5340 csc.exe 408 csc.exe 2828 Explorer.EXE 4576 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4976 wrote to memory of 948 4976 chrome.exe 90 PID 4976 wrote to memory of 948 4976 chrome.exe 90 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 2892 4976 chrome.exe 93 PID 4976 wrote to memory of 4488 4976 chrome.exe 94 PID 4976 wrote to memory of 4488 4976 chrome.exe 94 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95 PID 4976 wrote to memory of 4448 4976 chrome.exe 95
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Sets desktop wallpaper using registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2828 -
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\m.png2⤵PID:4740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd0f04f50,0x7fffd0f04f60,0x7fffd0f04f703⤵PID:948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1624 /prefetch:23⤵PID:2892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1992 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 /prefetch:83⤵PID:4448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2888 /prefetch:13⤵PID:4044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2916 /prefetch:13⤵PID:3024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4528 /prefetch:83⤵PID:1816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:13⤵PID:964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4860 /prefetch:83⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4860 /prefetch:83⤵PID:1988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4236 /prefetch:83⤵PID:4552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4492 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4944 /prefetch:83⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4352 /prefetch:83⤵PID:3728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4376 /prefetch:83⤵PID:1544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:13⤵PID:2244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5252 /prefetch:83⤵PID:3440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4428 /prefetch:83⤵PID:2252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 /prefetch:83⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4944 /prefetch:83⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5408 /prefetch:83⤵PID:1816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4308 /prefetch:83⤵PID:5116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4296 /prefetch:83⤵PID:5060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4396 /prefetch:83⤵PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5472 /prefetch:83⤵PID:3244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5404 /prefetch:83⤵PID:2808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5832 /prefetch:83⤵PID:2184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4248 /prefetch:83⤵PID:1256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4268 /prefetch:83⤵PID:1764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5724 /prefetch:83⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:13⤵PID:4216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:13⤵PID:4640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3328 /prefetch:83⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:13⤵PID:740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:13⤵PID:4908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:13⤵PID:920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:13⤵PID:4920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:13⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:13⤵PID:4432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:13⤵PID:1620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:13⤵PID:2984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:13⤵PID:3056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:13⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7708 /prefetch:13⤵PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7548 /prefetch:13⤵PID:1344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7420 /prefetch:13⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:13⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8224 /prefetch:13⤵PID:4044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:13⤵PID:3008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:13⤵PID:1336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:13⤵PID:2492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8468 /prefetch:13⤵PID:4324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:13⤵PID:1128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:13⤵PID:1464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=836 /prefetch:13⤵PID:5212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8484 /prefetch:13⤵PID:5236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8568 /prefetch:13⤵PID:5288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8912 /prefetch:13⤵PID:5340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8960 /prefetch:13⤵PID:5392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8932 /prefetch:13⤵PID:5400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9308 /prefetch:13⤵PID:5524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9424 /prefetch:13⤵PID:5536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9580 /prefetch:13⤵PID:5596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9564 /prefetch:13⤵PID:5708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9436 /prefetch:13⤵PID:5716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8760 /prefetch:13⤵PID:5768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2820 /prefetch:13⤵PID:5932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6700 /prefetch:83⤵PID:5988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8904 /prefetch:13⤵PID:6028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7660 /prefetch:13⤵PID:6084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:13⤵PID:180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9688 /prefetch:13⤵PID:1732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9876 /prefetch:13⤵PID:3908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10020 /prefetch:13⤵PID:2188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9904 /prefetch:13⤵PID:3712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8384 /prefetch:13⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:13⤵PID:4356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:13⤵PID:2544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9240 /prefetch:13⤵PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9692 /prefetch:83⤵PID:5312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:13⤵PID:5324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8720 /prefetch:13⤵PID:5412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:13⤵PID:4324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:13⤵PID:5344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2484 /prefetch:13⤵PID:5420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:13⤵PID:5600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6804 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:5712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:13⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:13⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:13⤵PID:5792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10028 /prefetch:13⤵PID:4076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:13⤵PID:3384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:13⤵PID:4436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:13⤵PID:3568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:13⤵PID:2464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6336 /prefetch:83⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:13⤵PID:5348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:13⤵PID:5292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:5312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9076 /prefetch:83⤵PID:6024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6952 /prefetch:83⤵PID:5520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7992 /prefetch:13⤵PID:4772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8136 /prefetch:13⤵PID:1196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:13⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9068 /prefetch:13⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9968 /prefetch:13⤵PID:364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9224 /prefetch:13⤵PID:5196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7992 /prefetch:13⤵PID:5712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9908 /prefetch:83⤵PID:5568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8960 /prefetch:83⤵PID:5464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6580 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:5640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6636 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9532 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9140 /prefetch:13⤵PID:4364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9164 /prefetch:83⤵PID:1296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10408 /prefetch:83⤵PID:1068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10392 /prefetch:83⤵PID:964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7388 /prefetch:83⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7748 /prefetch:83⤵PID:460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=122 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10388 /prefetch:13⤵PID:5312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10964 /prefetch:13⤵PID:5164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=124 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10964 /prefetch:13⤵PID:1520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=125 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10284 /prefetch:13⤵PID:4240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=126 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10464 /prefetch:13⤵PID:5604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=127 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10512 /prefetch:13⤵PID:5248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=128 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10468 /prefetch:13⤵PID:4456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6196 /prefetch:83⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7740 /prefetch:83⤵PID:3712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=131 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8644 /prefetch:13⤵PID:1716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10576 /prefetch:83⤵PID:688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8156 /prefetch:83⤵PID:5464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10024 /prefetch:83⤵PID:3440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7756 /prefetch:83⤵PID:6024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9204 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:1796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6852 /prefetch:83⤵PID:5352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10496 /prefetch:83⤵PID:1296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=140 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:13⤵PID:5648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7332 /prefetch:83⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9184 /prefetch:83⤵PID:5260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8116 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:5160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10376 /prefetch:83⤵PID:1172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10420 /prefetch:83⤵PID:5604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=146 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9540 /prefetch:13⤵PID:3640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2156 /prefetch:83⤵PID:3228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2148 /prefetch:83⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3576 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10572 /prefetch:83⤵PID:5144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9328 /prefetch:83⤵PID:1632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=152 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9416 /prefetch:13⤵PID:4232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:83⤵PID:5456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2148 /prefetch:83⤵PID:5560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9024 /prefetch:83⤵PID:5548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7720 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10376 /prefetch:83⤵PID:460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6328 /prefetch:83⤵PID:3932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=159 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:13⤵PID:5640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9328 /prefetch:83⤵PID:4172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1492 /prefetch:83⤵PID:5344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10256 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:5248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7540 /prefetch:83⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1540,150480554055998924,6457784904942564779,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9552 /prefetch:83⤵PID:1712
-
-
-
C:\Users\Admin\Downloads\utorrent_installer.exe"C:\Users\Admin\Downloads\utorrent_installer.exe"2⤵
- Executes dropped EXE
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\is-QH3CP.tmp\utorrent_installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-QH3CP.tmp\utorrent_installer.tmp" /SL5="$4027E,875149,815616,C:\Users\Admin\Downloads\utorrent_installer.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\is-VNPEP.tmp\uTorrent.exe"C:\Users\Admin\AppData\Local\Temp\is-VNPEP.tmp\uTorrent.exe" /S /FORCEINSTALL 11100101011111104⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5564
-
-
C:\Users\Admin\AppData\Local\Temp\is-VNPEP.tmp\prod0_extract\saBSI.exe"C:\Users\Admin\AppData\Local\Temp\is-VNPEP.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:5732 -
C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe"C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91088 PaidDistribution=true saBsiVersion=4.1.1.663 /no_self_update5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5344 -
C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe"C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1156 -
C:\Program Files\McAfee\Temp1781269283\installer.exe"C:\Program Files\McAfee\Temp1781269283\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4756 -
C:\Windows\SYSTEM32\sc.exesc.exe create "McAfee WebAdvisor" binPath= "\"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe\"" start= auto DisplayName= "McAfee WebAdvisor"8⤵
- Launches sc.exe
PID:5852
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"8⤵PID:5552
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"9⤵
- Loads dropped DLL
PID:1256
-
-
-
C:\Windows\SYSTEM32\sc.exesc.exe description "McAfee WebAdvisor" "McAfee WebAdvisor Service"8⤵
- Launches sc.exe
PID:5052
-
-
C:\Windows\SYSTEM32\sc.exesc.exe failure "McAfee WebAdvisor" reset= 3600 actions= restart/1/restart/1000/restart/3000/restart/30000/restart/1800000//08⤵
- Launches sc.exe
PID:2956
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"8⤵
- Loads dropped DLL
PID:6132
-
-
C:\Windows\SYSTEM32\sc.exesc.exe start "McAfee WebAdvisor"8⤵
- Launches sc.exe
PID:624
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"8⤵PID:4472
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"9⤵
- Loads dropped DLL
PID:5444
-
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"8⤵
- Registers COM server for autorun
- Loads dropped DLL
PID:3924
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-VNPEP.tmp\prod1_extract\avg_secure_browser_setup.exe"C:\Users\Admin\AppData\Local\Temp\is-VNPEP.tmp\prod1_extract\avg_secure_browser_setup.exe" /s /run_source=avg_ads_is_control /is_pixel_psh=2OYijmJRIIS283REJDOU2hXYyR2NDUqHLSbJVHYo1wFoNAarVNvSjk42bNPXocg6NUkpQseEOGk9f5gE2nFHX /make-default4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\nsoD0F6.tmp\AVGBrowserUpdateSetup.exeAVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=es-ES&brand=9145&installargs=--make-chrome-default --force-default-win10 --reset-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome --private-browsing"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3040 -
C:\Program Files (x86)\GUME094.tmp\AVGBrowserUpdate.exe"C:\Program Files (x86)\GUME094.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=es-ES&brand=9145&installargs=--make-chrome-default --force-default-win10 --reset-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome --private-browsing"6⤵
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:4988 -
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2476 -
C:\Program Files (x86)\AVG\Browser\Update\1.8.1207.2\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1207.2\AVGBrowserUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4064
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1207.2\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1207.2\AVGBrowserUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:4872
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1207.2\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1207.2\AVGBrowserUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:5816
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTIwNy4yIiBzaGVsbF92ZXJzaW9uPSIxLjguMTIwNy4yIiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0ie0JCOEQ5MTE1LUNBQ0QtNDA2Ny1BREE3LUMzODJGREY5NjcwOX0iIGNlcnRfZXhwX2RhdGU9IjIwMjIxMDIwIiB1c2VyaWQ9Ins3NkRBODJGMi0xRkZDLTQ5MEMtQjdCQS01MDU0MkRCOEQ4NEJ9IiB1c2VyaWRfZGF0ZT0iMjAyMjExMjkiIG1hY2hpbmVpZD0iezAwMDA1OEQ0LUIyN0EtMDEyQi05RTNFLTQ1NDE0NzFFNkM2OX0iIG1hY2hpbmVpZF9kYXRlPSIyMDIyMTEyOSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9Ins1MDEzRjJDMC0xREYwLTQxOTQtQTMzNC1FNUNEQkUyOTA5MzF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjQiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xMjA3LjIiIGxhbmc9ImVzLUVTIiBicmFuZD0iOTE0NSIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMjQyOSIvPjwvYXBwPjwvcmVxdWVzdD47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4368
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=es-ES&brand=9145&installargs=--make-chrome-default --force-default-win10 --reset-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome --private-browsing" /installsource otherinstallcmd /sessionid "{BB8D9115-CACD-4067-ADA7-C382FDF96709}" /silent7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /nobreak /t 10 && del /F /Q C:\Users\Admin\AppData\Local\Temp\is-VNPEP.tmp\prod1_extract\avg_secure_browser_setup.exe && rmdir /Q C:\Users\Admin\AppData\Local\Temp\is-VNPEP.tmp\prod1_extract5⤵PID:5208
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak /t 106⤵
- Delays execution with timeout.exe
PID:4420
-
-
-
-
C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe"C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe"4⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4484 -
C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46552\utorrentie.exe"C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46552\utorrentie.exe" uTorrent_4484_03B2CF20_528987286 µTorrent4823DF041B09 uTorrent ce unp5⤵
- Executes dropped EXE
PID:688
-
-
C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46552\utorrentie.exe"C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.5_46552\utorrentie.exe" uTorrent_4484_03ACAA78_450106649 µTorrent4823DF041B09 uTorrent ce unp5⤵
- Executes dropped EXE
PID:5520
-
-
C:\Users\Admin\AppData\Roaming\uTorrent\helper\helper.exe"C:\Users\Admin\AppData\Roaming\uTorrent\helper\helper.exe" 50502 --hval onQEUssYiLqvu5Zh -- -pid 4484 -version 465525⤵
- Executes dropped EXE
PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://utorrent.com/prodnews?v=3%2e5%2e5%2e1%2e46552&pv=0.0.0.0.05⤵PID:1492
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0x98,0x124,0x7fffd15d46f8,0x7fffd15d4708,0x7fffd15d47186⤵PID:5836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13421991376231547372,12959027158097521961,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:26⤵PID:5296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13421991376231547372,12959027158097521961,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2636 /prefetch:36⤵PID:3752
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.huobi.com/?utm_source=UT&utm_medium=prodnews&inviter_id=11350560&lang=es&geo=ie5⤵
- Adds Run key to start application
- Enumerates system info in registry
PID:5816 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fffd15d46f8,0x7fffd15d4708,0x7fffd15d47186⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,356892105100426009,43881895094945678,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:26⤵PID:3328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,356892105100426009,43881895094945678,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:36⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,356892105100426009,43881895094945678,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=3176 /prefetch:86⤵PID:2228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,356892105100426009,43881895094945678,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:16⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,356892105100426009,43881895094945678,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:16⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,356892105100426009,43881895094945678,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:16⤵PID:1064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2116,356892105100426009,43881895094945678,131072 --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4600 /prefetch:86⤵PID:6044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,356892105100426009,43881895094945678,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:16⤵PID:1660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2116,356892105100426009,43881895094945678,131072 --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5676 /prefetch:86⤵PID:708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,356892105100426009,43881895094945678,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:16⤵PID:5956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,356892105100426009,43881895094945678,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6420 /prefetch:86⤵PID:4704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings6⤵PID:5488
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf4,0x128,0x12c,0x270,0x124,0x7ff680105460,0x7ff680105470,0x7ff6801054807⤵PID:5952
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,356892105100426009,43881895094945678,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6420 /prefetch:86⤵PID:5484
-
-
-
-
-
-
C:\Users\Admin\Downloads\winrar-x64-602.exe"C:\Users\Admin\Downloads\winrar-x64-602.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:432 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1472
-
-
-
C:\Users\Admin\Downloads\advanced-systemcare-setup.exe"C:\Users\Admin\Downloads\advanced-systemcare-setup.exe"2⤵
- Executes dropped EXE
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\is-F8685.tmp\advanced-systemcare-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-F8685.tmp\advanced-systemcare-setup.tmp" /SL5="$802B4,46291771,137216,C:\Users\Admin\Downloads\advanced-systemcare-setup.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\is-AAMHG.tmp\Installer\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-AAMHG.tmp\Installer\Setup.exe" /InnoSetup "C:\Users\Admin\Downloads\advanced-systemcare-setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of SendNotifyMessage
PID:4468 -
C:\Users\Admin\Downloads\advanced-systemcare-setup.exe"C:\Users\Admin\Downloads\advanced-systemcare-setup.exe" /VerySilent /DIR="C:\Program Files (x86)\IObit\Advanced SystemCare\" /UNINSTALL /INSTALLER /NORESTART /TASKS="desktopicon" /CreateTaskbar5⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\is-OS418.tmp\advanced-systemcare-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-OS418.tmp\advanced-systemcare-setup.tmp" /SL5="$10424,46291771,137216,C:\Users\Admin\Downloads\advanced-systemcare-setup.exe" /VerySilent /DIR="C:\Program Files (x86)\IObit\Advanced SystemCare\" /UNINSTALL /INSTALLER /NORESTART /TASKS="desktopicon" /CreateTaskbar6⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\is-NHHVO.tmp\ASCUpgrade.exe"C:\Users\Admin\AppData\Local\Temp\is-NHHVO.tmp\ASCUpgrade.exe" /upgrade "c:\program files (x86)\iobit\advanced systemcare"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
C:\Users\Admin\AppData\Local\Temp\is-NHHVO.tmp\ASCUpgrade.exe"C:\Users\Admin\AppData\Local\Temp\is-NHHVO.tmp\ASCUpgrade.exe" /CleanDir "C:\Program Files (x86)\IObit\Advanced SystemCare\"7⤵
- Executes dropped EXE
PID:4872
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\LocalLang.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\LocalLang.exe"7⤵
- Executes dropped EXE
PID:3440
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\ASCInit.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\ASCInit.exe" /install /CreateTaskBar /Installer=true /insur=7⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
PID:2352 -
C:\Program Files (x86)\IObit\Advanced SystemCare\Register.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\Register.exe" /post8⤵
- Executes dropped EXE
PID:3356
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SC description AdvancedSystemCareService15 "Advanced SystemCare Service"8⤵PID:376
-
C:\Windows\SysWOW64\sc.exeSC description AdvancedSystemCareService15 "Advanced SystemCare Service"9⤵
- Launches sc.exe
PID:2592
-
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\UninstallInfo.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\UninstallInfo.exe" /install asc158⤵
- Executes dropped EXE
PID:2372
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\PinLink\ICONPIN64.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\PinLink\ICONPIN64.exe" Pin "C:\Users\Public\Desktop\Advanced SystemCare.lnk"8⤵
- Executes dropped EXE
PID:3944
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IObit\Advanced SystemCare\ASCExtMenu_64.dll"8⤵
- Modifies system executable filetype association
PID:3432
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\BrowserCleaner.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\BrowserCleaner.exe" /InitData8⤵
- Executes dropped EXE
PID:740
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\PrivacyShield.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\PrivacyShield.exe" /ShowStr=silentWriteCache8⤵
- Executes dropped EXE
PID:2644
-
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\PPUninstaller.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\PPUninstaller.exe" /i7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\RealTimeProtector.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\RealTimeProtector.exe" /install7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Program Files (x86)\IObit\Advanced SystemCare\RealTimeProtector.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\RealTimeProtector.exe" /Run8⤵
- Executes dropped EXE
PID:6008
-
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\DiskDefrag.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\DiskDefrag.exe" /install7⤵
- Executes dropped EXE
PID:4372
-
-
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\BrowserProtect.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\BrowserProtect.exe" /TurnOn5⤵
- Executes dropped EXE
PID:4256
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe"5⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:920 -
C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe" /manual6⤵
- Suspicious use of SendNotifyMessage
PID:5508
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\ASCFeature.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\ASCFeature.exe" /asc /user6⤵PID:3176
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\AutoUpdate.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\AutoUpdate.exe" /check6⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies system certificate store
PID:3120 -
C:\Program Files (x86)\IObit\Advanced SystemCare\bf.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\bf.exe" /br7⤵PID:6956
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\FreeBigupgrade161.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\FreeBigupgrade161.exe" /sp7⤵PID:6972
-
C:\Users\Admin\AppData\Local\Temp\ASC_FreeBigUpgrade_Downloader\FreeBigupgrade161.exe"C:\Users\Admin\AppData\Local\Temp\ASC_FreeBigUpgrade_Downloader\FreeBigupgrade161.exe"8⤵
- Checks computer location settings
PID:5292 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --single-argument https://www.iobit.com/appgoto.php?name=asc&ver=15.5.0.262&lan=es&to=update9⤵PID:3892
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=107.0.19254.108 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fffcd59aea8,0x7fffcd59aeb8,0x7fffcd59aec810⤵PID:5456
-
-
-
C:\Users\Admin\AppData\Local\Temp\ASC_FreeBigUpgrade_Downloader\ActionCenterDownloader.exe"C:\Users\Admin\AppData\Local\Temp\ASC_FreeBigUpgrade_Downloader\ActionCenterDownloader.exe" "iTop Screen Recorder Bigupgrade"9⤵PID:440
-
-
-
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\ASCFeature.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\ASCFeature.exe" /u http://stats.iobit.com/active_month.php /a asc15 /p es /v 15.5.0.262 /t 1 /d 76⤵PID:2352
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\ASCVER.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\ASCVER.exe" /product=ASC /Ver=15.5.0.262 /hwnd=1322086⤵PID:5864
-
-
C:\Windows\SysWOW64\sc.exesc start MpsSvc6⤵
- Launches sc.exe
PID:5584
-
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe"5⤵
- Maps connected drives based on registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\ActionCenterDownloader.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\ActionCenterDownloader.exe" /Product=ASC15 "/Config=http://update.iobit.com/infofiles/installer/Freeware-asc.upt" "iTop VPN Installer B" "iTop Screen Recorder Installer" "iTop PDF Installer"5⤵
- Suspicious use of SendNotifyMessage
PID:4744 -
C:\ProgramData\IObit\ASCDownloader\ASC15\iTopSetup.exe"C:\ProgramData\IObit\ASCDownloader\ASC15\iTopSetup.exe" /sp- /verysilent /suppressmsgboxes /NORESTART /insur=asc_inb6⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\is-7NTB1.tmp\iTopSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-7NTB1.tmp\iTopSetup.tmp" /SL5="$902C6,26431840,141312,C:\ProgramData\IObit\ASCDownloader\ASC15\iTopSetup.exe" /sp- /verysilent /suppressmsgboxes /NORESTART /insur=asc_inb7⤵
- Drops file in Program Files directory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\is-C83JB.tmp\ugin.exe"C:\Users\Admin\AppData\Local\Temp\is-C83JB.tmp\ugin.exe" /kill /UPGRADE8⤵PID:2476
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "ugin.exe"8⤵
- Kills process with taskkill
PID:5844
-
-
C:\Program Files (x86)\iTop VPN\ugin.exe"C:\Program Files (x86)\iTop VPN\ugin.exe" /kill /updagrade8⤵PID:5796
-
-
C:\Program Files (x86)\iTop VPN\iTopVPN.exe"C:\Program Files (x86)\iTop VPN\iTopVPN.exe" /installinit8⤵PID:4872
-
-
C:\Program Files (x86)\iTop VPN\ugin.exe"C:\Program Files (x86)\iTop VPN\ugin.exe" /init /ver 4.2.0.3828 /force /f /inspkg "C:\ProgramData\IObit\ASCDownloader\ASC15\iTopSetup.exe" /insur "asc_inb" /PINTOTASKBAR8⤵PID:2464
-
C:\Windows\SysWOW64\cmd.execmd.exe /c sc stop windivert9⤵PID:1896
-
C:\Windows\SysWOW64\sc.exesc stop windivert10⤵
- Launches sc.exe
PID:4352
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c sc stop windivert9⤵PID:6032
-
C:\Windows\SysWOW64\sc.exesc stop windivert10⤵
- Launches sc.exe
PID:3968
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c sc delete windivert9⤵PID:1408
-
C:\Windows\SysWOW64\sc.exesc delete windivert10⤵
- Launches sc.exe
PID:5172
-
-
-
C:\Program Files (x86)\iTop VPN\icop64.exe"C:\Program Files (x86)\iTop VPN\icop64.exe" Pin "C:\Program Files (x86)\iTop VPN\iTopVPN.exe"9⤵PID:1076
-
-
C:\Program Files (x86)\iTop VPN\ugin.exe"C:\Program Files (x86)\iTop VPN\ugin.exe" /checkwelcome9⤵PID:2188
-
-
-
C:\Program Files (x86)\iTop VPN\ullc.exe"C:\Program Files (x86)\iTop VPN\ullc.exe"8⤵PID:5692
-
-
C:\Program Files (x86)\iTop VPN\ugin.exe"C:\Program Files (x86)\iTop VPN\ugin.exe" /setlan "Spanish"8⤵PID:5576
-
-
C:\Program Files (x86)\iTop VPN\unpr.exe"C:\Program Files (x86)\iTop VPN\unpr.exe" /install itop48⤵PID:5288
-
-
C:\Program Files (x86)\iTop VPN\iTopVPN.exe"C:\Program Files (x86)\iTop VPN\iTopVPN.exe" /install8⤵
- Checks computer location settings
- Drops file in Program Files directory
PID:2124 -
C:\Program Files (x86)\iTop VPN\aud.exe"C:\Program Files (x86)\iTop VPN\aud.exe" /u https://stats.itopvpn.com/active_month.php /a itop4 /p es /v 4.2.0.3828 /t 10 /d 7 / /user9⤵PID:3476
-
-
C:\Program Files (x86)\iTop VPN\aud.exe"C:\Program Files (x86)\iTop VPN\aud.exe" /itop /dayactive9⤵PID:2052
-
-
C:\Program Files (x86)\iTop VPN\atud.exe"C:\Program Files (x86)\iTop VPN\atud.exe" /auto9⤵
- Modifies system certificate store
PID:4176 -
C:\Program Files (x86)\iTop VPN\Pub\itopbf.exe"C:\Program Files (x86)\iTop VPN\Pub\itopbf.exe" /vpn10⤵PID:6576
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ipconfig /flushdns9⤵PID:632
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /flushdns10⤵
- Gathers network information
PID:4512
-
-
-
C:\Program Files (x86)\iTop VPN\iTopVPNMini.exe"C:\Program Files (x86)\iTop VPN\iTopVPNMini.exe" /antrun /install /state 09⤵
- Checks computer location settings
PID:2464
-
-
-
C:\Program Files (x86)\iTop VPN\ugin.exe"C:\Program Files (x86)\iTop VPN\ugin.exe" /combinslog "C:\Users\Admin\AppData\Local\Temp\Setup Log 2022-11-29 #003.txt"8⤵PID:3524
-
-
-
-
C:\ProgramData\IObit\ASCDownloader\ASC15\ISRSetup.exe"C:\ProgramData\IObit\ASCDownloader\ASC15\ISRSetup.exe" /sp- /verysilent /suppressmsgboxes /insur=asc_in6⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\is-J79V1.tmp\ISRSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-J79V1.tmp\ISRSetup.tmp" /SL5="$105D4,95546839,228864,C:\ProgramData\IObit\ASCDownloader\ASC15\ISRSetup.exe" /sp- /verysilent /suppressmsgboxes /insur=asc_in7⤵
- Checks computer location settings
- Drops file in Program Files directory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\is-G3CD8.tmp\iScrInit.exe"C:\Users\Admin\AppData\Local\Temp\is-G3CD8.tmp\iScrInit.exe" /CopyOldConfig /installdir=""8⤵PID:5380
-
-
C:\Users\Admin\AppData\Local\Temp\is-G3CD8.tmp\iScrInit.exe"C:\Users\Admin\AppData\Local\Temp\is-G3CD8.tmp\iScrInit.exe" /CleanReg8⤵PID:6136
-
-
C:\Users\Admin\AppData\Local\Temp\is-G3CD8.tmp\iScrInit.exe"C:\Users\Admin\AppData\Local\Temp\is-G3CD8.tmp\iScrInit.exe" /KillProcess /installdir="C:\Program Files\iTop Screen Recorder"8⤵PID:4556
-
-
C:\Users\Admin\AppData\Local\Temp\is-G3CD8.tmp\iScrInit.exe"C:\Users\Admin\AppData\Local\Temp\is-G3CD8.tmp\iScrInit.exe" /DeleteAllFile /reinstall=1 /installdir="C:\Program Files\iTop Screen Recorder"8⤵PID:4732
-
-
C:\Program Files\iTop Screen Recorder\LocalLang.exe"C:\Program Files\iTop Screen Recorder\LocalLang.exe"8⤵PID:4512
-
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /reinstall=0 /insur=asc_in /SetupFile="C:\ProgramData\IObit\ASCDownloader\ASC15\ISRSetup.exe"8⤵PID:6684
-
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /install8⤵
- Checks computer location settings
PID:2292 -
C:\Program Files\iTop Screen Recorder\GpuCheck.exe"C:\Program Files\iTop Screen Recorder\GpuCheck.exe" /GpuCheck9⤵
- Checks SCSI registry key(s)
PID:3636
-
-
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /pin=08⤵PID:6832
-
-
C:\Program Files\iTop Screen Recorder\UninstallInfo.exe"C:\Program Files\iTop Screen Recorder\UninstallInfo.exe" /install isr38⤵PID:6872
-
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /PostSystemInfo8⤵
- Checks computer location settings
PID:6660
-
-
C:\Program Files\iTop Screen Recorder\iScrRec.exe"C:\Program Files\iTop Screen Recorder\iScrRec.exe"8⤵
- Checks computer location settings
PID:6472 -
C:\Program Files\iTop Screen Recorder\GpuCheck.exe"C:\Program Files\iTop Screen Recorder\GpuCheck.exe" /GpuCheck9⤵PID:6972
-
-
C:\Program Files\iTop Screen Recorder\graphics-check.exe"C:\Program Files\iTop Screen Recorder\graphics-check.exe"9⤵PID:4756
-
-
C:\Program Files\iTop Screen Recorder\AutoUpdate.exe"C:\Program Files\iTop Screen Recorder\AutoUpdate.exe" /auto /start9⤵PID:2080
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /AutoupdateUac10⤵PID:6948
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c Schtasks /run /tn "iTop Screen Recorder UAC"9⤵PID:6644
-
C:\Windows\system32\schtasks.exeSchtasks /run /tn "iTop Screen Recorder UAC"10⤵PID:7160
-
-
-
C:\Program Files\iTop Screen Recorder\get-graphics-offsets32.exe"C:\Program Files\iTop Screen Recorder\get-graphics-offsets32.exe" /main9⤵PID:1752
-
-
C:\Program Files\iTop Screen Recorder\get-graphics-offsets64.exe"C:\Program Files\iTop Screen Recorder\get-graphics-offsets64.exe" /main9⤵PID:2020
-
-
-
-
-
C:\ProgramData\IObit\ASCDownloader\ASC15\PDFSetup.exe"C:\ProgramData\IObit\ASCDownloader\ASC15\PDFSetup.exe" /sp- /verysilent /suppressmsgboxes /insur=asc_inw6⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\is-81H65.tmp\PDFSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-81H65.tmp\PDFSetup.tmp" /SL5="$30532,171180782,199680,C:\ProgramData\IObit\ASCDownloader\ASC15\PDFSetup.exe" /sp- /verysilent /suppressmsgboxes /insur=asc_inw7⤵
- Drops file in Program Files directory
PID:6380 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" -f -im iTopPDF.exe8⤵
- Kills process with taskkill
PID:7152
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" -f -im Launcher.exe8⤵
- Kills process with taskkill
PID:6524
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" -f -im AutoUpdate.exe8⤵
- Kills process with taskkill
PID:4512
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" -f -im AUpdate.exe8⤵
- Kills process with taskkill
PID:6360
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\iTop PDF\PDFShellExtension.dll"8⤵PID:3600
-
-
C:\Program Files\iTop PDF\PDFInit.exe"C:\Program Files\iTop PDF\PDFInit.exe" /deletefile8⤵PID:5208
-
-
C:\Program Files\iTop PDF\PDFInit.exe"C:\Program Files\iTop PDF\PDFInit.exe" /pintaskbar /lastversion=8⤵PID:3988
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵PID:5740
-
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\iTop PDF\PDFShellExtension.dll"8⤵PID:520
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" -f -im iTopPDF.exe8⤵
- Kills process with taskkill
PID:116
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" -f -im Launcher.exe8⤵
- Kills process with taskkill
PID:5152
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" -f -im AutoUpdate.exe8⤵
- Kills process with taskkill
PID:4260
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" -f -im AUpdate.exe8⤵
- Kills process with taskkill
PID:2052 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵PID:212
-
-
-
C:\Program Files\iTop PDF\LocalLang.exe"C:\Program Files\iTop PDF\LocalLang.exe"8⤵PID:6724
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵PID:6644
-
-
-
C:\Program Files\iTop PDF\PDFInit.exe"C:\Program Files\iTop PDF\PDFInit.exe" /recordver8⤵PID:5672
-
-
C:\Program Files\iTop PDF\PDFInit.exe"C:\Program Files\iTop PDF\PDFInit.exe" /reinstall=0 /Language=Spanish /insur=asc_inw8⤵PID:720
-
-
C:\Program Files\iTop PDF\PDFInit.exe"C:\Program Files\iTop PDF\PDFInit.exe" /install /lastversion=8⤵PID:4412
-
-
C:\Program Files\iTop PDF\ICONPIN64.exe"C:\Program Files\iTop PDF\ICONPIN64.exe" Pin "C:\Program Files\iTop PDF\Launcher.exe"8⤵PID:1176
-
-
C:\Program Files\iTop PDF\UninstallInfo.exe"C:\Program Files\iTop PDF\UninstallInfo.exe" /install pdf38⤵PID:4572
-
-
C:\Program Files\iTop PDF\iTopPDF.exe"C:\Program Files\iTop PDF\iTopPDF.exe"8⤵
- Checks computer location settings
PID:3124 -
C:\Program Files\iTop PDF\iTopPDF.exe"C:\Program Files\iTop PDF\iTopPDF.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\iTop PDF" /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\iTop PDF\Crashpad" --url=https://f.a.k/e "--annotation=_productName=iTop PDF" --annotation=_version=3.2.0-12 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=19.0.17 --initial-client-data=0x470,0x474,0x478,0x46c,0x47c,0x7ff7bd3f4270,0x7ff7bd3f4280,0x7ff7bd3f42909⤵PID:6792
-
-
C:\Program Files\iTop PDF\iTopPDF.exe"C:\Program Files\iTop PDF\iTopPDF.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\iTop PDF" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1572 --field-trial-handle=1800,i,3070831595357520032,8990727670865730677,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:29⤵PID:3996
-
-
C:\Program Files\iTop PDF\iTopPDF.exe"C:\Program Files\iTop PDF\iTopPDF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\iTop PDF" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2068 --field-trial-handle=1800,i,3070831595357520032,8990727670865730677,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:89⤵PID:6936
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\iTop PDF\PDFInit.exe" /createuactask"9⤵PID:6212
-
C:\Program Files\iTop PDF\PDFInit.exe"C:\Program Files\iTop PDF\PDFInit.exe" /createuactask10⤵PID:6900
-
-
-
C:\Program Files\iTop PDF\iTopPDF.exe"C:\Program Files\iTop PDF\iTopPDF.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\iTop PDF" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Program Files\iTop PDF\resources\app" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2396 --field-trial-handle=1800,i,3070831595357520032,8990727670865730677,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:19⤵
- Checks computer location settings
PID:5320 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"10⤵PID:1056
-
C:\Windows\System32\reg.exeC:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid11⤵PID:1460
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001|powershell -command "chcp 65001|Out-Null;Add-Type -AssemblyName PresentationCore;$families=[Windows.Media.Fonts]::SystemFontFamilies;foreach($family in $families){$name='';if(!$family.FamilyNames.TryGetValue([Windows.Markup.XmlLanguage]::GetLanguage('zh-cn'),[ref]$name)){$name=$family.FamilyNames[[Windows.Markup.XmlLanguage]::GetLanguage('en-us')]}echo $name}""10⤵
- Drops file in Program Files directory
PID:6704 -
C:\Windows\system32\chcp.comchcp 6500111⤵PID:3800
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "chcp 65001|Out-Null;Add-Type -AssemblyName PresentationCore;$families=[Windows.Media.Fonts]::SystemFontFamilies;foreach($family in $families){$name='';if(!$family.FamilyNames.TryGetValue([Windows.Markup.XmlLanguage]::GetLanguage('zh-cn'),[ref]$name)){$name=$family.FamilyNames[[Windows.Markup.XmlLanguage]::GetLanguage('en-us')]}echo $name}"11⤵PID:4748
-
C:\Windows\system32\chcp.com"C:\Windows\system32\chcp.com" 6500112⤵PID:6612
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\iTop PDF\ProductStat.exe" /cachepath "C:\Users\Admin\AppData\Roaming\iTop PDF\Data" /appid pdf3 /pr es /ver 3.2.0.12 /stflag b100 /type 10 /url http://stats.itopvpn.com/iusage.php /dyonce"10⤵PID:1248
-
C:\Program Files\iTop PDF\ProductStat.exe"C:\Program Files\iTop PDF\ProductStat.exe" /cachepath "C:\Users\Admin\AppData\Roaming\iTop PDF\Data" /appid pdf3 /pr es /ver 3.2.0.12 /stflag b100 /type 10 /url http://stats.itopvpn.com/iusage.php /dyonce11⤵PID:6576
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\iTop PDF\ProductStat.exe" /cachepath "C:\Users\Admin\AppData\Roaming\iTop PDF\Data" /appid pdf3 /pr es /ver 3.2.0.12 /stflag a100 /type 10 /url http://stats.itopvpn.com/iusage.php /dycus 0"10⤵PID:2568
-
C:\Program Files\iTop PDF\ProductStat.exe"C:\Program Files\iTop PDF\ProductStat.exe" /cachepath "C:\Users\Admin\AppData\Roaming\iTop PDF\Data" /appid pdf3 /pr es /ver 3.2.0.12 /stflag a100 /type 10 /url http://stats.itopvpn.com/iusage.php /dycus 011⤵PID:3812
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\iTop PDF\PDFInit.exe" /correctautask /createexprttask"9⤵PID:7144
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
- Checks processor information in registry
PID:6572
-
-
C:\Program Files\iTop PDF\PDFInit.exe"C:\Program Files\iTop PDF\PDFInit.exe" /correctautask /createexprttask10⤵PID:6636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\iTop PDF\AutoUpdate.exe" /main"9⤵PID:6208
-
C:\Program Files\iTop PDF\AutoUpdate.exe"C:\Program Files\iTop PDF\AutoUpdate.exe" /main10⤵PID:6580
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\iTop PDF\AUpdate.exe" /pdf /dayactive"9⤵PID:6300
-
C:\Program Files\iTop PDF\AUpdate.exe"C:\Program Files\iTop PDF\AUpdate.exe" /pdf /dayactive10⤵PID:4304
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\iTop PDF\ProductStat.exe" /cachepath "C:\Users\Admin\AppData\Roaming\iTop PDF\Data" /appid pdf3 /pr es /ver 3.2.0.12 /stflag b600 /type 10 /url http://stats.itopvpn.com/iusage.php /dyonce /postnow"9⤵PID:440
-
C:\Program Files\iTop PDF\ProductStat.exe"C:\Program Files\iTop PDF\ProductStat.exe" /cachepath "C:\Users\Admin\AppData\Roaming\iTop PDF\Data" /appid pdf3 /pr es /ver 3.2.0.12 /stflag b600 /type 10 /url http://stats.itopvpn.com/iusage.php /dyonce /postnow10⤵PID:5548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\iTop PDF\ProductStat.exe" /cachepath "C:\Users\Admin\AppData\Roaming\iTop PDF\Data" /appid pdf3 /pr es /ver 3.2.0.12 /stflag a600 /type 10 /url http://stats.itopvpn.com/iusage.php /dycus 0 /postnow"9⤵PID:4216
-
C:\Program Files\iTop PDF\ProductStat.exe"C:\Program Files\iTop PDF\ProductStat.exe" /cachepath "C:\Users\Admin\AppData\Roaming\iTop PDF\Data" /appid pdf3 /pr es /ver 3.2.0.12 /stflag a600 /type 10 /url http://stats.itopvpn.com/iusage.php /dycus 0 /postnow10⤵PID:7056
-
-
-
-
-
-
C:\ProgramData\IObit\ASCDownloader\ASC15\ISRSetup.exe"C:\ProgramData\IObit\ASCDownloader\ASC15\ISRSetup.exe" /sp- /verysilent /suppressmsgboxes /insur=asc_bg6⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\is-6IJPA.tmp\ISRSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-6IJPA.tmp\ISRSetup.tmp" /SL5="$705D0,95546839,228864,C:\ProgramData\IObit\ASCDownloader\ASC15\ISRSetup.exe" /sp- /verysilent /suppressmsgboxes /insur=asc_bg7⤵PID:6704
-
C:\Users\Admin\AppData\Local\Temp\is-SSQKG.tmp\iScrInit.exe"C:\Users\Admin\AppData\Local\Temp\is-SSQKG.tmp\iScrInit.exe" /CopyOldConfig /installdir="C:\Program Files\iTop Screen Recorder"8⤵PID:5116
-
-
C:\Users\Admin\AppData\Local\Temp\is-SSQKG.tmp\iScrInit.exe"C:\Users\Admin\AppData\Local\Temp\is-SSQKG.tmp\iScrInit.exe" /CleanReg8⤵PID:5824
-
-
C:\Users\Admin\AppData\Local\Temp\is-SSQKG.tmp\iScrInit.exe"C:\Users\Admin\AppData\Local\Temp\is-SSQKG.tmp\iScrInit.exe" /KillProcess /installdir="C:\Program Files\iTop Screen Recorder"8⤵PID:1236
-
-
C:\Users\Admin\AppData\Local\Temp\is-SSQKG.tmp\iScrInit.exe"C:\Users\Admin\AppData\Local\Temp\is-SSQKG.tmp\iScrInit.exe" /DeleteAllFile /reinstall=1 /installdir="C:\Program Files\iTop Screen Recorder"8⤵PID:3488
-
-
C:\Program Files\iTop Screen Recorder\LocalLang.exe"C:\Program Files\iTop Screen Recorder\LocalLang.exe"8⤵PID:816
-
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /reinstall=1 /insur=asc_bg /SetupFile="C:\ProgramData\IObit\ASCDownloader\ASC15\ISRSetup.exe"8⤵PID:116
-
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /install8⤵PID:5396
-
C:\Program Files\iTop Screen Recorder\GpuCheck.exe"C:\Program Files\iTop Screen Recorder\GpuCheck.exe" /GpuCheck9⤵PID:6640
-
-
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /pin=18⤵
- Checks computer location settings
PID:2188 -
C:\Program Files\iTop Screen Recorder\ICONPIN64.exe"C:\Program Files\iTop Screen Recorder\ICONPIN64.exe" pin "C:\Program Files\iTop Screen Recorder\iScrRec.exe"9⤵PID:6224
-
-
-
C:\Program Files\iTop Screen Recorder\UninstallInfo.exe"C:\Program Files\iTop Screen Recorder\UninstallInfo.exe" /install isr38⤵PID:440
-
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /PostSystemInfo8⤵PID:5220
-
-
C:\Program Files\iTop Screen Recorder\iScrRec.exe"C:\Program Files\iTop Screen Recorder\iScrRec.exe"8⤵
- Checks computer location settings
PID:5184 -
C:\Program Files\iTop Screen Recorder\GpuCheck.exe"C:\Program Files\iTop Screen Recorder\GpuCheck.exe" /GpuCheck9⤵PID:6400
-
-
C:\Program Files\iTop Screen Recorder\graphics-check.exe"C:\Program Files\iTop Screen Recorder\graphics-check.exe"9⤵PID:7068
-
-
C:\Program Files\iTop Screen Recorder\AutoUpdate.exe"C:\Program Files\iTop Screen Recorder\AutoUpdate.exe" /auto /start9⤵
- Checks computer location settings
PID:6784 -
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /AutoupdateUac10⤵PID:6344
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c Schtasks /run /tn "iTop Screen Recorder UAC"9⤵PID:6256
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵PID:6772
-
-
C:\Windows\system32\schtasks.exeSchtasks /run /tn "iTop Screen Recorder UAC"10⤵PID:7032
-
-
-
C:\Program Files\iTop Screen Recorder\get-graphics-offsets64.exe"C:\Program Files\iTop Screen Recorder\get-graphics-offsets64.exe" /main9⤵
- Suspicious use of SetWindowsHookEx
PID:5556 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵PID:6664
-
-
-
C:\Program Files\iTop Screen Recorder\get-graphics-offsets32.exe"C:\Program Files\iTop Screen Recorder\get-graphics-offsets32.exe" /main9⤵
- Suspicious use of SetWindowsHookEx
PID:6176
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\idman638build3.exe"C:\Users\Admin\Downloads\idman638build3.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp"C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"3⤵
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3812 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵PID:5428
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"5⤵
- Registers COM server for autorun
PID:4888
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵PID:3788
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"5⤵
- Registers COM server for autorun
PID:4408
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵PID:3356
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"5⤵
- Registers COM server for autorun
PID:4052
-
-
-
C:\Program Files (x86)\Internet Download Manager\idmBroker.exe"C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer4⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4608
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr /setlngid 10 /fulllngfile idm_es.lng4⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6064 -
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv5⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:3944 -
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf6⤵
- Drops file in Drivers directory
- Adds Run key to start application
PID:5636 -
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r7⤵PID:6572
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o8⤵PID:4468
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵PID:6648
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵PID:5380
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵PID:6176
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵PID:3208
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵PID:6664
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵PID:4292
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵PID:3100
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵PID:2052
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵PID:6332
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵PID:5536
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵PID:5592
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵PID:6516
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵PID:1436
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"6⤵PID:1344
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"7⤵PID:5500
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"5⤵PID:5456
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"6⤵
- Registers COM server for autorun
PID:1660
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"5⤵PID:4720
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"6⤵PID:3244
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"5⤵PID:6276
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"6⤵PID:4536
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵PID:3920
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"6⤵
- Registers COM server for autorun
PID:1548
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"5⤵PID:5056
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"6⤵
- Registers COM server for autorun
PID:4548
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"5⤵PID:4060
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"6⤵PID:384
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"5⤵PID:2640
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"6⤵PID:5676
-
-
-
C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"5⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:3744
-
-
-
-
-
C:\Users\Admin\Downloads\iobituninstaller.exe"C:\Users\Admin\Downloads\iobituninstaller.exe"2⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\is-N9QSC.tmp\iobituninstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-N9QSC.tmp\iobituninstaller.tmp" /SL5="$70404,24978386,139264,C:\Users\Admin\Downloads\iobituninstaller.exe"3⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\is-P578T.tmp\Installer\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-P578T.tmp\Installer\Setup.exe" /setup "C:\Users\Admin\Downloads\iobituninstaller.exe" "" "/Ver=11.6.0.12"4⤵PID:3860
-
C:\Users\Admin\Downloads\iobituninstaller.exe"C:\Users\Admin\Downloads\iobituninstaller.exe" /verysilent /NORESTART /DIR="C:\Program Files (x86)\IObit\IObit Uninstaller\" /TASKS="desktopicon, " /do /dt ""5⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\is-9BRHU.tmp\iobituninstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-9BRHU.tmp\iobituninstaller.tmp" /SL5="$2064E,24978386,139264,C:\Users\Admin\Downloads\iobituninstaller.exe" /verysilent /NORESTART /DIR="C:\Program Files (x86)\IObit\IObit Uninstaller\" /TASKS="desktopicon, " /do /dt ""6⤵
- Checks computer location settings
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\is-32BMT.tmp\Installer\iushrun.exe"C:\Users\Admin\AppData\Local\Temp\is-32BMT.tmp\Installer\iushrun.exe" /ii "C:\Program Files (x86)\IObit\IObit Uninstaller"7⤵PID:4284
-
-
C:\Program Files (x86)\IObit\IObit Uninstaller\iush.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\iush.exe" /if "C:\Program Files (x86)\IObit\IObit Uninstaller" /dt /insur=7⤵PID:5400
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IObit\IObit Uninstaller\IUMenuRight.dll"8⤵PID:4344
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\IObit\IObit Uninstaller\IUMenuRight.dll"9⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Modifies registry class
PID:2496
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll"8⤵PID:1364
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll"9⤵
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
PID:5952
-
-
-
C:\Program Files (x86)\IObit\IObit Uninstaller\TaskbarPin\ICONPIN64.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\TaskbarPin\ICONPIN64.exe" Pin "C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe"8⤵PID:4872
-
-
C:\Program Files (x86)\IObit\IObit Uninstaller\DSPut.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\DSPut.exe" /Now /update /W3sidmVyc2lvbiI6IjAuMC4wLjAiLCJzaG93IjowLCJjbGljayI6MCwibGFzdCI6MH1d8⤵PID:6160
-
-
-
C:\Program Files (x86)\IObit\IObit Uninstaller\CrRestore.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\CrRestore.exe" /Backup7⤵PID:6600
-
-
C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallPromote.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallPromote.exe" /INSTALL un117⤵PID:6672
-
-
-
-
C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe" /setup5⤵
- Checks computer location settings
- Drops file in Program Files directory
PID:6824 -
C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe" /Set6⤵PID:3480
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IObit\IObit Uninstaller\IUMenuRight.dll"6⤵PID:6820
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\IObit\IObit Uninstaller\IUMenuRight.dll"7⤵PID:1404
-
-
-
C:\Program Files (x86)\IObit\IObit Uninstaller\AUpdate.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\AUpdate.exe" /a un11 /p es /v 11.6.0.12 /t 1 /d 7 /un /user6⤵PID:6416
-
-
C:\Program Files (x86)\IObit\IObit Uninstaller\DSPut.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\DSPut.exe"6⤵PID:6740
-
-
C:\Program Files (x86)\IObit\IObit Uninstaller\PPUninstaller.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\PPUninstaller.exe" /x6⤵PID:6212
-
-
-
C:\Program Files (x86)\IObit\IObit Uninstaller\IObitDownloader.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\IObitDownloader.exe" "/Config=http://update.iobit.com/infofiles/iu11/Freeware-iu11.upt" /show /lang=English.lng /product=un "iTop Data Recovery In" "iTop PDF In" "iTop Screen Recorder In"5⤵
- Checks computer location settings
PID:6848 -
C:\ProgramData\IObit\IObit Uninstaller\Downloader\iTop Data Recovery_Setup_IU.exe"C:\ProgramData\IObit\IObit Uninstaller\Downloader\iTop Data Recovery_Setup_IU.exe" /sp- /verysilent /suppressmsgboxes /insur=iu_inw6⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\is-3CD2Q.tmp\iTop Data Recovery_Setup_IU.tmp"C:\Users\Admin\AppData\Local\Temp\is-3CD2Q.tmp\iTop Data Recovery_Setup_IU.tmp" /SL5="$5066C,8664805,329216,C:\ProgramData\IObit\IObit Uninstaller\Downloader\iTop Data Recovery_Setup_IU.exe" /sp- /verysilent /suppressmsgboxes /insur=iu_inw7⤵
- Checks computer location settings
- Drops file in Program Files directory
PID:1088 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop iTopDataRecoveryService38⤵PID:6296
-
C:\Windows\SysWOW64\sc.exesc stop iTopDataRecoveryService39⤵
- Launches sc.exe
PID:5476
-
-
-
C:\Program Files (x86)\iTop Data Recovery\LocalLang.exe"C:\Program Files (x86)\iTop Data Recovery\LocalLang.exe"8⤵PID:4412
-
-
C:\Program Files (x86)\iTop Data Recovery\iTopInsur.exe"C:\Program Files (x86)\iTop Data Recovery\iTopInsur.exe" /SetLicenseStatus8⤵PID:6340
-
-
C:\Program Files (x86)\iTop Data Recovery\iTopInsur.exe"C:\Program Files (x86)\iTop Data Recovery\iTopInsur.exe" /insur=iu_inw /reinstall=0 /regkeynameinsur="iTop Data Recovery" /writeregWow6432Node=08⤵PID:6876
-
-
C:\Program Files (x86)\iTop Data Recovery\UninstallInfo.exe"C:\Program Files (x86)\iTop Data Recovery\UninstallInfo.exe" /install idr38⤵PID:4336
-
-
C:\Program Files (x86)\iTop Data Recovery\ICONPIN64.exe"C:\Program Files (x86)\iTop Data Recovery\ICONPIN64.exe" Pin "C:\Program Files (x86)\iTop Data Recovery\iTopDataRecovery.exe"8⤵PID:5652
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc create iTopDataRecoveryService3 binPath= "\"C:\Program Files (x86)\iTop Data Recovery\IDRService.exe\"" start= auto DisplayName= "iTop Data Recovery Service 3"8⤵PID:6512
-
C:\Windows\SysWOW64\sc.exesc create iTopDataRecoveryService3 binPath= "\"C:\Program Files (x86)\iTop Data Recovery\IDRService.exe\"" start= auto DisplayName= "iTop Data Recovery Service 3"9⤵
- Launches sc.exe
PID:4772
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc description iTopDataRecoveryService3 "iTop Data Recovery Service"8⤵
- Checks computer location settings
PID:4080 -
C:\Windows\SysWOW64\sc.exesc description iTopDataRecoveryService3 "iTop Data Recovery Service"9⤵
- Launches sc.exe
PID:5388
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc start iTopDataRecoveryService38⤵PID:7012
-
C:\Windows\SysWOW64\sc.exesc start iTopDataRecoveryService39⤵
- Launches sc.exe
PID:816
-
-
-
C:\Program Files (x86)\iTop Data Recovery\iTopDataRecovery.exe"C:\Program Files (x86)\iTop Data Recovery\iTopDataRecovery.exe"8⤵PID:5704
-
C:\Program Files (x86)\iTop Data Recovery\Autoupdate.exe"C:\Program Files (x86)\iTop Data Recovery\Autoupdate.exe" /auto /start9⤵PID:3744
-
C:\Program Files (x86)\iTop Data Recovery\Pub\itopbf.exe"C:\Program Files (x86)\iTop Data Recovery\Pub\itopbf.exe" /idr10⤵PID:4860
-
-
-
C:\Program Files (x86)\iTop Data Recovery\AUpdate.exe"C:\Program Files (x86)\iTop Data Recovery\AUpdate.exe" /idr /dayactive9⤵PID:6780
-
-
C:\Program Files (x86)\iTop Data Recovery\AUpdate.exe"C:\Program Files (x86)\iTop Data Recovery\AUpdate.exe" /a idr3 /p es /v 3.3.0.451 /t 1 /d 79⤵PID:5068
-
-
-
-
-
C:\ProgramData\IObit\IObit Uninstaller\Downloader\iTop PDF_Setup_IU.exe"C:\ProgramData\IObit\IObit Uninstaller\Downloader\iTop PDF_Setup_IU.exe" /sp- /verysilent /suppressmsgboxes /insur=iu_inw6⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\is-RI459.tmp\iTop PDF_Setup_IU.tmp"C:\Users\Admin\AppData\Local\Temp\is-RI459.tmp\iTop PDF_Setup_IU.tmp" /SL5="$707FE,171180782,199680,C:\ProgramData\IObit\IObit Uninstaller\Downloader\iTop PDF_Setup_IU.exe" /sp- /verysilent /suppressmsgboxes /insur=iu_inw7⤵PID:6416
-
-
-
C:\ProgramData\IObit\IObit Uninstaller\Downloader\isrSetup.exe.exe"C:\ProgramData\IObit\IObit Uninstaller\Downloader\isrSetup.exe.exe" /sp- /verysilent /suppressmsgboxes /insur=iu_in6⤵PID:6496
-
C:\Users\Admin\AppData\Local\Temp\is-4EQGB.tmp\isrSetup.exe.tmp"C:\Users\Admin\AppData\Local\Temp\is-4EQGB.tmp\isrSetup.exe.tmp" /SL5="$E0602,92565533,228864,C:\ProgramData\IObit\IObit Uninstaller\Downloader\isrSetup.exe.exe" /sp- /verysilent /suppressmsgboxes /insur=iu_in7⤵
- Checks computer location settings
- Drops file in Program Files directory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\is-VM9HD.tmp\iScrInit.exe"C:\Users\Admin\AppData\Local\Temp\is-VM9HD.tmp\iScrInit.exe" /CopyOldConfig /installdir="C:\Program Files\iTop Screen Recorder"8⤵PID:6552
-
-
C:\Users\Admin\AppData\Local\Temp\is-VM9HD.tmp\iScrInit.exe"C:\Users\Admin\AppData\Local\Temp\is-VM9HD.tmp\iScrInit.exe" /CleanReg8⤵PID:4716
-
-
C:\Users\Admin\AppData\Local\Temp\is-VM9HD.tmp\iScrInit.exe"C:\Users\Admin\AppData\Local\Temp\is-VM9HD.tmp\iScrInit.exe" /KillProcess /installdir="C:\Program Files\iTop Screen Recorder"8⤵PID:6492
-
-
C:\Users\Admin\AppData\Local\Temp\is-VM9HD.tmp\iScrInit.exe"C:\Users\Admin\AppData\Local\Temp\is-VM9HD.tmp\iScrInit.exe" /DeleteAllFile /Reinstall=1 /installdir="C:\Program Files\iTop Screen Recorder"8⤵PID:5436
-
-
C:\Program Files\iTop Screen Recorder\LocalLang.exe"C:\Program Files\iTop Screen Recorder\LocalLang.exe"8⤵PID:456
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵PID:3812
-
-
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /reinstall=1 /insur=iu_in /SetupFile="C:\ProgramData\IObit\IObit Uninstaller\Downloader\isrSetup.exe.exe"8⤵PID:6800
-
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /install8⤵
- Checks computer location settings
PID:6576 -
C:\Program Files\iTop Screen Recorder\GpuCheck.exe"C:\Program Files\iTop Screen Recorder\GpuCheck.exe" /GpuCheck9⤵PID:3476
-
-
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /pin=18⤵
- Suspicious use of SetWindowsHookEx
PID:2020 -
C:\Program Files\iTop Screen Recorder\ICONPIN64.exe"C:\Program Files\iTop Screen Recorder\ICONPIN64.exe" pin "C:\Program Files\iTop Screen Recorder\iScrRec.exe"9⤵PID:1896
-
-
-
C:\Program Files\iTop Screen Recorder\UninstallInfo.exe"C:\Program Files\iTop Screen Recorder\UninstallInfo.exe" /install isr38⤵PID:808
-
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /PostSystemInfo8⤵PID:6192
-
-
C:\Program Files\iTop Screen Recorder\iScrRec.exe"C:\Program Files\iTop Screen Recorder\iScrRec.exe"8⤵
- Checks computer location settings
PID:6596 -
C:\Program Files\iTop Screen Recorder\GpuCheck.exe"C:\Program Files\iTop Screen Recorder\GpuCheck.exe" /GpuCheck9⤵PID:6876
-
-
C:\Program Files\iTop Screen Recorder\graphics-check.exe"C:\Program Files\iTop Screen Recorder\graphics-check.exe"9⤵PID:5288
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c Schtasks /run /tn "iTop Screen Recorder Update"9⤵PID:5628
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
- Suspicious use of SetWindowsHookEx
PID:1752
-
-
C:\Windows\system32\schtasks.exeSchtasks /run /tn "iTop Screen Recorder Update"10⤵
- Blocklisted process makes network request
PID:4860
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c Schtasks /run /tn "iTop Screen Recorder UAC"9⤵PID:6272
-
C:\Windows\system32\schtasks.exeSchtasks /run /tn "iTop Screen Recorder UAC"10⤵PID:5392
-
-
-
C:\Program Files\iTop Screen Recorder\get-graphics-offsets32.exe"C:\Program Files\iTop Screen Recorder\get-graphics-offsets32.exe" /main9⤵
- Suspicious use of SetWindowsHookEx
PID:6040
-
-
C:\Program Files\iTop Screen Recorder\get-graphics-offsets64.exe"C:\Program Files\iTop Screen Recorder\get-graphics-offsets64.exe" /main9⤵
- Suspicious use of SetWindowsHookEx
PID:1176
-
-
-
-
-
-
C:\Program Files (x86)\IObit\IObit Uninstaller\iush.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\iush.exe" /tmpDir="C:\Users\Admin\AppData\Local\Temp\is-P578T.tmp\"5⤵PID:5132
-
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --check-run=src=desktop2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:5832 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=107.0.19254.108 --initial-client-data=0x118,0x11c,0x120,0xf8,0x124,0x7fffcd59aea8,0x7fffcd59aeb8,0x7fffcd59aec83⤵PID:4628
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:23⤵PID:4248
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:83⤵PID:3920
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=2000 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:83⤵PID:3568
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=3400 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:13⤵PID:384
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=3416 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:13⤵PID:5796
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=3520 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:13⤵
- Checks computer location settings
PID:3540
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=3488 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:83⤵PID:5824
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4888 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:83⤵PID:5804
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5284 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:83⤵PID:5592
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"3⤵
- Checks computer location settings
PID:5664
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5848 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:13⤵PID:6368
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=6276 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:13⤵
- Checks computer location settings
PID:6732
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=3388 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:83⤵PID:6944
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --mojo-platform-channel-handle=6520 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:13⤵PID:7012
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --mojo-platform-channel-handle=6284 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:13⤵PID:3308
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --mojo-platform-channel-handle=7004 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:13⤵
- Checks computer location settings
PID:6160
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=7188 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:83⤵PID:6616
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=7152 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:83⤵PID:2000
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --disable-protect3⤵
- Enumerates system info in registry
PID:6868 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=107.0.19254.108 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffcd59aea8,0x7fffcd59aeb8,0x7fffcd59aec84⤵PID:3752
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1840 --field-trial-handle=2060,i,17271613614266323416,16106096338587225266,131072 /prefetch:24⤵PID:6924
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=2020 --field-trial-handle=2060,i,17271613614266323416,16106096338587225266,131072 /prefetch:84⤵PID:6656
-
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=7200 --field-trial-handle=1924,i,15533821595318019664,6433729194331528349,131072 /prefetch:13⤵PID:3576
-
-
C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\Installer\chrmstp.exe"C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings3⤵PID:6624
-
C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\Installer\chrmstp.exe"C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=107.0.19254.108 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff675d09300,0x7ff675d09310,0x7ff675d093204⤵PID:6696
-
-
C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\Installer\chrmstp.exe"C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\AVG\Browser\Application\master_preferences" --create-shortcuts=1 --install-level=04⤵PID:388
-
C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\Installer\chrmstp.exe"C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=107.0.19254.108 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x7ff675d09300,0x7ff675d09310,0x7ff675d093205⤵PID:3672
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 taskbarpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"5⤵
- Checks computer location settings
PID:6468
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"5⤵
- Checks computer location settings
PID:6708
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
PID:6756 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd0f04f50,0x7fffd0f04f60,0x7fffd0f04f703⤵PID:6772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:23⤵PID:1464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1928 /prefetch:83⤵PID:6856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2492 /prefetch:83⤵PID:1736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:13⤵PID:5536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2876 /prefetch:13⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3596 /prefetch:83⤵PID:3288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3780 /prefetch:83⤵PID:6980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4532 /prefetch:83⤵PID:5440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1572 /prefetch:13⤵PID:4732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4692 /prefetch:83⤵PID:3644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4728 /prefetch:83⤵PID:3600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4856 /prefetch:83⤵PID:808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5212 /prefetch:83⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5016 /prefetch:83⤵PID:6088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5568 /prefetch:83⤵PID:6668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3644 /prefetch:83⤵PID:1404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5756 /prefetch:83⤵PID:3116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5920 /prefetch:83⤵PID:4444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3628 /prefetch:83⤵PID:5504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3748 /prefetch:83⤵PID:6136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5876 /prefetch:83⤵PID:6712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5784 /prefetch:83⤵PID:2952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6288 /prefetch:83⤵PID:7004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6460 /prefetch:83⤵PID:6684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:13⤵PID:6464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,13492350507332847110,12915098136885345476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:83⤵PID:5676
-
-
-
C:\Users\Admin\Downloads\PhotoScapeSetup_V3.7.exe"C:\Users\Admin\Downloads\PhotoScapeSetup_V3.7.exe"2⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
PID:7148 -
C:\Users\Admin\AppData\Local\Temp\GTGCAPI.exe"C:\Users\Admin\AppData\Local\Temp\GTGCAPI.exe"3⤵PID:2792
-
-
C:\Users\Admin\AppData\Local\Temp\GTGCAPI.exe"C:\Users\Admin\AppData\Local\Temp\GTGCAPI.exe" /reasongccc3⤵PID:6092
-
-
C:\Users\Admin\AppData\Local\Temp\GTGCAPI.exe"C:\Users\Admin\AppData\Local\Temp\GTGCAPI.exe" /reasontcc3⤵PID:4640
-
-
C:\Users\Admin\AppData\Local\Temp\GTGCAPI.exe"C:\Users\Admin\AppData\Local\Temp\GTGCAPI.exe" /reasongdcc3⤵
- Checks computer location settings
PID:5396
-
-
C:\Users\Admin\AppData\Local\Temp\GTGCAPI.exe"C:\Users\Admin\AppData\Local\Temp\GTGCAPI.exe" /set3⤵PID:6008
-
-
C:\Users\Admin\AppData\Local\Temp\GoogleSetup.exe"C:\Users\Admin\AppData\Local\Temp\GoogleSetup.exe" ver=3.7&hwnd=394854&app=gd&ReasonGCCC=2&ReasonTCC=12&ReasonGDCC=0&lang=eng&3⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\Mooii_GDrive.exe"C:\Users\Admin\AppData\Local\Temp\Mooii_GDrive.exe" /back:false4⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_latest.exeC:\Users\Admin\AppData\Local\Temp\GoogleUpdateSetup_latest.exe /silent /install "appguid={3C122445-AECE-4309-90B7-85A6AEF42AC0}&appname=Google%20Drive&needsadmin=true&brand=VLYS"5⤵PID:6904
-
C:\Program Files (x86)\GUM8E4B.tmp\GoogleUpdate.exe"C:\Program Files (x86)\GUM8E4B.tmp\GoogleUpdate.exe" /silent /install "appguid={3C122445-AECE-4309-90B7-85A6AEF42AC0}&appname=Google%20Drive&needsadmin=true&brand=VLYS"6⤵
- Checks computer location settings
PID:5704
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\GTGCAPI.exe"C:\Users\Admin\AppData\Local\Temp\GTGCAPI.exe" /launchgd /back:false /hwnd:3948544⤵
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Checks SCSI registry key(s)
PID:5548
-
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --single-argument http://photoscape.org/link/link.php?version=installer&topic=afterinstall&v=3.73⤵
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
PID:7092 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=107.0.19254.108 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffcd3caea8,0x7fffcd3caeb8,0x7fffcd3caec84⤵PID:5132
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=392 --field-trial-handle=2020,i,13583649919456617876,14050213160584208200,131072 /prefetch:24⤵PID:100
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=1968 --field-trial-handle=2020,i,13583649919456617876,14050213160584208200,131072 /prefetch:84⤵PID:6904
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2316 --field-trial-handle=2020,i,13583649919456617876,14050213160584208200,131072 /prefetch:84⤵PID:3092
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=3348 --field-trial-handle=2020,i,13583649919456617876,14050213160584208200,131072 /prefetch:14⤵PID:1348
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=3364 --field-trial-handle=2020,i,13583649919456617876,14050213160584208200,131072 /prefetch:14⤵PID:2256
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=4396 --field-trial-handle=2020,i,13583649919456617876,14050213160584208200,131072 /prefetch:14⤵
- Checks computer location settings
PID:2588
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --mojo-platform-channel-handle=5356 --field-trial-handle=2020,i,13583649919456617876,14050213160584208200,131072 /prefetch:14⤵
- Checks computer location settings
PID:4584
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5492 --field-trial-handle=2020,i,13583649919456617876,14050213160584208200,131072 /prefetch:84⤵PID:4996
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --disable-protect4⤵
- Enumerates system info in registry
PID:4888 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=107.0.19254.108 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffcd3caea8,0x7fffcd3caeb8,0x7fffcd3caec85⤵PID:2440
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1988,i,9698194161071896874,16677389530795680256,131072 /prefetch:25⤵
- Drops file in Drivers directory
- Adds Run key to start application
PID:4956
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=2076 --field-trial-handle=1988,i,9698194161071896874,16677389530795680256,131072 /prefetch:85⤵PID:6276
-
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5832 --field-trial-handle=2020,i,13583649919456617876,14050213160584208200,131072 /prefetch:84⤵PID:1248
-
-
-
-
C:\Users\Admin\Downloads\bittorrent_installer.exe"C:\Users\Admin\Downloads\bittorrent_installer.exe"2⤵
- Checks for any installed AV software in registry
- Suspicious use of SetWindowsHookEx
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\bittorrent_installer.exe_1669714610\Carrier.exe"C:\Users\Admin\AppData\Local\Temp\bittorrent_installer.exe_1669714610\Carrier.exe" /S /FORCEINSTALL 11100101011111103⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\bittorrent\bittorrent.exe"C:\Users\Admin\AppData\Local\Temp\bittorrent\bittorrent.exe" /S /FORCEINSTALL 11100101011111104⤵
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:540
-
-
-
C:\Users\Admin\AppData\Local\Temp\u4vmpt3n.n4w.exe"C:\Users\Admin\AppData\Local\Temp\u4vmpt3n.n4w.exe" -i * -accept -silent -p pubid CS -p templateid 6373deac80cd60396938810b -p source lvsppi3⤵
- Suspicious use of SetWindowsHookEx
PID:2628
-
-
C:\Users\Admin\AppData\Local\Temp\xybbujjh.fxf.exe"C:\Users\Admin\AppData\Local\Temp\xybbujjh.fxf.exe" --silent --partner=BT171003 --webprotection --searchenbl --prod3⤵
- Suspicious use of SetWindowsHookEx
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\7zS8DFD6F35\WebCompanionInstaller.exe.\WebCompanionInstaller.exe --partner=BT171003 --webprotection --version=9.1.0.409 --silent --partner=BT171003 --webprotection --searchenbl --prod4⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1636 -
C:\Windows\SysWOW64\sc.exe"sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto5⤵
- Launches sc.exe
PID:808
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" failure WCAssistantService reset= 30 actions= restart/600005⤵
- Launches sc.exe
PID:2268
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"5⤵
- Launches sc.exe
PID:5944
-
-
C:\Windows\system32\RunDLL32.Exe"C:\Windows\sysnative\RunDLL32.Exe" syssetup,SetupInfObjectInstallAction BootInstall 128 C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf5⤵
- Drops file in Drivers directory
- Adds Run key to start application
PID:2272 -
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r6⤵
- Checks processor information in registry
PID:3612 -
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o7⤵PID:1096
-
-
-
-
C:\Windows\system32\net.exe"C:\Windows\sysnative\net.exe" start bddci5⤵PID:1324
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start bddci6⤵PID:256
-
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" Create "DCIService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe" DisplayName= "DCIService" start= auto5⤵
- Launches sc.exe
PID:3480
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" description "DCIService" "Webprotection Bridge service"5⤵
- Launches sc.exe
PID:3664
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd"5⤵PID:800
-
C:\Windows\SysWOW64\sc.exesc start DCIService6⤵
- Launches sc.exe
PID:5992
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone5⤵PID:6412
-
C:\Windows\SysWOW64\netsh.exenetsh http add urlacl url=http://+:9007/ user=Everyone6⤵PID:4148
-
-
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo= --searchenbl5⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
PID:3432 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\opfv5z7o.cmdline"6⤵
- Suspicious use of SetWindowsHookEx
PID:5340 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵PID:6828
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES521F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC520F.tmp"7⤵PID:6436
-
-
-
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --afterinstall5⤵
- Checks computer location settings
PID:4776 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hfkrq0r7.cmdline"6⤵
- Suspicious use of SetWindowsHookEx
PID:408 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵PID:6516
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDCEB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDCEA.tmp"7⤵PID:5688
-
-
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe"C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Search.exe" --searchConfigPath="C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\SearchMetadata.txt" --eventConfigPath="C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Options\EventMetadata.txt"6⤵
- Drops file in Windows directory
PID:1040
-
-
-
-
-
-
C:\Users\Admin\Downloads\bittorrent_installer.exe"C:\Users\Admin\Downloads\bittorrent_installer.exe"2⤵PID:5836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5836 -s 25963⤵
- Program crash
PID:6344
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵PID:1376
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵PID:4576
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.0.71985814\332076641" -parentBuildID 20200403170909 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 1 -prefMapSize 220622 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 1780 gpu4⤵PID:7084
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.3.578036757\770296944" -childID 1 -isForBrowser -prefsHandle 2496 -prefMapHandle 2452 -prefsLen 112 -prefMapSize 220622 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 2440 tab4⤵PID:5000
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.13.1192184857\563484419" -childID 2 -isForBrowser -prefsHandle 3616 -prefMapHandle 3612 -prefsLen 6896 -prefMapSize 220622 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 3628 tab4⤵PID:4384
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
PID:6572 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd0f04f50,0x7fffd0f04f60,0x7fffd0f04f703⤵PID:5380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2012 /prefetch:83⤵PID:4944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1624 /prefetch:23⤵PID:5188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2344 /prefetch:83⤵PID:1056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2852 /prefetch:13⤵PID:5692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2844 /prefetch:13⤵PID:984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4236 /prefetch:83⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:13⤵PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4668 /prefetch:83⤵PID:6208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4244 /prefetch:83⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4788 /prefetch:83⤵PID:5576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4932 /prefetch:83⤵PID:3192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4908 /prefetch:83⤵PID:6728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4740 /prefetch:83⤵PID:5920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4228 /prefetch:83⤵PID:1464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:13⤵PID:6976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:13⤵PID:6504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3100 /prefetch:83⤵PID:6328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3000 /prefetch:83⤵PID:6944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 /prefetch:83⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5356 /prefetch:83⤵PID:5208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4860 /prefetch:83⤵PID:5176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:13⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:13⤵PID:6292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:13⤵PID:1708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:13⤵PID:5560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:13⤵PID:6508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:13⤵PID:2496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:13⤵PID:6408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:13⤵PID:6544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:13⤵PID:6576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:13⤵PID:6700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:13⤵PID:5672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6584 /prefetch:83⤵PID:2656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /c "C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=0 < \\.\pipe\chrome.nativeMessaging.in.6e8c3985c5b30442 > \\.\pipe\chrome.nativeMessaging.out.6e8c3985c5b304423⤵PID:5980
-
C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" chrome-extension://ngpampappnmepgilojfohadhhmbhlaek/ --parent-window=04⤵PID:7120
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:13⤵PID:1296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:13⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:13⤵PID:6872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1612,5169623948869295458,4772600556603398049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7696 /prefetch:83⤵PID:6228
-
-
-
C:\Users\Admin\Downloads\MBSetup-0009996.0009996-consumer.exe"C:\Users\Admin\Downloads\MBSetup-0009996.0009996-consumer.exe"2⤵
- Drops file in Drivers directory
PID:5472 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /t 1 & "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"3⤵PID:4524
-
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
PID:2080
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"4⤵PID:112
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi5⤵
- Checks processor information in registry
PID:6992 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6992.0.517539962\1354124398" -parentBuildID 20200403170909 -prefsHandle 1692 -prefMapHandle 1684 -prefsLen 1 -prefMapSize 220971 -appdir "C:\Program Files\Mozilla Firefox\browser" - 6992 "\\.\pipe\gecko-crash-server-pipe.6992" 1776 gpu6⤵PID:7164
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6992.3.434345190\2133542741" -childID 1 -isForBrowser -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 27 -prefMapSize 220971 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 6992 "\\.\pipe\gecko-crash-server-pipe.6992" 2452 tab6⤵PID:4944
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6992.13.893124141\1103779406" -childID 2 -isForBrowser -prefsHandle 3440 -prefMapHandle 3436 -prefsLen 6193 -prefMapSize 220971 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 6992 "\\.\pipe\gecko-crash-server-pipe.6992" 3392 tab6⤵PID:6044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6992.20.848778264\1713128005" -childID 3 -isForBrowser -prefsHandle 4140 -prefMapHandle 4180 -prefsLen 6898 -prefMapSize 220971 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 6992 "\\.\pipe\gecko-crash-server-pipe.6992" 4168 tab6⤵PID:2584
-
-
-
-
-
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:6940
-
-
-
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"2⤵
- Suspicious behavior: AddClipboardFormatListener
PID:3316
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:984
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2244
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x434 0x3781⤵
- Suspicious use of AdjustPrivilegeToken
PID:5472
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4408
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}1⤵PID:4852
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies data under HKEY_USERS
PID:4180 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\AVGBrowserInstaller.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=1003 --default-search=bing.com --adblock-mode-default=0 --make-chrome-default --force-default-win10 --reset-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --private-browsing --system-level2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5164 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\CR_4C610.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\CR_4C610.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\CR_4C610.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=1003 --default-search=bing.com --adblock-mode-default=0 --make-chrome-default --force-default-win10 --reset-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --private-browsing --system-level3⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Drops file in Program Files directory
- Modifies registry class
PID:1460 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\CR_4C610.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\CR_4C610.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=107.0.19254.108 --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff6b3849300,0x7ff6b3849310,0x7ff6b38493204⤵
- Executes dropped EXE
PID:5624
-
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\CR_4C610.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\CR_4C610.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\AVG\Browser\Temp\source1460_1481800273\Safer-bin\master_preferences" --create-shortcuts=0 --install-level=14⤵
- Executes dropped EXE
PID:208 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\CR_4C610.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\CR_4C610.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=107.0.19254.108 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff6b3849300,0x7ff6b3849310,0x7ff6b38493205⤵
- Executes dropped EXE
PID:3248
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 taskbarpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"5⤵PID:5364
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
PID:4284
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\CR_4C610.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\CR_4C610.tmp\setup.exe" --system-level --make-chrome-default-helper --user-data-dir="C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --module-dir="C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\CR_4C610.tmp" "AVG Secure Browser"4⤵
- Executes dropped EXE
PID:408 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\CR_4C610.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{0FE51C74-1039-4218-8625-879EE43C9FE1}\CR_4C610.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=107.0.19254.108 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff6b3849300,0x7ff6b3849310,0x7ff6b38493205⤵
- Executes dropped EXE
PID:5720
-
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1207.2\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1207.2\AVGBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1207.2\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1207.2\AVGBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5772
-
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:888 -
C:\Program Files\McAfee\WebAdvisor\UIHost.exe"C:\Program Files\McAfee\WebAdvisor\UIHost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348
-
-
C:\Program Files\McAfee\WebAdvisor\updater.exe"C:\Program Files\McAfee\WebAdvisor\updater.exe"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4460 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c IF EXIST "C:\Program Files\McAfee\WebAdvisor\Download" ( DEL "C:\Program Files\McAfee\WebAdvisor\Download\*.bak" )3⤵PID:936
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c DEL "C:\Program Files\McAfee\WebAdvisor\*.tmp"3⤵PID:3944
-
-
-
C:\Program Files\McAfee\WebAdvisor\updater.exe"C:\Program Files\McAfee\WebAdvisor\updater.exe"2⤵
- Modifies data under HKEY_USERS
PID:6156 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c IF EXIST "C:\Program Files\McAfee\WebAdvisor\Download" ( DEL "C:\Program Files\McAfee\WebAdvisor\Download\*.bak" )3⤵PID:2292
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Registers COM server for autorun
PID:6800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c DEL "C:\Program Files\McAfee\WebAdvisor\*.tmp"3⤵PID:6448
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5632
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2980
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5364
-
C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3652 -
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTimebase.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTimebase.exe" /boottime2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:536
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /UpdateTaskschd2⤵
- Executes dropped EXE
PID:3176
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /start2⤵
- Executes dropped EXE
PID:3988
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\RealTimeProtector.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\RealTimeProtector.exe" /RunCurUs2⤵
- Executes dropped EXE
PID:2188
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\Display.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\Display.exe" /service2⤵
- Executes dropped EXE
PID:3488
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\AutoSweep.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\AutoSweep.exe" /SvcAutoClean2⤵
- Executes dropped EXE
- Suspicious use of SendNotifyMessage
PID:5404
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C004100530043005F0050006500720066006F0072006D0061006E00630065004D006F006E00690074006F0072002⤵PID:3056
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\AutoCare.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\AutoCare.exe" /autorun /AdvanceScan2⤵
- Suspicious use of SendNotifyMessage
PID:3932
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\IObitLiveUpdate.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\IObitLiveUpdate.exe" /srvupt2⤵
- Checks computer location settings
PID:5072 -
C:\Program Files (x86)\IObit\Advanced SystemCare\startupInfo.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\startupInfo.exe" /auto3⤵PID:5052
-
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C00690054006F007000560050004E005F005500700064006100740065005F00410064006D0069006E002⤵PID:5356
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C00690054006F007000560050004E005F005300630068006500640075006C00650072005F00410064006D0069006E002⤵PID:1480
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C00690054006F007000560050004E005F0053006B00690070005500410043005F00410064006D0069006E002⤵PID:5268
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\register.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\register.exe" /trailcheck2⤵
- Drops file in Program Files directory
PID:2960
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /2 /49004F0062006900740055006E00530076007200 /43003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C0049004F006200690074005C0049004F00620069007400200055006E0069006E007300740061006C006C00650072005C004900550053006500720076006900630065002E00650078006500 /49004F00620069007400200055006E0069006E007300740061006C006C0065007200200053006500720076006900630065002⤵PID:212
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C0055006E0069006E007300740061006C006C00650072005F0053006B00690070005500610063005F00410064006D0069006E002⤵PID:6244
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /1 /410056004700420072006F0077007300650072004100750074006F004C00610075006E00630068005F0032003500330039004400390046004600460031004600340030004300300041003900370036003700360032004400360043003800310035004400330045003300 /220043003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C004100560047005C00420072006F0077007300650072005C004100700070006C00690063006100740069006F006E005C00410056004700420072006F0077007300650072002E00650078006500220020002D002D0063006800650063006B002D00720075006E003D007300720063003D006C006F0067006F006E0020002D002D006100750074006F002D006C00610075006E00630068002D00610074002D00730074006100720074007500700020002D002D00700072006F00660069006C0065002D006400690072006500630074006F00720079003D002200440065006600610075006C0074002200 /48004B00450059005F00430055005200520045004E0054005F0055005300450052005C0053004F004600540057004100520045005C004D006900630072006F0073006F00660074005C00570069006E0064006F00770073005C00430075007200720065006E007400560065007200730069006F006E005C00520075006E005C002⤵PID:6392
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C00690054006F007000200042004C00410043004B00200046005200490044004100590020005400610073006B00200028004F006E0065002D00540069006D00650029002⤵PID:6696
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\MonitorDisk.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\MonitorDisk.exe"2⤵
- Enumerates connected drives
PID:6912
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C0042004C00410043004B00200046005200490044004100590020005400610073006B00200028004F006E0065002D00540069006D00650029002⤵PID:6388
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\AutoCare.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\AutoCare.exe" /autorun /Pr2⤵PID:5548
-
C:\Windows\system32\netsh.exenetsh int tcp show global3⤵PID:5472
-
-
C:\Windows\system32\secedit.exesecedit /export /cfg C:\Users\Admin\AppData\Local\Temp\2117.inf /log C:\Users\Admin\AppData\Local\Temp\7589.log3⤵PID:2036
-
-
C:\Windows\system32\secedit.exesecedit /export /cfg C:\Users\Admin\AppData\Local\Temp\9775.inf /log C:\Users\Admin\AppData\Local\Temp\3052.log3⤵PID:6668
-
-
C:\Windows\SysWOW64\sc.exesc start MpsSvc3⤵
- Launches sc.exe
PID:5320 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Modifies registry class
PID:520
-
-
-
C:\Windows\SysWOW64\sc.exesc start MpsSvc3⤵
- Launches sc.exe
PID:6748
-
-
C:\Windows\SysWOW64\sc.exesc start MpsSvc3⤵
- Launches sc.exe
PID:5384 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:3644
-
-
-
C:\Windows\SysWOW64\sc.exesc start MpsSvc3⤵
- Launches sc.exe
PID:4256
-
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C00690054006F0070002000530063007200650065006E0020005200650063006F007200640065007200200053006B006900700055004100430020002800410064006D0069006E0029002⤵PID:3524
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C00690054006F0070002000530063007200650065006E0020005200650063006F00720064006500720020005500410043002⤵
- Checks computer location settings
PID:5400
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C00690054006F0070002000530063007200650065006E0020005200650063006F00720064006500720020005500700064006100740065002⤵PID:5740
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C00690054006F0070002000530063007200650065006E0020005200650063006F007200640065007200200053007400610072007400750070002⤵PID:4368
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /2 /690054006F00700044006100740061005200650063006F00760065007200790053006500720076006900630065003300 /220043003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C00690054006F0070002000440061007400610020005200650063006F0076006500720079005C0049004400520053006500720076006900630065002E006500780065002200 /690054006F0070002000440061007400610020005200650063006F00760065007200790020005300650072007600690063006500200033002⤵PID:4708
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C00690054006F00700020005000440046002000450078007000520074002⤵PID:3380
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C00690054006F007000200050004400460020004C00610075006E0063006800200053006B006900700055004100430020002800410064006D0069006E0029002⤵PID:3260
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C00690054006F0070002000500044004600200053006B006900700055004100430020002800410064006D0069006E0029002⤵PID:3124
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C00690054006F007000200050004400460020005500700064006100740065002⤵PID:4580
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C00690054006F0070002000440061007400610020005200650063006F00760065007200790020005500700064006100740065002⤵PID:5596
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /3 /43003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C005400610073006B0073005C00690054006F0070002000440061007400610020005200650063006F007600650072007900200053006B006900700055004100430020002800410064006D0069006E0029002⤵PID:3576
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /1 /490044004D0061006E00 /43003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C0049006E007400650072006E0065007400200044006F0077006E006C006F006100640020004D0061006E0061006700650072005C00490044004D0061006E002E0065007800650020002F006F006E0062006F006F007400 /48004B00450059005F00430055005200520045004E0054005F0055005300450052005C0053004F004600540057004100520045005C004D006900630072006F0073006F00660074005C00570069006E0064006F00770073005C00430075007200720065006E007400560065007200730069006F006E005C00520075006E005C002⤵PID:6828
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\AutoUpdate.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\AutoUpdate.exe" /SvcCheck2⤵PID:1184
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /1 /62007400 /43003A005C00550073006500720073005C00410064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C0042006900740054006F007200720065006E0074005C0042006900740054006F007200720065006E0074002E0065007800650020002F004D0049004E0049004D0049005A0045004400 /48004B00450059005F00430055005200520045004E0054005F0055005300450052005C0053004F004600540057004100520045005C004D006900630072006F0073006F00660074005C00570069006E0064006F00770073005C00430075007200720065006E007400560065007200730069006F006E005C00520075006E005C002⤵PID:5852
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /2 /5700430041007300730069007300740061006E0074005300650072007600690063006500 /43003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C004C0061007600610073006F00660074005C00570065006200200043006F006D00700061006E0069006F006E005C004100700070006C00690063006100740069006F006E005C004C0061007600610073006F00660074002E005700430041007300730069007300740061006E0074002E00570069006E0053006500720076006900630065002E00650078006500 /57004300200041007300730069007300740061006E0074002⤵PID:3016
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /2 /4400430049005300650072007600690063006500 /43003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C004C0061007600610073006F00660074005C00570065006200200043006F006D00700061006E0069006F006E005C0053006500720076006900630065005C007800360034005C0044004300490053006500720076006900630065002E00650078006500 /44004300490053006500720076006900630065002⤵PID:1056
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /1 /570065006200200043006F006D00700061006E0069006F006E00 /43003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C004C0061007600610073006F00660074005C00570065006200200043006F006D00700061006E0069006F006E005C004100700070006C00690063006100740069006F006E005C0057006500620043006F006D00700061006E0069006F006E002E0065007800650020002D002D006D0069006E0069006D0069007A0065002000 /48004B00450059005F00430055005200520045004E0054005F0055005300450052005C0053004F004600540057004100520045005C004D006900630072006F0073006F00660074005C00570069006E0064006F00770073005C00430075007200720065006E007400560065007200730069006F006E005C00520075006E005C002⤵PID:1040
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\BrowserProtect.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\BrowserProtect.exe" /popup2⤵PID:3260
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /2 /4D00420041004D0049006E007300740061006C006C00650072005300650072007600690063006500 /220043003A005C00550073006500720073005C00410064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C004D00420041004D0049006E007300740061006C006C006500720053006500720076006900630065002E006500780065002200 /4D0061006C00770061007200650062007900740065007300200049006E007300740061006C006C0065007200200053006500720076006900630065002⤵PID:1544
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /2 /4D00420041004D005300650072007600690063006500 /220043003A005C00500072006F006700720061006D002000460069006C00650073005C004D0061006C007700610072006500620079007400650073005C0041006E00740069002D004D0061006C0077006100720065005C004D00420041004D0053006500720076006900630065002E006500780065002200 /4D0061006C00770061007200650062007900740065007300200053006500720076006900630065002⤵PID:6988
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\BrowserCleaner.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\BrowserCleaner.exe" /Firefox2⤵PID:4004
-
-
C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe"C:\Program Files (x86)\IObit\Advanced SystemCare\smBootTime.exe" /AddAutoRun /2 /4D00420041004D0049006E007300740061006C006C00650072005300650072007600690063006500 /220043003A005C00500072006F006700720061006D002000460069006C00650073005C004D0061006C007700610072006500620079007400650073005C0041006E00740069002D004D0061006C0077006100720065005C004D00420041004D0049006E007300740061006C006C006500720053006500720076006900630065002E006500780065002200 /4D0061006C00770061007200650062007900740065007300200049006E007300740061006C006C0065007200200053006500720076006900630065002⤵PID:440
-
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent1⤵PID:5356
-
C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe"1⤵PID:376
-
C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe" /srvupt2⤵PID:6880
-
-
C:\Program Files (x86)\IObit\IObit Uninstaller\DSPut.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\DSPut.exe"2⤵PID:4460
-
-
C:\Program Files (x86)\IObit\IObit Uninstaller\AutoUpdate.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\AutoUpdate.exe" /SvcCheck2⤵PID:3476
-
C:\Program Files (x86)\IObit\IObit Uninstaller\BigUpgrade_IU12_5.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\BigUpgrade_IU12_5.exe" /bigupgrade /53⤵PID:7052
-
-
C:\Program Files (x86)\IObit\IObit Uninstaller\bf.exe"C:\Program Files (x86)\IObit\IObit Uninstaller\bf.exe" /br3⤵PID:5412
-
-
-
C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\elevation_service.exe"C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\elevation_service.exe"1⤵PID:4368
-
C:\Windows\System32\slui.exeC:\Windows\System32\slui.exe -Embedding1⤵PID:1364
-
C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\elevation_service.exe"C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\elevation_service.exe"1⤵PID:4948
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x434 0x3781⤵PID:7120
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /c1⤵PID:660
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /cr2⤵PID:1928
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1207.2\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1207.2\AVGBrowserCrashHandler.exe"2⤵PID:2976
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1207.2\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1207.2\AVGBrowserCrashHandler64.exe"2⤵PID:4828
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ua /installsource scheduler1⤵PID:960
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /registermsihelper2⤵PID:4384
-
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /UAC1⤵PID:384
-
C:\Program Files\iTop Screen Recorder\AUpdate.exe"C:\Program Files\iTop Screen Recorder\AUpdate.exe" /u http://stats.itopvpn.com/iactive_month.php /a isr3 /p es /v 3.2.0.1168 /t 1 /d 72⤵PID:6796
-
-
C:\Program Files\iTop Screen Recorder\AUpdate.exe"C:\Program Files\iTop Screen Recorder\AUpdate.exe" /isr /dayactive2⤵
- Suspicious use of SetWindowsHookEx
PID:6348
-
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\7acbe0caba2640cfbb28953cf0ca42c0 /t 3040 /p 21241⤵PID:1460
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3476
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:5796
-
C:\Program Files (x86)\iTop Data Recovery\IDRService.exe"C:\Program Files (x86)\iTop Data Recovery\IDRService.exe"1⤵PID:6080
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:3568
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Registers COM server for autorun
PID:4536
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:6032 -
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:2520 -
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf3⤵PID:4956
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Checks processor information in registry
PID:5936 -
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵PID:4716
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵PID:5648
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Registers COM server for autorun
PID:5676
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵PID:5992
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵PID:6200
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵PID:7152
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵PID:1768
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Registers COM server for autorun
PID:5500
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵PID:5672
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵PID:3664
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵PID:440
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵PID:2592
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵PID:6520
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP3⤵PID:6524
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP4⤵PID:1272
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵PID:6576
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵PID:6800
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"2⤵PID:912
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"3⤵
- Registers COM server for autorun
PID:5596
-
-
-
C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe"C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1436
-
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /UAC1⤵
- Checks computer location settings
PID:5368 -
C:\Program Files\iTop Screen Recorder\AUpdate.exe"C:\Program Files\iTop Screen Recorder\AUpdate.exe" /u http://stats.itopvpn.com/iactive_month.php /a isr3 /p es /v 3.2.0.1168 /t 1 /d 72⤵PID:7112
-
-
C:\Program Files\iTop Screen Recorder\AUpdate.exe"C:\Program Files\iTop Screen Recorder\AUpdate.exe" /isr /dayactive2⤵
- Suspicious use of SetWindowsHookEx
PID:4060
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4260
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:6636
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Writes to the Master Boot Record (MBR)
- Modifies data under HKEY_USERS
PID:5172
-
C:\Program Files\iTop Screen Recorder\AutoUpdate.exe"C:\Program Files\iTop Screen Recorder\AutoUpdate.exe" /auto1⤵PID:4544
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /AutoupdateUac2⤵PID:5648
-
-
C:\Program Files\iTop Screen Recorder\Pub\isrbfr.exe"C:\Program Files\iTop Screen Recorder\Pub\isrbfr.exe" /isr2⤵
- Modifies system executable filetype association
PID:1404
-
-
C:\Program Files\iTop Screen Recorder\iScrInit.exe"C:\Program Files\iTop Screen Recorder\iScrInit.exe" /UAC1⤵
- Checks computer location settings
PID:6440 -
C:\Program Files\iTop Screen Recorder\AUpdate.exe"C:\Program Files\iTop Screen Recorder\AUpdate.exe" /u http://stats.itopvpn.com/iactive_month.php /a isr3 /p es /v 3.0.0.934 /t 1 /d 72⤵PID:2628
-
-
C:\Program Files\iTop Screen Recorder\AUpdate.exe"C:\Program Files\iTop Screen Recorder\AUpdate.exe" /isr /dayactive2⤵
- Registers COM server for autorun
- Suspicious use of SetWindowsHookEx
PID:3244
-
-
C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\elevation_service.exe"C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\elevation_service.exe"1⤵PID:720
-
C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\elevation_service.exe"C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\elevation_service.exe"1⤵PID:5252
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:6296
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:3920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5836 -ip 58362⤵PID:5356
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:2976
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}1⤵PID:6392
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:5208
-
C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe"C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe"1⤵
- Registers COM server for autorun
- Drops file in System32 directory
PID:384
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"1⤵
- Checks computer location settings
- Modifies data under HKEY_USERS
PID:5536 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone2⤵PID:6632
-
C:\Windows\system32\netsh.exenetsh http add urlacl url=http://+:9007/ user=Everyone3⤵PID:4576
-
-
-
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeC:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe1⤵PID:6816
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4828
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x434 0x3781⤵PID:6284
-
C:\Users\Admin\AppData\Local\Temp\MBAMInstallerService.exe"C:\Users\Admin\AppData\Local\Temp\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
PID:6516 -
C:\Windows\system32\certutil.exe"C:\Windows\system32\certutil.exe" -f -addstore root "C:\Windows\TEMP\MBInstallTemp\servicepkg\starfieldrootcag2_new.crt"2⤵
- Modifies data under HKEY_USERS
PID:4352
-
-
C:\Windows\system32\certutil.exe"C:\Windows\system32\certutil.exe" -f -addstore root "C:\Windows\TEMP\MBInstallTemp\servicepkg\msrootca2020.crt"2⤵PID:4916
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Registers COM server for autorun
- Drops file in System32 directory
- Modifies registry class
PID:5576
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Registers COM server for autorun
- Sets service image path in registry
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:3260 -
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:4056 -
C:\Users\Admin\Downloads\MB-SupportTool.exeC:\Users\Admin\Downloads\MB-SupportTool.exe ""3⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\7zS921D.tmp\mbstub.exe.\mbstub.exe ""4⤵PID:6520
-
C:\Users\Admin\AppData\Local\Temp\mwb9EB0.tmp\mb-support.exeC:\Users\Admin\AppData\Local\Temp\mwb9EB0.tmp\mb-support.exe ""5⤵
- Checks BIOS information in registry
PID:7020
-
-
-
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵PID:5044
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-0.exeig.exe reseed2⤵PID:6412
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-1.exeig.exe reseed2⤵PID:5216
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-2.exeig.exe reseed2⤵PID:632
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-3.exeig.exe reseed2⤵PID:1376
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-4.exeig.exe reseed2⤵PID:6904
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-5.exeig.exe reseed2⤵PID:2036
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-6.exeig.exe reseed2⤵PID:6196
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-7.exeig.exe reseed2⤵PID:1040
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-8.exeig.exe reseed2⤵PID:2664
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-9.exeig.exe reseed2⤵PID:3408
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-10.exeig.exe reseed2⤵PID:6940
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-11.exeig.exe reseed2⤵PID:4000
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-12.exeig.exe reseed2⤵PID:4552
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-13.exeig.exe reseed2⤵PID:6092
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-14.exeig.exe reseed2⤵PID:6400
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-15.exeig.exe reseed2⤵PID:3176
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-16.exeig.exe reseed2⤵PID:796
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-17.exeig.exe reseed2⤵PID:5556
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-18.exeig.exe reseed2⤵PID:1104
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-19.exeig.exe reseed2⤵PID:6964
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-20.exeig.exe reseed2⤵PID:4352
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-21.exeig.exe reseed2⤵PID:2916
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-22.exeig.exe reseed2⤵PID:6436
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-23.exeig.exe reseed2⤵PID:2876
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-24.exeig.exe reseed2⤵PID:5920
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-25.exeig.exe reseed2⤵PID:212
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-26.exeig.exe reseed2⤵PID:6428
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-27.exeig.exe reseed2⤵PID:6216
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-28.exeig.exe reseed2⤵PID:6960
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-29.exeig.exe reseed2⤵PID:6664
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-30.exeig.exe reseed2⤵PID:5500
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-31.exeig.exe reseed2⤵PID:1404
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-32.exeig.exe reseed2⤵PID:3448
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-33.exeig.exe reseed2⤵PID:6520
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-34.exeig.exe reseed2⤵PID:3420
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-35.exeig.exe reseed2⤵PID:2648
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-36.exeig.exe reseed2⤵PID:6256
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-37.exeig.exe reseed2⤵PID:5844
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-38.exeig.exe reseed2⤵PID:6484
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-39.exeig.exe reseed2⤵PID:6308
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-40.exeig.exe reseed2⤵PID:6628
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-41.exeig.exe reseed2⤵PID:1636
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-42.exeig.exe reseed2⤵PID:5376
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-43.exeig.exe reseed2⤵PID:376
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-44.exeig.exe reseed2⤵PID:1632
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-45.exeig.exe reseed2⤵PID:2568
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-46.exeig.exe reseed2⤵PID:2080
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-47.exeig.exe reseed2⤵PID:4840
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-48.exeig.exe reseed2⤵PID:2776
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-49.exeig.exe reseed2⤵PID:1828
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 0 /status on true /updatesubstatus none /scansubstatus none /settingssubstatus none2⤵PID:6400
-
-
C:\Users\Admin\AppData\LocalLow\IGDump\bufrxmxhacavzcekehnmhgigfeznqdso\ig.exeig.exe timer 4000 xsvfjclpfcwuosyfndafiwqrjbjrlkpp.ext2⤵PID:2600
-
-
C:\Users\Admin\AppData\LocalLow\IGDump\fbxbajsgonbkruhnlmvriqoujgwtrvjw\ig.exeig.exe timer 4000 jjmsevgktfybhpfknnqifeyvcutidejc.ext2⤵PID:5184
-
-
C:\Users\Admin\AppData\LocalLow\IGDump\ezseblecczxdoapfklkphfovhutmlgzc\ig.exeig.exe timer 4000 fyfayfcnwgqxaiqpphyxopqauijztbjc.ext2⤵PID:5256
-
-
C:\Users\Admin\AppData\LocalLow\IGDump\fbxbajsgonbkruhnlmvriqoujgwtrvjw\ig.exeig.exe timer 4000 orivepycbyrkbkevngwschtvknekjphx.ext2⤵PID:3476
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵PID:5960
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-0.exeig.exe reseed2⤵PID:3176
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-1.exeig.exe reseed2⤵PID:6708
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-2.exeig.exe reseed2⤵PID:1204
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-3.exeig.exe reseed2⤵PID:5268
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-4.exeig.exe reseed2⤵PID:660
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-5.exeig.exe reseed2⤵PID:6544
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-6.exeig.exe reseed2⤵PID:6832
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-7.exeig.exe reseed2⤵PID:3584
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-8.exeig.exe reseed2⤵PID:3024
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-9.exeig.exe reseed2⤵PID:6864
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-10.exeig.exe reseed2⤵PID:6008
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-11.exeig.exe reseed2⤵PID:4404
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-12.exeig.exe reseed2⤵PID:5428
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-13.exeig.exe reseed2⤵PID:3556
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-14.exeig.exe reseed2⤵PID:5916
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-15.exeig.exe reseed2⤵PID:6772
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-16.exeig.exe reseed2⤵PID:5864
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-17.exeig.exe reseed2⤵PID:6196
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-18.exeig.exe reseed2⤵PID:708
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-19.exeig.exe reseed2⤵PID:6016
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-20.exeig.exe reseed2⤵PID:5460
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-21.exeig.exe reseed2⤵PID:4540
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-22.exeig.exe reseed2⤵PID:4384
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-23.exeig.exe reseed2⤵PID:4344
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-24.exeig.exe reseed2⤵PID:6140
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-25.exeig.exe reseed2⤵PID:3484
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-26.exeig.exe reseed2⤵PID:3100
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-27.exeig.exe reseed2⤵PID:1076
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-28.exeig.exe reseed2⤵PID:4160
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-29.exeig.exe reseed2⤵PID:5416
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-30.exeig.exe reseed2⤵PID:4452
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-31.exeig.exe reseed2⤵PID:1096
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-32.exeig.exe reseed2⤵PID:3812
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-33.exeig.exe reseed2⤵PID:1300
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-34.exeig.exe reseed2⤵PID:5880
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-35.exeig.exe reseed2⤵PID:3800
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-36.exeig.exe reseed2⤵PID:6300
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-37.exeig.exe reseed2⤵PID:2600
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-38.exeig.exe reseed2⤵PID:4148
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-39.exeig.exe reseed2⤵PID:5608
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-40.exeig.exe reseed2⤵PID:1236
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-41.exeig.exe reseed2⤵PID:4000
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-42.exeig.exe reseed2⤵PID:5636
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-43.exeig.exe reseed2⤵PID:6128
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-44.exeig.exe reseed2⤵PID:6480
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-45.exeig.exe reseed2⤵PID:3432
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-46.exeig.exe reseed2⤵PID:3412
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-47.exeig.exe reseed2⤵PID:6912
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-48.exeig.exe reseed2⤵PID:1040
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-49.exeig.exe reseed2⤵PID:2372
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6288
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1204
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:4980
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:6884
-
C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe" /Uninstall1⤵PID:4244
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --single-argument https://www.surveymonkey.com/r/Uninstall_Trial?utm_source=INPRODUCT&utm_medium=Expt&utm_campaign=EXPT44&utm_content=CTrial&progver=4.5.18&cuver=1.0.18232⤵
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
- Modifies system certificate store
PID:5824 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=107.0.19254.108 --initial-client-data=0x40,0x120,0x124,0xfc,0x128,0x7fffb98aaea8,0x7fffb98aaeb8,0x7fffb98aaec83⤵PID:2632
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:23⤵PID:4756
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6420
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=2024 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:3800
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --start-stack-profiler --first-renderer-process --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=3432 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:13⤵
- Checks computer location settings
PID:2256
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=3440 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:13⤵PID:1408
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=4056 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:13⤵
- Checks computer location settings
PID:5336
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5552 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:1364
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --disable-protect3⤵
- Enumerates system info in registry
PID:5476 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=107.0.19254.108 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffb98aaea8,0x7fffb98aaeb8,0x7fffb98aaec84⤵PID:3584
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 --field-trial-handle=2080,i,10250711631154155280,12571416035064994449,131072 /prefetch:24⤵PID:3128
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=1996 --field-trial-handle=2080,i,10250711631154155280,12571416035064994449,131072 /prefetch:84⤵PID:1636
-
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5648 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:3256
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5656 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6560
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5676 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6932
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5624 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6044
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6084 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:64
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5992 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:3544
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=6284 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:5484
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=5760 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:4180
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=5896 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:5952
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=6016 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:7024
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=6168 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:2732
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=5748 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6052
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6488 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:5016
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5900 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:2336
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6192 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:3192
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6900 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6712
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6208 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:5696
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=7172 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6332
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=7336 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6588
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=7500 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6436
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=7652 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6008
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=7812 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:5980
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=7836 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6016
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=8396 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6884
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=8428 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6004
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=8584 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6260
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=8728 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:5936
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=8940 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:7064
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --mojo-platform-channel-handle=8972 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:13⤵
- Checks computer location settings
PID:3744
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --mojo-platform-channel-handle=9172 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:13⤵
- Checks computer location settings
PID:2916
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5992 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:2052
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --mojo-platform-channel-handle=9476 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:13⤵
- Checks computer location settings
PID:6564
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=9668 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6496
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --mojo-platform-channel-handle=9972 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:13⤵
- Checks computer location settings
PID:456
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --mojo-platform-channel-handle=10160 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:13⤵PID:1380
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=10208 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:2820
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --mojo-platform-channel-handle=10628 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:13⤵
- Checks computer location settings
PID:4080
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --mojo-platform-channel-handle=5116 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:13⤵
- Checks computer location settings
PID:6588
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --start-stack-profiler --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --mojo-platform-channel-handle=1780 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:13⤵PID:3584
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --mojo-platform-channel-handle=9540 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:13⤵
- Checks computer location settings
PID:2532
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --mojo-platform-channel-handle=9568 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:13⤵
- Checks computer location settings
PID:6644
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=8776 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:83⤵PID:6732
-
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --mojo-platform-channel-handle=8956 --field-trial-handle=2100,i,2929971632454328247,12354453073909764417,131072 /prefetch:13⤵PID:5216
-
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Modifies data under HKEY_USERS
PID:6744 -
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /uninstall2⤵PID:4444
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Unregserver2⤵
- Registers COM server for autorun
- Modifies registry class
PID:1096
-
-
C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\elevation_service.exe"C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\elevation_service.exe"1⤵PID:5620
-
C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\elevation_service.exe"C:\Program Files (x86)\AVG\Browser\Application\107.0.19254.108\elevation_service.exe"1⤵PID:1248
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:440
Network
MITRE ATT&CK Enterprise v6
Persistence
Bootkit
1Browser Extensions
1Change Default File Association
1Modify Existing Service
1New Service
1Registry Run Keys / Startup Folder
5Defense Evasion
Impair Defenses
1Install Root Certificate
1Modify Registry
9Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
849KB
MD573e8fc17c670b29cc7306920411eda87
SHA1ed33549d67ba78cb69697822f999c3bf5d3d84f2
SHA256e0b08f6f91b0518cd11e1bae60eb37a82ab35762e5dd065f7c46f547cdef892e
SHA512edb12ea285b5d1259a6daa182127e67baaecc1ef866c88aae24de949ae7582a83ffdc1634fe1fd35cd94c89f60ffec8a8d1aa5124aa6e69ea9caa3b83084d3f7
-
Filesize
772KB
MD5c2588919895de5c04ad5e4d609aacf8c
SHA15a554813fb22b2c945a7f29bf4bd09f859204987
SHA256e600f98a96476ef66d370f675ac79ce44ccb2a8759bd1c3741bf8f7e295568bb
SHA512b43f554e4ed6edf939ebecbcc12e0c16f42dbc360dc82356bac72f23b2dd8eb7b835ad7e91084ed2ab307c1e526cbd3beeb483ad4c3a8d256a7dbb9415f2a7a8
-
Filesize
540KB
MD5e43e4a5ea52304bf6746d5274494546b
SHA155843bee801ffb0898ac43fcff45ae61bf53913e
SHA2568922403077c86bdf0fed8cebc7e66da37df6370cd18af7f7dbb977fbc0f5c30b
SHA5121ccc1253c33717c7638e282bef9e40da10be8c471c35cbadb7734f47fe3815e11076233109ad1e6c942563c35481e5b0557de9453cad71061cb34d3627b92053
-
Filesize
695KB
MD5f4f56ba110fc8948a7604bca71c03f86
SHA1762e2749b09d0ea901a81b0bdf7b2fff806257be
SHA2567b341eebd57d0886c08043436314818b791c3c05991300ecf20e49dbe2e5f13b
SHA512e6e7490c92dea6eb36ebaddacb7abb4f019877dcfac8921131b70e7a736f1f511d1e36158249932e1bfb7cfe8817cf463d3c62c452e4b1eaa76bbf18d77bef24
-
Filesize
566KB
MD57ae07968c7ef3a86ebb9a1d33d75fd55
SHA19dc0f9967ebd08a739f147d9685810dee9b2d1cb
SHA2567a8f5cf0397b7d8dce222dc63ac02c36c51f91a6478af492796d2a86c0b5d36b
SHA512dded954f79785886ddbfec403f818a84dc05f75e477f459233d45fd9b1251622ec74fe3afd3b13eeeaca92cb6317b85e59341f1e64913e99e297e0056d565d3c
-
Filesize
1.3MB
MD51ae8d36cd4131be74cbf5a8753fe70f0
SHA12bda7df3316ac610808447d3b5a83f2bf5b39f55
SHA256571e9d6a44b66e2680acb972e6d7abcf947da8b4dcb6f2143bfcb7742a2a61ec
SHA512a0f015e20609d56e1539caac8927864d2667745d4f48e385a315f06687f40bbeefa9eda9070737a066ec4d95140d5abfff11c6827beda14cdaf6603fa26e2b7e
-
Filesize
360KB
MD542225d1d11e0e2295388c0b929b9c958
SHA15d1d7989b47fb839193e7ef9d5d5145773b6fe4a
SHA256ae84d6fe011994fb708f7d0f995df00d9b58e5f891a2eac1a612c488ebf9378f
SHA512c628edf127ca11602e13727d16823af0100a6438c8f5b37d6b63890a3e7fb8ef0c8ddef4b67c469cc09a123a87f2c9e6453164d41ebe183bd358900c12480907
-
Filesize
515KB
MD5122a1ecbb676899e05efc103f277b6f1
SHA1f807b955d03378a56f63841aa82adc741e893ee4
SHA256618e0ce7e48923199391bebe7540411cb268890919313e392099012c56923335
SHA5123f732d40916296eaad2bed13c83c3146f641a75194659d99699983ae4f2f8fc2fe959440c0bbb114e5d03c75ff14c258aef3d3f63a1054510601f0a639e7d49e
-
Filesize
463KB
MD5746433e3ab76e3b9bbfffc544b3797d0
SHA1f9ff27c0427fff05406b90ab68448c437b6dd7fc
SHA256f779fcafff5a0ac15ec55f041664d36aa645f8eb1929541147bea75e3b3e3126
SHA512ef0f65c74397abf8fa0d8e04e52ed4aae62a92efd9162143d275f06bc3969ea2320ef106a9a331159f45d880c4198b100d7b6db9312ee022912d8b46ccb02484
-
Filesize
798KB
MD555f9fe57bb5093233e07d61e68946710
SHA1d7cf45a30a6a9a6b40ebc909fb1a0bd10464dcf6
SHA256124af1c43c52467d136d79f748ce30a1a71af7e3e70f4f9ce6496eb809f37764
SHA51282c88f9c00312fd86922ba34a0de8d1b8caadd9999a9aae21db1629c72cd44f6773f498a9b8d82f2f745ad6c673e88384fe6a8d86b12b40b8949388faa803dbc
-
Filesize
592KB
MD52ec1fdb3dc92ceca8d490ccb5eb972ef
SHA1683ceaee53578a284a4aee59438c8085c90e5d79
SHA2561487e61bd91efff08fbb979485696818881de15e028b63c5a326459383ea977e
SHA51236101bd9de5071fbee2859e82d2aae8b9d551edfbf0652811c28a62966a0b504d7ed8ac4e9be178374f4ffea21d434d8496bdd49ca6af616037d90bf0a011cef
-
Filesize
952KB
MD5c8fbde64103863435923ea1f60afcfa1
SHA1e435379287a88d4acc468ded29aab298decd3e2e
SHA256cebaf29448692d043160dc675267ef678e078f74e14be47b68ddaed5978788bc
SHA5126e4f626763f6fc9dc9cbeed505b9ee5f05ad833314b5ab34842b3a4e12fa1973b4b71c913ca566976346af7efe3cfc35bc73ba50934dce32863113b7bf7e8eff
-
Filesize
437KB
MD5db5dedd81c9911057df2961c15dca970
SHA1c3416472aafad2263ef592a569fb6f7a85576cfa
SHA2566b67b5b00b55540e4ed21f42e4ca899ce035ed1ca1fee38a292d2ed949b91447
SHA51265b99fb5c3d80425ab109a70a341b3b37986c75bd00af598970489d49d6248eb7f9d55e451d816a2a9a88f7c7bd49ba915d4cbff0f9fafc3b9a28ee42ddb22c3
-
Filesize
412KB
MD517f8c1b66fc8da6681d55fb8783669dc
SHA1d6f3a6d873db41748beffc5ec6e1b9a3bf05808d
SHA2560b9462456667d34cefc505641c12c2307ee75bfe86fc6a6fde0977d14151157b
SHA5124b6c146285fa33c9c76082d159451f468d491bcb216957e8c057553592157430c9384b62dc3379f57af26b7f5fe4a0fa31f3a361d236b7ed83956dd53bb41d7b
-
Filesize
618KB
MD5d1222e999b6100a8a7b7424d3d01395e
SHA16906ce2f7ea5d296fbbddc78e18c385f90cb5750
SHA256a3ceaf4ee0c28839e8dac29c783f9aa5ba0e322e2f8b49cce40ddc352cf9db65
SHA5127994524c742432f8d8ee1df2a128c59cb7d3ca2777e8437f34caaf56a4a0d12c8dbd5464aee1258b1838da7959dd28b46a259a6f926f10dba9544dde818ad5e9
-
Filesize
746KB
MD53379ad2d99522c3a60fa631db7911f25
SHA1fbebd1a4175b7887cfccbc242a25ca418c37a8df
SHA256bfe60f747a7755415083fe8e783e0bfb290d4e2441439321df9a876db6f87c77
SHA512d3f12fc5ceb759b2229b63c4e8f7396db037302ebb6e05e4dad2d802fb3434c8a987fba4abb2e62be2334418df22d1d258ece2063ca0f11afc475b43f7372dd9
-
Filesize
643KB
MD57febed040e98929060ea6655e802bd34
SHA1aba872a72f5be2ec10d8e212bbef248574401b2d
SHA2563b760d8196faf1705de552a2885d0c4dd37f582f64cdcdeb15b1a6c039bbdb34
SHA512247349493145bc0c392f5041c713b4a0d5a36eebca7c225a7423d665ab54f47ca2a47d3daec592a101d946d9b35de93b45b56c50d9d8137e1f381d54b91070a4
-
Filesize
721KB
MD5d58782b9de6eb5ce8413915e66164890
SHA19e3426318ea75fbc35eb1de6ad8a8ad2f146f945
SHA256542933b43da8847d40b7e4b163df4dd1541508fed09360d5848cc4923e72d33a
SHA51293edbc3b08fa8a61ab1e35c17b4ac2742c2dbb73aeb9764df612ca29d0e49e08336cb8833fbeff0234477231fe5c8a6830fb8c055c0aa0fd2ec13db93b4ab4d3
-
Filesize
386KB
MD5aedde473f8d71db567f686c247d8d6bb
SHA1b771f8f4e049109de2d5de900e6201fbbc4b05f0
SHA2568906c15fec313839d45cda36fc0ad62530a72973f379f82969b097f2b9bad34e
SHA5126cb0eafb2a2175ea1db62ba6e88401a82386688870197aa3b86ba47888d565c62369c7e2535172517e1e02c7928dc7fe3eb68442abbb9bb00b9ebc978f20104e
-
Filesize
824KB
MD5b36b9b99e444e434b538fee4922fd294
SHA1ceb6481f8dcc3d01e1006cca6a87b9bbc52108cd
SHA25655399c23f43e16318882a0884a9f318dd50e768c5b860aa3f9251bf6a6f18a65
SHA512c3622b82f12b1101e0dd38ae36e2d074330ce5152d5220be08c07c2ed7d319b0d824c7ce37af5155e4f97e8e89b165ca7e6b1f19b013db92f4c9b87e73ca6724
-
Filesize
875KB
MD51e3f3e9fd92183e4337e74a1747ffec4
SHA1d10a92a18a12f59a9e43bfd42974a65a15900d7d
SHA2567c3b32d697efcb07a27f0d7ccbea864910a83dddc4539a6cc29542c25df5b759
SHA5128373240a4a7d0898753581fe1a404f1ba80531dae012df85926b55e60faab5cc32edefb0522610ec72a0000c3aba4bcf550ef96244d13f4d0417b9e12b2967f3
-
Filesize
489KB
MD5a156a9aaf24cdbedd73ad997400a0290
SHA18a52c8e3395943070b2cc925736baf82f1ece497
SHA2569ccc866c8208a3e1ea8deccd92249fe1f997d0ba1414c996a88628af5a1fc519
SHA51261c0bf3555706a0aa2d4e43e84294c978ed02c7bb39a70ffebfaec0ce159b4cb72b3ee9aaa450371668dc2e38b71ce31ac0283054f775a08bdbaaac805be08c4
-
Filesize
901KB
MD5a99374f0c725b68859b98f7cdd27eda3
SHA11429980e05f2938efc7b49fc021ca6764ec10190
SHA25691d0dfefe1369a0e613ab1191c13f4abb24ea5397b56be0782b9e587eb7040b4
SHA5129a442a59bb0a1c1d60ba9646836307a6b0c684bdd20e8fff80a41d8a3914e996f002223c01bfbc36a38f2eb500018c641679ed10d33d447cddb5eec23eaebad6
-
Filesize
669KB
MD5b720f291ed97315a23076fc41bc8e5e5
SHA1cde15eb74b988e05d1a98cee90fe4133efb61f44
SHA2565a5c3b3fe680f7734ed26f42a021276e797a0765e7eca35c37ee81963fcceebe
SHA512a9334dee1123823ae42e04f3f8279ced601469224799910387e490423b95f8beffe6394600859a2dd02f5bc19652d9711c11b9fbd481bf8f0c721f412d5ed534
-
Filesize
927KB
MD5094c9674a065747b122f880077d912da
SHA195820b818bc5691e24ed3139fa6b5406651fd881
SHA256ab26a50594712c4974983c83a623a2334c4e186aaf368fd957b7ceb7cc4e6fce
SHA5122111c4f0c3fdd50108fab4db9889b24bc3155da53d98ffbc717c27e739fec3618542286be774fdec06071abea3ac619647fbbbaee6e494e6c235dc1f4944143b
-
Filesize
334KB
MD50ec417c761f657579c1fe842bfb63531
SHA19f2a5ca7f2a5b2a2a937a779471043edbc2cd3a9
SHA2560a716791cc359ba9947bf6bad1b202e5a7d964c287f3e340fd474540c2b7656c
SHA512f77770f53e3f806788cbcd1f30b79c2db36f4b6094a3b4a4c862afc06fe14ca68551e785e724c623f80a10204584d19a27fd9b4d57fa9932c272e5bcc54a83ba