hxxps://www[.]youtube[.]com/redirect?event=video_description&redir_token=QUFFLUhqa3pxSk5sV2EzLXlNTDFoWm1fOXI5cG82bVNrZ3xBQ3Jtc0tsVXdyWXJGX1BHUjdGSXByS0VNVkxQalhBMS03VWhVdDg2bEo0ZUY1NHNsWktYNjhZMEdnSjMzb3ZQc2p0dU8yZTlDNGVHcVhYRFdEOE9ZT1Y4UGJBc2M0UmtpZVJfcmlzNVhfNEc3alR4MHdyU0Jobw&q=http%3A%2F%2Fcursoexcelvba[.]com[.]br%2Fproduto%2FInstalar-Visual-Basic-6[.]0-no-Windows-10-Curso-Excel%2F83%2F&v=n4GNcnvgVNM

Modify Registry

Processes:

instup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgSnx\ImagePath = "system32\\drivers\\avgSnx.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgArDisk\ImagePath = "system32\\drivers\\avgArDisk.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgArPot\ImagePath = "system32\\drivers\\avgArPot.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgKbd\ImagePath = "system32\\drivers\\avgKbd.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgMonFlt\ImagePath = "system32\\drivers\\avgMonFlt.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgVmm\ImagePath = "system32\\drivers\\avgVmm.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgSP\ImagePath = "system32\\drivers\\avgSP.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgbidsh\ImagePath = "system32\\drivers\\avgbidsh.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgbuniv\ImagePath = "system32\\drivers\\avgbuniv.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgbidsdriver\ImagePath = "system32\\drivers\\avgbidsdriver.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgNetHub\ImagePath = "system32\\drivers\\avgNetHub.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgRdr\ImagePath = "system32\\drivers\\avgRdr2.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgElam\ImagePath = "system32\\drivers\\avgElam.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgRvrt\ImagePath = "system32\\drivers\\avgRvrt.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgStm\ImagePath = "system32\\drivers\\avgStm.sys"	instup.exe

Executes dropped EXE 54 IoCs

Processes:

avg_antivirus_free_setup.exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exesbr.exewinrar-x64-621.exeuninstall.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeAvEmUpdate.exeAvEmUpdate.exeavBugReport.exeRegSvr.exeRegSvr.exeRegSvr.exeRegSvr.exeSetupInf.exeoverseer.exeengsup.exewsc_proxy.exewsc_proxy.exeengsup.exeavg_antivirus_free_setup.exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeinstup.exeinstup.exesbr.exeavg_antivirus_free_setup.exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeinstup.exeinstup.exesbr.exeWinRAR.exeavg_antivirus_free_setup.exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeinstup.exeinstup.exesbr.exe

pid	process
3988	avg_antivirus_free_setup.exe
820	avg_antivirus_free_setup_x64.exe
648	instup.exe
4684	instup.exe
4240	aswOfferTool.exe
4284	aswOfferTool.exe
3144	aswOfferTool.exe
4864	aswOfferTool.exe
2084	aswOfferTool.exe
1896	aswOfferTool.exe
1572	aswOfferTool.exe
4368	sbr.exe
5088	winrar-x64-621.exe
1596	uninstall.exe
2436	SetupInf.exe
4156	SetupInf.exe
2304	SetupInf.exe
4424	SetupInf.exe
4892	SetupInf.exe
4412	AvEmUpdate.exe
1252	AvEmUpdate.exe
384	avBugReport.exe
3772	RegSvr.exe
4820	RegSvr.exe
2192	RegSvr.exe
2964	RegSvr.exe
3896	SetupInf.exe
1896	overseer.exe
3548	engsup.exe
4468	wsc_proxy.exe
624	wsc_proxy.exe
4420	engsup.exe
2844	avg_antivirus_free_setup.exe
2144	avg_antivirus_free_setup_x64.exe
2336	instup.exe
1128	instup.exe
3548	instup.exe
1388	instup.exe
1212	sbr.exe
340	avg_antivirus_free_setup.exe
2716	avg_antivirus_free_setup_x64.exe
4412	instup.exe
5112	instup.exe
4396	instup.exe
4312	instup.exe
2476	sbr.exe
4256	WinRAR.exe
996	avg_antivirus_free_setup.exe
4792	avg_antivirus_free_setup_x64.exe
2164	instup.exe
2564	instup.exe
3552	instup.exe
2196	instup.exe
4292	sbr.exe

Loads dropped DLL 38 IoCs

Processes:

avg_antivirus_free_setup.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeavg_antivirus_free_setup.exeinstup.exeinstup.exeavg_antivirus_free_setup.exeinstup.exeinstup.exeavg_antivirus_free_setup.exeinstup.exeinstup.exe

pid	process
3988	avg_antivirus_free_setup.exe
648	instup.exe
648	instup.exe
648	instup.exe
648	instup.exe
4684	instup.exe
3144	aswOfferTool.exe
2084	aswOfferTool.exe
1896	aswOfferTool.exe
1572	aswOfferTool.exe
2844	avg_antivirus_free_setup.exe
3548	instup.exe
3548	instup.exe
3548	instup.exe
3548	instup.exe
3548	instup.exe
1388	instup.exe
1388	instup.exe
1388	instup.exe
1388	instup.exe
340	avg_antivirus_free_setup.exe
4396	instup.exe
4396	instup.exe
4396	instup.exe
4396	instup.exe
4312	instup.exe
4312	instup.exe
4312	instup.exe
4312	instup.exe
996	avg_antivirus_free_setup.exe
3552	instup.exe
3552	instup.exe
3552	instup.exe
3552	instup.exe
2196	instup.exe
2196	instup.exe
2196	instup.exe
2196	instup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

instup.exeRegSvr.exeRegSvr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\InProcServer32	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32\ = "C:\\Program Files\\AVG\\Antivirus\\aswAMSI.dll"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32\ThreadingModel = "Both"	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32\ = "C:\\Program Files\\AVG\\Antivirus\\aswAMSI.dll"	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\InprocServer32	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\InprocServer32\ThreadingModel = "Apartment"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\InProcServer32\ = "C:\\Program Files\\AVG\\Antivirus\\ashShell.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\InProcServer32\ReleaseName = "C:\\Program Files\\AVG\\Antivirus\\ashShell.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\InProcServer32\ThreadingModel = "Apartment"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32\ThreadingModel = "Both"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\InprocServer32\ = "C:\\Program Files\\AVG\\Antivirus\\asOutExt.dll"	RegSvr.exe

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

instup.exewsc_proxy.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{4FC75CA5-1654-5411-7CFB-1893D506BCF4}	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av	instup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SECURITY CENTER\PROVIDER\AV\{4FC75CA5-1654-5411-7CFB-1893D506BCF4}	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{4FC75CA5-1654-5411-7CFB-1893D506BCF4}	wsc_proxy.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SECURITY CENTER\PROVIDER\AV\{4FC75CA5-1654-5411-7CFB-1893D506BCF4}	wsc_proxy.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

instup.exechrome.exeinstup.exeinstup.exeinstup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AvRepair = "\"C:\\Program Files\\AVG\\Antivirus\\setup\\instup.exe\" /instop:repair /wait"	instup.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AvRepair = "\"C:\\Program Files\\AVG\\Antivirus\\setup\\instup.exe\" /instop:repair /wait"	instup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	instup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AvRepair = "\"C:\\Program Files\\AVG\\Antivirus\\setup\\instup.exe\" /instop:repair /wait"	instup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AvRepair = "\"C:\\Program Files\\AVG\\Antivirus\\setup\\instup.exe\" /instop:repair /wait"	instup.exe

Checks for any installed AV software in registry 1 TTPs 44 IoCs

Security Software Discovery

T1063

Processes:

RegSvr.exeinstup.exeavg_antivirus_free_setup_x64.exeinstup.exeSetupInf.exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeavg_antivirus_free_setup_x64.exeinstup.exepowershell.exeinstup.exeSetupInf.exeRegSvr.exeinstup.exeinstup.exeavg_antivirus_free_setup_x64.exeSetupInf.exeSetupInf.exewsc_proxy.exeinstup.exeinstup.exeinstup.exeSetupInf.exeRegSvr.exeinstup.exeAvEmUpdate.exeengsup.exeAvEmUpdate.exeRegSvr.exeengsup.exewsc_proxy.exeinstup.exeSetupInf.exeinstup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	avg_antivirus_free_setup_x64.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	avg_antivirus_free_setup_x64.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	avg_antivirus_free_setup_x64.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	powershell.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Avira\Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	avg_antivirus_free_setup_x64.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Avira\Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Avira\Antivirus	powershell.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	engsup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	engsup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast	instup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 37 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

SetupInf.exeRegSvr.exeinstup.exeinstup.exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeinstup.exeSetupInf.exeSetupInf.exeSetupInf.exewsc_proxy.exeAvEmUpdate.exeavBugReport.exeoverseer.exeavg_antivirus_free_setup.exeinstup.exeinstup.exeRegSvr.exewsc_proxy.exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeRegSvr.exeavg_antivirus_free_setup.exeinstup.exeinstup.exeavg_antivirus_free_setup.exeinstup.exeSetupInf.exeRegSvr.exeinstup.exeavg_antivirus_free_setup.exeinstup.exeavg_antivirus_free_setup_x64.exeSetupInf.exeavg_antivirus_free_setup_x64.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup_x64.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	wsc_proxy.exe
File opened for modification	\??\PhysicalDrive0	AvEmUpdate.exe
File opened for modification	\??\PhysicalDrive0	avBugReport.exe
File opened for modification	\??\PhysicalDrive0	overseer.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	wsc_proxy.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup_x64.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup_x64.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup_x64.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

WinRAR.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Documents\vb\AUTORUN.INF	WinRAR.exe
File created	C:\Users\Admin\Documents\vb\IE4b\AUTORUN.INF	WinRAR.exe
File opened for modification	C:\Users\Admin\Documents\vb\IE4b\AUTORUN.INF	WinRAR.exe
File created	C:\Users\Admin\Documents\vb\AUTORUN.INF	WinRAR.exe

Drops file in System32 directory 5 IoCs

Processes:

instup.exeSetupInf.exemmc.exemmc.exe

description	ioc	process
File opened for modification	C:\Windows\system32\asw869f862eeb16d3ae.tmp	instup.exe
File created	C:\Windows\system32\asw869f862eeb16d3ae.tmp	instup.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	SetupInf.exe
File opened for modification	C:\Windows\system32\WF.msc	mmc.exe
File opened for modification	C:\Windows\system32\compmgmt.msc	mmc.exe

Drops file in Program Files directory 64 IoCs

Processes:

instup.exeinstup.exeengsup.exewinrar-x64-621.exeinstup.exeinstup.exe

description	ioc	process
File created	C:\Program Files\AVG\Antivirus\setup\setup.def	instup.exe
File created	C:\Program Files\AVG\Antivirus\RescueDisk\asw9e8fc5d42178abc4.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\23040399\db_elfa.sig	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\RescueDisk\background.png	instup.exe
File created	C:\Program Files\AVG\Antivirus\defs\23040399\avg.local_vc142.crt\api-ms-win-core-heap-l1-1-0.dll	engsup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\23040399\aswCmnIS64.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\Inf\x64\avgMonFlt.sys.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\resources_av	instup.exe
File created	C:\Program Files\AVG\Antivirus\setup\part-prg_ais-17030cce.vpx	instup.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-621.exe
File created	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\aswa8fcb566d2d5b5cc.tmp	instup.exe
File created	C:\Program Files\AVG\Antivirus\aswee942225fcec9533.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\ntp_time.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\tasks_core.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\instup.dll.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\aswf5cf5aaa43118046.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\23040399\db_elfa.sig.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-util-l1-1-0.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\Licenses\dnscrypt-proxy.txt.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_codecvt_ids.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\ashBase.dll.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\wsc_proxy.exe.manifest	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\23040399\aswee7cdcd43f132f21.tmp	instup.exe
File created	C:\Program Files\AVG\Antivirus\setup\Inf\x64\asw3672499d650dcf76.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\aswb0bd82e1b176bef9.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\23040399\db_cmd.nmp.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\AvDump32.exe	instup.exe
File created	C:\Program Files\AVG\Antivirus\defs\23040399\avg.local_vc142.crt\api-ms-win-crt-heap-l1-1-0.dll	engsup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\23040399\aswabe0d3732208c657.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\Licenses\asweb4521ebab2b029a.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\23040399\db_evope.dat	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-math-l1-1-0.dll	instup.exe
File created	C:\Program Files\AVG\Antivirus\defs\23040399\asw6b3e40086cdc318e.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-synch-l1-1-0.dll.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_2.dll	instup.exe
File created	C:\Program Files\AVG\Antivirus\defs\23040399\db_js.map	engsup.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-621.exe
File opened for modification	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-console-l1-1-0.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\SetupInf.exe	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\vps_32-*.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\Sfx\instup.exe	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-localization-l1-2-0.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\API-MS-Win-core-xstate-l2-1-0.dll.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\AhResStd.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\setup\instup_x64_ais-cce.vpx	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\flash	instup.exe
File created	C:\Program Files\AVG\Antivirus\1033\avg.local_vc142.crt\aswb2355bfe95497bf0.tmp	instup.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-621.exe
File created	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\aswb9b37f146473e28e.tmp	instup.exe
File created	C:\Program Files\AVG\Antivirus\setup\Inf\x64\aswc7d6791ce248db79.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\23040399\aswFiDb.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\snxhk.dll.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\1033\avg.local_vc142.crt\asw82f5601be04331e3.tmp	instup.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-621.exe
File opened for modification	C:\Program Files\AVG\Antivirus\x86\aswd99456af804b6bfc.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\asw7ee3a44106212a61.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\23040399\db_mx4.nmp.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\nos.dll	instup.exe
File created	C:\Program Files\AVG\Antivirus\defs\23040399\avg.local_vc142.crt\vccorlib140.dll	engsup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\1033\avg.local_vc142.crt\asw74c1e3e8f0eebfd9.tmp	instup.exe
File created	C:\Program Files\AVG\Antivirus\defs\23040399\asw09f44d807da74b00.tmp	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\serialization.dll.sum	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\event_manager_rpc.dll	instup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\1033\avg.local_vc142.crt\aswb2860fe8c46d4aae.tmp	instup.exe

Drops file in Windows directory 14 IoCs

Processes:

taskmgr.exeMicrosoftEdgeCP.exeinstup.exetaskmgr.exeMicrosoftEdgeCP.exeSecHealthUI.exeSecHealthUI.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\ELAMBKUP\asw483b765a9e18d332.tmp	instup.exe
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\4272278488\3302449443.pri	SecHealthUI.exe
File created	C:\Windows\rescache\_merged\4272278488\3302449443.pri	SecHealthUI.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\ELAMBKUP\asw483b765a9e18d332.tmp	instup.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3016 3564 WerFault.exe SecHealthUI.exe
3376 3736 WerFault.exe SecHealthUI.exe

pid	pid_target	process	target process
3016	3564	WerFault.exe	SecHealthUI.exe
3376	3736	WerFault.exe	SecHealthUI.exe

Checks SCSI registry key(s) 3 TTPs 14 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

instup.exetaskmgr.exetaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

instup.exefirefox.exeSetupInf.exewsc_proxy.exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeSetupInf.exeRegSvr.exeinstup.exeRegSvr.exeavg_antivirus_free_setup_x64.exeAvEmUpdate.exeRegSvr.exeinstup.exepowershell.exefirefox.exeinstup.exeSetupInf.exeSetupInf.exeinstup.exeinstup.exeSetupInf.exeAvEmUpdate.exeinstup.exeinstup.exeinstup.exeRegSvr.exeinstup.exeinstup.exeengsup.exeSetupInf.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	avg_antivirus_free_setup_x64.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	avg_antivirus_free_setup_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	avg_antivirus_free_setup_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exeinstup.exechrome.exeinstup.exeinstup.exeinstup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosReleaseDate	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosReleaseDate	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosReleaseDate	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosReleaseDate	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

Processes:

browser_broker.exeMicrosoftEdgeCP.exeRegSvr.exeRegSvr.exeWinRAR.exeMicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80}	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80}	RegSvr.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	WinRAR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

chrome.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133251246940401823"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

Processes:

avg_antivirus_free_setup_x64.exeinstup.exeinstup.exeinstup.exeRegSvr.exeavg_antivirus_free_setup_x64.exeMicrosoftEdgeCP.exeinstup.exeMicrosoftEdge.exeRegSvr.exeinstup.exeuninstall.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\SfxInstProgress = "100"	avg_antivirus_free_setup_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\setup\\part-iex-*.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "0"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "71"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\avg.vc140.debugcrt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\Edge_Renderer.dll"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\ProgID	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage	avg_antivirus_free_setup_x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "2200"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: db_elfa.nmp"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: instup.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\Aavm4h.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "98"	instup.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\ = "Addin Class"	RegSvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "75"	instup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1553"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "46"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Main = "18"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: db_sl.nmp"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: api-ms-win-core-debug-l1-1-0.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: vxWidgets.txt"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "74"	instup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.thewindowsclub.com\ = "178"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: BCUEngine.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "20"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "35"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Main = "50"	instup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "5"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r01\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\ashTaskEx.dll"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "100"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Creating directory: C:\\ProgramData\\AVG\\Antivirus\\fw"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\RescueDisk\\uiLangRes.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\setup\\Inf\\x64\\aswTdi.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Updating package: avdump_x64_ais"	instup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "2159"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\WebRep\\IE"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\setup\\ais_cmp_grimefighter-*.vpx"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avgsoundsfile\shell\open	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Antivirus.AsOutExt\CurVer	RegSvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "26"	instup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.thewindowsclub.com\ = "518"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "83"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\setup\\setgui_ais-*.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_UpdateSetup_Syncer = "68"	instup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\thewindowsclub.com\Total = "178"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\thewindowsclub.com\Total = "1388"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\setup\\Inf\\x86\\avgbidsdriverx.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\AVG\\Antivirus\\setup\\ais_cmp_datascan-*.vpx"	instup.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: LZMA.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: unrar.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Extracting file: event_routing_rpc.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "DNS resolving"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Description = "Replacing files"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\InstupProgress_Installation_Syncer = "58"	instup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exechrome.exeavg_antivirus_free_setup_x64.exeinstup.exechrome.exeavg_antivirus_free_setup_x64.exeinstup.exeavg_antivirus_free_setup_x64.exeinstup.exetaskmgr.exe

pid	process
3840	powershell.exe
3840	powershell.exe
3840	powershell.exe
4536	chrome.exe
4536	chrome.exe
820	avg_antivirus_free_setup_x64.exe
820	avg_antivirus_free_setup_x64.exe
4684	instup.exe
4684	instup.exe
4684	instup.exe
4684	instup.exe
4684	instup.exe
4684	instup.exe
4684	instup.exe
4684	instup.exe
4492	chrome.exe
4492	chrome.exe
4684	instup.exe
4684	instup.exe
2144	avg_antivirus_free_setup_x64.exe
2144	avg_antivirus_free_setup_x64.exe
1388	instup.exe
1388	instup.exe
2716	avg_antivirus_free_setup_x64.exe
2716	avg_antivirus_free_setup_x64.exe
4312	instup.exe
4312	instup.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

Processes:

WinRAR.exetaskmgr.exetaskmgr.exemmc.exemsconfig.exe

pid process

4256 WinRAR.exe
4600 taskmgr.exe
2024 taskmgr.exe
3028 mmc.exe
1872 msconfig.exe
Suspicious behavior: LoadsDriver 13 IoCs

Processes:

pid process

656
656
656
656
656
656
656
656
656
656
656
656
656

pid	process
4256	WinRAR.exe
4600	taskmgr.exe
2024	taskmgr.exe
3028	mmc.exe
1872	msconfig.exe

pid	process
656
656
656
656
656
656
656
656
656
656
656
656
656

Suspicious behavior: MapViewOfSection 9 IoCs

Processes:

MicrosoftEdgeCP.exe

pid	process
432	MicrosoftEdgeCP.exe
432	MicrosoftEdgeCP.exe
432	MicrosoftEdgeCP.exe
432	MicrosoftEdgeCP.exe
432	MicrosoftEdgeCP.exe
432	MicrosoftEdgeCP.exe
432	MicrosoftEdgeCP.exe
432	MicrosoftEdgeCP.exe
432	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs

Processes:

chrome.exechrome.exe

pid	process
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exefirefox.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	3840	powershell.exe
Token: SeDebugPrivilege	1524	firefox.exe
Token: SeDebugPrivilege	1524	firefox.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe
Token: SeCreatePagefilePrivilege	4536	chrome.exe
Token: SeShutdownPrivilege	4536	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exechrome.exeinstup.exe

pid	process
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4684	instup.exe
4684	instup.exe
4684	instup.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exechrome.exeinstup.exeinstup.exeinstup.exetaskmgr.exe

pid	process
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4684	instup.exe
4684	instup.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
1388	instup.exe
1388	instup.exe
4312	instup.exe
4312	instup.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe
4600	taskmgr.exe

Suspicious use of SetWindowsHookEx 52 IoCs

Processes:

firefox.exeinstup.exeinstup.exewinrar-x64-621.exeavg_antivirus_free_setup.exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeinstup.exeinstup.exesbr.exeavg_antivirus_free_setup.exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeinstup.exeinstup.exesbr.exeWinRAR.exeSecHealthUI.exeSecHealthUI.exeavg_antivirus_free_setup.exeavg_antivirus_free_setup_x64.exeinstup.exeinstup.exeinstup.exeinstup.exesbr.exeMicrosoftEdge.exeMicrosoftEdgeCP.exemmc.exemmc.exemsconfig.exe

pid	process
1524	firefox.exe
648	instup.exe
4684	instup.exe
4684	instup.exe
5088	winrar-x64-621.exe
5088	winrar-x64-621.exe
2844	avg_antivirus_free_setup.exe
2144	avg_antivirus_free_setup_x64.exe
2336	instup.exe
1128	instup.exe
3548	instup.exe
3548	instup.exe
1388	instup.exe
1388	instup.exe
1388	instup.exe
1212	sbr.exe
340	avg_antivirus_free_setup.exe
2716	avg_antivirus_free_setup_x64.exe
4412	instup.exe
5112	instup.exe
4396	instup.exe
4396	instup.exe
4312	instup.exe
4312	instup.exe
4312	instup.exe
2476	sbr.exe
4256	WinRAR.exe
4256	WinRAR.exe
4256	WinRAR.exe
3564	SecHealthUI.exe
3736	SecHealthUI.exe
996	avg_antivirus_free_setup.exe
4792	avg_antivirus_free_setup_x64.exe
2164	instup.exe
2564	instup.exe
3552	instup.exe
3552	instup.exe
2196	instup.exe
2196	instup.exe
2196	instup.exe
4292	sbr.exe
740	MicrosoftEdge.exe
432	MicrosoftEdgeCP.exe
432	MicrosoftEdgeCP.exe
5108	mmc.exe
5108	mmc.exe
3028	mmc.exe
3028	mmc.exe
3028	mmc.exe
3028	mmc.exe
1872	msconfig.exe
1872	msconfig.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2680 wrote to memory of 1524	2680	firefox.exe	firefox.exe
PID 2680 wrote to memory of 1524	2680	firefox.exe	firefox.exe
PID 2680 wrote to memory of 1524	2680	firefox.exe	firefox.exe
PID 2680 wrote to memory of 1524	2680	firefox.exe	firefox.exe
PID 2680 wrote to memory of 1524	2680	firefox.exe	firefox.exe
PID 2680 wrote to memory of 1524	2680	firefox.exe	firefox.exe
PID 2680 wrote to memory of 1524	2680	firefox.exe	firefox.exe
PID 2680 wrote to memory of 1524	2680	firefox.exe	firefox.exe
PID 2680 wrote to memory of 1524	2680	firefox.exe	firefox.exe
PID 2680 wrote to memory of 1524	2680	firefox.exe	firefox.exe
PID 2680 wrote to memory of 1524	2680	firefox.exe	firefox.exe
PID 1524 wrote to memory of 4980	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 4980	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 1844	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 4564	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 4564	1524	firefox.exe	firefox.exe
PID 1524 wrote to memory of 4564	1524	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa3pxSk5sV2EzLXlNTDFoWm1fOXI5cG82bVNrZ3xBQ3Jtc0tsVXdyWXJGX1BHUjdGSXByS0VNVkxQalhBMS03VWhVdDg2bEo0ZUY1NHNsWktYNjhZMEdnSjMzb3ZQc2p0dU8yZTlDNGVHcVhYRFdEOE9ZT1Y4UGJBc2M0UmtpZVJfcmlzNVhfNEc3alR4MHdyU0Jobw&q=http%3A%2F%2Fcursoexcelvba.com.br%2Fproduto%2FInstalar-Visual-Basic-6.0-no-Windows-10-Curso-Excel%2F83%2F&v=n4GNcnvgVNM
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3840

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2680

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1524.0.1275470566\1763258254" -parentBuildID 20221007134813 -prefsHandle 1644 -prefMapHandle 1632 -prefsLen 20888 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {58fdded0-886a-4102-a4f6-4c95cfe1b0a2} 1524 "\\.\pipe\gecko-crash-server-pipe.1524" 1716 26ff0ea6e58 gpu
3⤵
PID:4980

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1524.1.222521911\1354326565" -parentBuildID 20221007134813 -prefsHandle 2060 -prefMapHandle 2056 -prefsLen 20969 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ccc451f-5a14-4dbd-906c-1bb721b5fe7f} 1524 "\\.\pipe\gecko-crash-server-pipe.1524" 2072 26fefb0e858 socket
3⤵
- Checks processor information in registry
PID:1844

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1524.2.199565660\225949452" -childID 1 -isForBrowser -prefsHandle 1488 -prefMapHandle 1504 -prefsLen 21052 -prefMapSize 232675 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e706fd9-4cff-438e-985e-bfa6f306390f} 1524 "\\.\pipe\gecko-crash-server-pipe.1524" 2744 26ff3bca858 tab
3⤵
PID:4564

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1524.3.686288083\812414635" -childID 2 -isForBrowser -prefsHandle 2104 -prefMapHandle 1052 -prefsLen 26562 -prefMapSize 232675 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {60d84ea8-a8e5-4b84-9548-cd0c8f57b2af} 1524 "\\.\pipe\gecko-crash-server-pipe.1524" 3552 26ff4a15558 tab
3⤵
PID:5040

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1524.4.1746279146\1366366518" -childID 3 -isForBrowser -prefsHandle 3848 -prefMapHandle 3832 -prefsLen 26562 -prefMapSize 232675 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {488780d7-6cba-46dc-8525-5d9639be3e60} 1524 "\\.\pipe\gecko-crash-server-pipe.1524" 3860 26ff51ecb58 tab
3⤵
PID:404

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1524.5.559694366\69751088" -childID 4 -isForBrowser -prefsHandle 4652 -prefMapHandle 4576 -prefsLen 26702 -prefMapSize 232675 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2668b9a4-74b3-4ca9-9eb4-efb2702f6148} 1524 "\\.\pipe\gecko-crash-server-pipe.1524" 4672 26ff5f24f58 tab
3⤵
PID:340

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1524.6.374078267\72400510" -childID 5 -isForBrowser -prefsHandle 4808 -prefMapHandle 4812 -prefsLen 26702 -prefMapSize 232675 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64305b74-8f4c-40c3-a95b-8d40ddb9c9fd} 1524 "\\.\pipe\gecko-crash-server-pipe.1524" 4800 26ff680b358 tab
3⤵
PID:216

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1524.7.1163077277\1713982243" -childID 6 -isForBrowser -prefsHandle 5000 -prefMapHandle 5004 -prefsLen 26702 -prefMapSize 232675 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {494d4668-196f-404b-8ea4-3965bbfe489c} 1524 "\\.\pipe\gecko-crash-server-pipe.1524" 5084 26ff680ad58 tab
3⤵
PID:208

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1524.8.662714208\1478083887" -childID 7 -isForBrowser -prefsHandle 2460 -prefMapHandle 5388 -prefsLen 26719 -prefMapSize 232675 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {79394aa7-8a4a-42c7-ab22-076f0e285754} 1524 "\\.\pipe\gecko-crash-server-pipe.1524" 5404 26ff6ce9658 tab
3⤵
PID:4116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe72a89758,0x7ffe72a89768,0x7ffe72a89778
2⤵
PID:4620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1568 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:2
2⤵
PID:228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:2052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3616 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:4436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4532 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:4100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4684 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:3752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:1396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:3036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5056 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:5044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5060 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5000 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:2600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4976 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:4056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3252 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:4100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5340 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:4496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4964 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:1844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4544 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:3988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5216 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:1304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5108 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:3656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:4724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5424 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:3752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5908 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:3132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6424 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:3028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6276 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:3372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:2964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1660 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:1020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1528 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:4980

C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe
"C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:3988

C:\Windows\Temp\asw.141605f972ba70c3\avg_antivirus_free_setup_x64.exe
"C:\Windows\Temp\asw.141605f972ba70c3\avg_antivirus_free_setup_x64.exe" /cookie:mmm_bav_012_999_a7d_m /ga_clientid:569561fd-4d20-4c2a-90db-9f8b7348ff00 /edat_dir:C:\Windows\Temp\asw.141605f972ba70c3
3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:820

C:\Windows\Temp\asw.9d46f43442a5e379\instup.exe
"C:\Windows\Temp\asw.9d46f43442a5e379\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.9d46f43442a5e379 /edition:15 /prod:ais /guid:ef9dff34-189a-4883-a7cc-2938e0c41a6c /ga_clientid:569561fd-4d20-4c2a-90db-9f8b7348ff00 /cookie:mmm_bav_012_999_a7d_m /ga_clientid:569561fd-4d20-4c2a-90db-9f8b7348ff00 /edat_dir:C:\Windows\Temp\asw.141605f972ba70c3
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:648

C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\instup.exe
"C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.9d46f43442a5e379 /edition:15 /prod:ais /guid:ef9dff34-189a-4883-a7cc-2938e0c41a6c /ga_clientid:569561fd-4d20-4c2a-90db-9f8b7348ff00 /cookie:mmm_bav_012_999_a7d_m /edat_dir:C:\Windows\Temp\asw.141605f972ba70c3 /online_installer
5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4684

C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\aswOfferTool.exe
"C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\aswOfferTool.exe" -checkGToolbar -elevated
6⤵
- Executes dropped EXE
PID:4240

C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\aswOfferTool.exe
"C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\aswOfferTool.exe" /check_secure_browser
6⤵
- Executes dropped EXE
PID:4284

C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\aswOfferTool.exe
"C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\aswOfferTool.exe" -checkChrome -elevated
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3144

C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\aswOfferTool.exe
"C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AWFC
6⤵
- Executes dropped EXE
PID:4864

C:\Users\Public\Documents\aswOfferTool.exe
"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AWFC
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084

C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\aswOfferTool.exe
"C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AWFC
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896

C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\aswOfferTool.exe
"C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\aswOfferTool.exe" -checkChrome -elevated
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572

C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\sbr.exe
"C:\Windows\Temp\asw.9d46f43442a5e379\New_17030cce\sbr.exe" 4684 "AVG Antivirus setup" "AVG Antivirus is being installed. Do not shut down your computer!"
6⤵
- Executes dropped EXE
PID:4368

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRdr2.cat
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:2436

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgHwid.cat
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:4156

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgVmm.cat
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:2304

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRvrt.cat
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:4424

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /elaminst C:\Windows\system32\drivers\avgElam.sys
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:4892

C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer /reg
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:4412

C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer1
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:1252

C:\Program Files\AVG\Antivirus\avBugReport.exe
"C:\Program Files\AVG\Antivirus\avBugReport.exe" --send "dumps|report" --silent --path "C:\ProgramData\AVG\Antivirus" --logpath "C:\ProgramData\AVG\Antivirus\log" --guid ef9dff34-189a-4883-a7cc-2938e0c41a6c
7⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:384

C:\Program Files\AVG\Antivirus\x86\RegSvr.exe
"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
PID:3772

C:\Program Files\AVG\Antivirus\RegSvr.exe
"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\aswAMSI.dll"
6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
PID:4820

C:\Program Files\AVG\Antivirus\x86\RegSvr.exe
"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\asOutExt.dll"
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
PID:2192

C:\Program Files\AVG\Antivirus\RegSvr.exe
"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\asOutExt.dll"
6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
PID:2964

C:\Program Files\AVG\Antivirus\SetupInf.exe
"C:\Program Files\AVG\Antivirus\SetupInf.exe" /catinstall:"C:\Program Files\AVG\Antivirus\setup\crts.cat" /basename:pkg_{af98c830-528a-46b9-a60e-2db5d9a76b77}.cat /crtid:E731805758E58411CF990D777C923498ABBE964B
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
PID:3896

C:\Program Files\Common Files\AVG\Overseer\overseer.exe
"C:\Program Files\Common Files\AVG\Overseer\overseer.exe" /skip_uptime /skip_remediations
6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1896

C:\Program Files\AVG\Antivirus\defs\23040399\engsup.exe
"C:\Program Files\AVG\Antivirus\defs\23040399\engsup.exe" /prepare_definitions_folder
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in Program Files directory
PID:3548

C:\Program Files\AVG\Antivirus\wsc_proxy.exe
"C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /svc /register /ppl_svc
6⤵
- Executes dropped EXE
- Windows security modification
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:4468

C:\Program Files\AVG\Antivirus\defs\23040399\engsup.exe
"C:\Program Files\AVG\Antivirus\defs\23040399\engsup.exe" /avg /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:4420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=5132 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:4160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4948 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:3992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4432 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:4804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=164 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:5052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=5664 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=5420 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:5028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=2436 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:4804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=6380 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:1636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=4964 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:4432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=4988 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:4720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=6744 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:2124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=5820 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:4996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3232 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:3252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6416 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:4872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5768 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=6368 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:3588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=5916 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:1252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=988 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:3040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3096 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:1648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4556 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:3236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4420 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:1236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5592 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:1312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6312 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:3640

C:\Users\Admin\Downloads\winrar-x64-621.exe
"C:\Users\Admin\Downloads\winrar-x64-621.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:5088

C:\Program Files\WinRAR\uninstall.exe
"C:\Program Files\WinRAR\uninstall.exe" /setup
3⤵
- Executes dropped EXE
- Modifies registry class
PID:1596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=2480 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:4160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=5928 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:1
2⤵
PID:4240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5356 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:2760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4772 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:2600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 --field-trial-handle=1668,i,9312901271862813852,10368090065489729145,131072 /prefetch:8
2⤵
PID:2480

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\VisualBasic.rar"
2⤵
- Executes dropped EXE
- Drops autorun.inf file
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4256

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4252

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x408
1⤵
PID:4260

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3036

C:\Program Files\AVG\Antivirus\wsc_proxy.exe
"C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /runassvc /rpcserver
1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
PID:624

C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe
"C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:2844

C:\Windows\Temp\asw.f4e8c1c08f0cbeec\avg_antivirus_free_setup_x64.exe
"C:\Windows\Temp\asw.f4e8c1c08f0cbeec\avg_antivirus_free_setup_x64.exe" /cookie:mmm_bav_012_999_a7d_m /ga_clientid:a9aa81a9-6fc0-4d55-bc01-557ffbf306ff /edat_dir:C:\Windows\Temp\asw.f4e8c1c08f0cbeec
2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2144

C:\Program Files\AVG\Antivirus\setup\instup.exe
"C:\Program Files\AVG\Antivirus\setup\instup.exe" /copy_sfx:C:\Windows\Temp\asw.c3e406307ab55918\instup.exe /wait
3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2336

C:\Program Files\AVG\Antivirus\setup\instup.exe
"C:\Program Files\AVG\Antivirus\setup\instup.exe" /copy_sfx:C:\Windows\Temp\asw.c3e406307ab55918\Instup.dll /wait
3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1128

C:\Program Files\AVG\Antivirus\setup\Sfx\instup.exe
"C:\Program Files\AVG\Antivirus\setup\Sfx\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.c3e406307ab55918 /edition:15 /prod:ais /ga_clientid:a9aa81a9-6fc0-4d55-bc01-557ffbf306ff /cookie:mmm_bav_012_999_a7d_m /ga_clientid:a9aa81a9-6fc0-4d55-bc01-557ffbf306ff /edat_dir:C:\Windows\Temp\asw.f4e8c1c08f0cbeec
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3548

C:\Program Files\AVG\Antivirus\setup\Sfx\New_17030cce\instup.exe
"C:\Program Files\AVG\Antivirus\setup\Sfx\New_17030cce\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.c3e406307ab55918 /edition:15 /prod:ais /ga_clientid:a9aa81a9-6fc0-4d55-bc01-557ffbf306ff /cookie:mmm_bav_012_999_a7d_m /edat_dir:C:\Windows\Temp\asw.f4e8c1c08f0cbeec /online_installer
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1388

C:\Program Files\AVG\Antivirus\setup\Sfx\New_17030cce\sbr.exe
"C:\Program Files\AVG\Antivirus\setup\Sfx\New_17030cce\sbr.exe" 1388 "AVG Antivirus setup" "AVG Antivirus is being installed. Do not shut down your computer!"
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1212

C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe
"C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:340

C:\Windows\Temp\asw.3eabbac33af5490f\avg_antivirus_free_setup_x64.exe
"C:\Windows\Temp\asw.3eabbac33af5490f\avg_antivirus_free_setup_x64.exe" /cookie:mmm_bav_012_999_a7d_m /ga_clientid:9df75aa5-8986-4b9a-9355-e8848f6018a6 /edat_dir:C:\Windows\Temp\asw.3eabbac33af5490f
2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2716

C:\Program Files\AVG\Antivirus\setup\instup.exe
"C:\Program Files\AVG\Antivirus\setup\instup.exe" /copy_sfx:C:\Windows\Temp\asw.ba8076c22ff5a850\instup.exe /wait
3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4412

C:\Program Files\AVG\Antivirus\setup\instup.exe
"C:\Program Files\AVG\Antivirus\setup\instup.exe" /copy_sfx:C:\Windows\Temp\asw.ba8076c22ff5a850\Instup.dll /wait
3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:5112

C:\Program Files\AVG\Antivirus\setup\Sfx\instup.exe
"C:\Program Files\AVG\Antivirus\setup\Sfx\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.ba8076c22ff5a850 /edition:15 /prod:ais /ga_clientid:9df75aa5-8986-4b9a-9355-e8848f6018a6 /cookie:mmm_bav_012_999_a7d_m /ga_clientid:9df75aa5-8986-4b9a-9355-e8848f6018a6 /edat_dir:C:\Windows\Temp\asw.3eabbac33af5490f
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4396

C:\Program Files\AVG\Antivirus\setup\Sfx\New_17030cce\instup.exe
"C:\Program Files\AVG\Antivirus\setup\Sfx\New_17030cce\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.ba8076c22ff5a850 /edition:15 /prod:ais /ga_clientid:9df75aa5-8986-4b9a-9355-e8848f6018a6 /cookie:mmm_bav_012_999_a7d_m /edat_dir:C:\Windows\Temp\asw.3eabbac33af5490f /online_installer
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4312

C:\Program Files\AVG\Antivirus\setup\Sfx\New_17030cce\sbr.exe
"C:\Program Files\AVG\Antivirus\setup\Sfx\New_17030cce\sbr.exe" 4312 "AVG Antivirus setup" "AVG Antivirus is being installed. Do not shut down your computer!"
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2476

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:3252

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4464

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3564

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3564 -s 1696
2⤵
- Program crash
PID:3016

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3736

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3736 -s 1680
2⤵
- Program crash
PID:3376

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:4600

C:\Users\Admin\Desktop\avg_antivirus_free_setup.exe
"C:\Users\Admin\Desktop\avg_antivirus_free_setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:996

C:\Windows\Temp\asw.4e8306ee2f1909aa\avg_antivirus_free_setup_x64.exe
"C:\Windows\Temp\asw.4e8306ee2f1909aa\avg_antivirus_free_setup_x64.exe" /cookie:mmm_bav_012_999_a7d_m /ga_clientid:4bdeb0b3-c2b0-4545-b977-3e72396dbcf9 /edat_dir:C:\Windows\Temp\asw.4e8306ee2f1909aa
2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4792

C:\Program Files\AVG\Antivirus\setup\instup.exe
"C:\Program Files\AVG\Antivirus\setup\instup.exe" /copy_sfx:C:\Windows\Temp\asw.bbb194203d7ff466\instup.exe /wait
3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:2164

C:\Program Files\AVG\Antivirus\setup\instup.exe
"C:\Program Files\AVG\Antivirus\setup\instup.exe" /copy_sfx:C:\Windows\Temp\asw.bbb194203d7ff466\Instup.dll /wait
3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2564

C:\Program Files\AVG\Antivirus\setup\Sfx\instup.exe
"C:\Program Files\AVG\Antivirus\setup\Sfx\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.bbb194203d7ff466 /edition:15 /prod:ais /ga_clientid:4bdeb0b3-c2b0-4545-b977-3e72396dbcf9 /cookie:mmm_bav_012_999_a7d_m /ga_clientid:4bdeb0b3-c2b0-4545-b977-3e72396dbcf9 /edat_dir:C:\Windows\Temp\asw.4e8306ee2f1909aa
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3552

C:\Program Files\AVG\Antivirus\setup\Sfx\New_17030cce\instup.exe
"C:\Program Files\AVG\Antivirus\setup\Sfx\New_17030cce\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.bbb194203d7ff466 /edition:15 /prod:ais /ga_clientid:4bdeb0b3-c2b0-4545-b977-3e72396dbcf9 /cookie:mmm_bav_012_999_a7d_m /edat_dir:C:\Windows\Temp\asw.4e8306ee2f1909aa /online_installer
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:2196

C:\Program Files\AVG\Antivirus\setup\Sfx\New_17030cce\sbr.exe
"C:\Program Files\AVG\Antivirus\setup\Sfx\New_17030cce\sbr.exe" 2196 "AVG Antivirus setup" "AVG Antivirus is being installed. Do not shut down your computer!"
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4292

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:2024

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "http://www.bing.com/search?q=unsecapp.exe Sink to receive asynchronous callbacks for WMI client application"
1⤵
PID:3624

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:740

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4560

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:432

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
PID:4976

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4256

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:1712

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3080

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2188

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:2716

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4532

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\WF.msc"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:5108

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\compmgmt.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3028

C:\Windows\system32\msconfig.exe
"C:\Windows\system32\msconfig.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1872

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" "C:\Windows\System32\wscui.cpl",
2⤵
PID:4224

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\wscui.cpl",
3⤵
PID:1072

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2688

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffe72a89758,0x7ffe72a89768,0x7ffe72a89778
2⤵
PID:4860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1972 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:8
2⤵
PID:4232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:2
2⤵
PID:400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:8
2⤵
PID:4464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:1560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3808 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:2452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4516 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:8
2⤵
PID:2964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4672 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:8
2⤵
PID:4244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:8
2⤵
PID:3116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:8
2⤵
PID:2968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4760 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:3784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4844 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:1868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3320 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:2448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3092 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:3832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3788 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:2024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4968 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:2396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3108 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4844 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:1884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5408 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:4160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5536 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3300 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:1400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5268 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:4380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5404 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:8
2⤵
PID:2044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5472 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:8
2⤵
PID:3832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5508 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:60

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=6040 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:1
2⤵
PID:3436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:8
2⤵
PID:4036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3316 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:8
2⤵
PID:528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5088 --field-trial-handle=1672,i,6648510516982898449,14826272781262300731,131072 /prefetch:8
2⤵
PID:1884

C:\Users\Admin\Downloads\Windows-KB890830-x64-V5.111.exe
"C:\Users\Admin\Downloads\Windows-KB890830-x64-V5.111.exe"
2⤵
PID:5100

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:244

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Security Software Discovery

T1063

Query Registry

System Information Discovery