Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
22/03/2024, 13:41
240322-qzd8jaed3s 828/12/2023, 08:18
231228-j7d46scdd9 813/12/2023, 16:39
231213-t55t8aggb9 813/11/2023, 18:53
231113-xjvznsee5s 820/10/2023, 12:54
231020-p49dssch35 818/10/2023, 12:57
231018-p6wwgsga73 814/10/2023, 13:18
231014-qkc2xsef2w 813/10/2023, 08:25
231013-kbcf5sfh5w 811/10/2023, 09:32
231011-lhkxjadh3v 811/10/2023, 09:28
231011-lfb7lsfg37 7Analysis
-
max time kernel
283s -
max time network
333s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 13:18
Static task
static1
General
-
Target
avast_secure_browser_setup.exe
-
Size
5.8MB
-
MD5
3ad1c03d333da86a47884f01b8ae7664
-
SHA1
9feb944a823a0374f6db7bfd5abf78b494e49782
-
SHA256
4b6cc676769de04acf4936a5a395349cb779616c0621c5921bf07c3e405b51ee
-
SHA512
121c6bd0150ecde57e379a62a19583c1412cd6f411ef46533a3d3241c59613905e56ae58943bc685ba7f892bbf37018ec34d3e6f6fdb36efd39220b2db60cb1f
-
SSDEEP
98304:R8PxEloFJNcSmf0UH/Z10hTSYPHnyJLhNr1/K9O6oTCA+iGGps74a4:RSvFJyBsucZ74hNxKDiG/4a
Malware Config
Signatures
-
Downloads MZ/PE file
-
Modifies Installed Components in the registry 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A8504530-742B-42BC-895D-2BAD6406F698}\StubPath = "\"C:\\Program Files (x86)\\AVAST Software\\Browser\\Application\\118.0.22807.71\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A8504530-742B-42BC-895D-2BAD6406F698}\Localized Name = "Avast Secure Browser" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A8504530-742B-42BC-895D-2BAD6406F698}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A8504530-742B-42BC-895D-2BAD6406F698}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{A8504530-742B-42BC-895D-2BAD6406F698} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A8504530-742B-42BC-895D-2BAD6406F698}\ = "Avast Secure Browser" setup.exe -
Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastBrowserUpdate.exe AvastBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastBrowserUpdate.exe\DisableExceptionChainValidation = "0" AvastBrowserUpdate.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ajD257.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ajD257.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AvastBrowser.exe -
Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation ajD257.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation AvastBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation AvastBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation AvastBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation AvastBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation avast_secure_browser_setup.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation AvastBrowserUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation AvastBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation AvastBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation AvastBrowser.exe -
Executes dropped EXE 64 IoCs
pid Process 2264 ajD257.exe 3044 AvastBrowserUpdateSetup.exe 400 AvastBrowserUpdate.exe 4704 AvastBrowserUpdate.exe 3004 AvastBrowserUpdate.exe 4596 AvastBrowserUpdateComRegisterShell64.exe 2976 AvastBrowserUpdateComRegisterShell64.exe 556 AvastBrowserUpdateComRegisterShell64.exe 3976 AvastBrowserUpdate.exe 1196 AvastBrowserUpdate.exe 2800 AvastBrowserUpdate.exe 1416 AvastBrowserInstaller.exe 888 setup.exe 2168 setup.exe 5012 AvastBrowserCrashHandler.exe 4604 AvastBrowserCrashHandler64.exe 1804 AvastBrowser.exe 1948 AvastBrowser.exe 1020 AvastBrowser.exe 832 AvastBrowser.exe 380 AvastBrowser.exe 1088 elevation_service.exe 4388 AvastBrowser.exe 3628 AvastBrowser.exe 2804 AvastBrowser.exe 456 AvastBrowser.exe 3372 AvastBrowser.exe 1084 elevation_service.exe 4948 AvastBrowser.exe 3824 AvastBrowser.exe 1016 AvastBrowser.exe 1092 chrmstp.exe 3084 chrmstp.exe 1968 chrmstp.exe 3228 chrmstp.exe 2008 AvastBrowser.exe 2996 AvastBrowser.exe 2680 AvastBrowser.exe 4172 AvastBrowser.exe 1076 elevation_service.exe 1624 AvastBrowser.exe 4400 AvastBrowser.exe 3852 AvastBrowser.exe 4648 elevation_service.exe 644 AvastBrowser.exe 3180 AvastBrowser.exe 4836 AvastBrowserUpdate.exe 4492 AvastBrowserUpdate.exe 3660 AvastBrowser.exe 4060 AvastBrowser.exe 1884 AvastBrowserUpdate.exe 3456 AvastBrowserCrashHandler.exe 1548 AvastBrowserCrashHandler64.exe 3448 AvastBrowser.exe 4944 AvastBrowser.exe 404 AvastBrowserUpdate.exe 5084 AvastBrowser.exe 3512 AvastBrowser.exe 4876 AvastBrowser.exe 3952 AvastBrowser.exe 1248 AvastBrowser.exe 4760 AvastBrowser.exe 928 AvastBrowser.exe 5468 AvastBrowser.exe -
Loads dropped DLL 64 IoCs
pid Process 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2264 ajD257.exe 2264 ajD257.exe 2264 ajD257.exe 2264 ajD257.exe 2264 ajD257.exe 2264 ajD257.exe 2264 ajD257.exe 2264 ajD257.exe 400 AvastBrowserUpdate.exe 4704 AvastBrowserUpdate.exe 3004 AvastBrowserUpdate.exe 4596 AvastBrowserUpdateComRegisterShell64.exe 3004 AvastBrowserUpdate.exe 2976 AvastBrowserUpdateComRegisterShell64.exe 3004 AvastBrowserUpdate.exe 556 AvastBrowserUpdateComRegisterShell64.exe 3004 AvastBrowserUpdate.exe 400 AvastBrowserUpdate.exe 400 AvastBrowserUpdate.exe 3976 AvastBrowserUpdate.exe 1196 AvastBrowserUpdate.exe 2800 AvastBrowserUpdate.exe 2800 AvastBrowserUpdate.exe 1196 AvastBrowserUpdate.exe 2800 AvastBrowserUpdate.exe 2264 ajD257.exe 1804 AvastBrowser.exe 1948 AvastBrowser.exe 1804 AvastBrowser.exe 1804 AvastBrowser.exe 1020 AvastBrowser.exe 1020 AvastBrowser.exe 1020 AvastBrowser.exe 1020 AvastBrowser.exe 1020 AvastBrowser.exe 1020 AvastBrowser.exe 832 AvastBrowser.exe 380 AvastBrowser.exe 1020 AvastBrowser.exe 380 AvastBrowser.exe 380 AvastBrowser.exe 832 AvastBrowser.exe 832 AvastBrowser.exe 4388 AvastBrowser.exe 3628 AvastBrowser.exe 2804 AvastBrowser.exe 3628 AvastBrowser.exe 3628 AvastBrowser.exe 2804 AvastBrowser.exe 4388 AvastBrowser.exe 2804 AvastBrowser.exe 4388 AvastBrowser.exe 456 AvastBrowser.exe 456 AvastBrowser.exe 456 AvastBrowser.exe 3372 AvastBrowser.exe 3372 AvastBrowser.exe 3372 AvastBrowser.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 23 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99F8769E-4FE9-3A40-9D6D-5424B8AC9F57}\InprocServer32 AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}\InProcServer32\ThreadingModel = "Both" AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}\InProcServer32 AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99F8769E-4FE9-3A40-9D6D-5424B8AC9F57}\InprocServer32\ = "C:\\Program Files (x86)\\AVAST Software\\Browser\\Update\\1.8.1631.4\\psmachine_64.dll" AvastBrowserUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99F8769E-4FE9-3A40-9D6D-5424B8AC9F57}\InprocServer32 AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99F8769E-4FE9-3A40-9D6D-5424B8AC9F57}\InprocServer32 AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CEA41856-DAAB-4EE7-9731-0DB1BCD5E0F4}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\AVAST Software\\Browser\\Application\\118.0.22807.71\\notification_helper.exe" setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99F8769E-4FE9-3A40-9D6D-5424B8AC9F57}\InprocServer32 AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{CEA41856-DAAB-4EE7-9731-0DB1BCD5E0F4}\LocalServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99F8769E-4FE9-3A40-9D6D-5424B8AC9F57}\InprocServer32\ = "C:\\Program Files (x86)\\AVAST Software\\Browser\\Update\\1.8.1631.4\\psmachine_64.dll" AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99F8769E-4FE9-3A40-9D6D-5424B8AC9F57}\InprocServer32 AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99F8769E-4FE9-3A40-9D6D-5424B8AC9F57}\InprocServer32\ThreadingModel = "Both" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}\InProcServer32\ = "C:\\Program Files (x86)\\AVAST Software\\Browser\\Update\\1.8.1631.4\\psmachine_64.dll" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}\InProcServer32\ThreadingModel = "Both" AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}\InProcServer32 AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}\InProcServer32\ = "C:\\Program Files (x86)\\AVAST Software\\Browser\\Update\\1.8.1631.4\\psmachine_64.dll" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}\InProcServer32\ThreadingModel = "Both" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99F8769E-4FE9-3A40-9D6D-5424B8AC9F57}\InprocServer32\ThreadingModel = "Both" AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}\InProcServer32 AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}\InProcServer32\ = "C:\\Program Files (x86)\\AVAST Software\\Browser\\Update\\1.8.1631.4\\psmachine_64.dll" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99F8769E-4FE9-3A40-9D6D-5424B8AC9F57}\InprocServer32\ = "C:\\Program Files (x86)\\AVAST Software\\Browser\\Update\\1.8.1631.4\\psmachine_64.dll" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99F8769E-4FE9-3A40-9D6D-5424B8AC9F57}\InprocServer32\ThreadingModel = "Both" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CEA41856-DAAB-4EE7-9731-0DB1BCD5E0F4}\LocalServer32\ = "\"C:\\Program Files (x86)\\AVAST Software\\Browser\\Application\\118.0.22807.71\\notification_helper.exe\"" setup.exe -
Checks for any installed AV software in registry 1 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast AvastBrowser.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast AvastBrowser.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast avast_secure_browser_setup.exe Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\AVAST Software\Avast avast_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast ajD257.exe Key opened \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\AVAST Software\Avast ajD257.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast ajD257.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast AvastBrowser.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ajD257.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 6 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 ajD257.exe File opened for modification \??\PhysicalDrive0 AvastBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 AvastBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 AvastBrowser.exe File opened for modification \??\PhysicalDrive0 AvastBrowser.exe File opened for modification \??\PhysicalDrive0 AvastBrowserUpdate.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GUMA8ED.tmp\goopdateres_es-419.dll AvastBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUMA8ED.tmp\goopdateres_pt-PT.dll AvastBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\AvastBrowserUpdateCore.exe AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\goopdateres_fil.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\psmachine.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\GUMA8ED.tmp\goopdateres_en-GB.dll AvastBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUMA8ED.tmp\goopdateres_ja.dll AvastBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\goopdate.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\goopdateres_ca.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\goopdateres_da.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\goopdateres_vi.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\Locales\nl.pak setup.exe File created C:\Program Files (x86)\GUMA8ED.tmp\goopdateres_hr.dll AvastBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUMA8ED.tmp\goopdateres_hi.dll AvastBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUMA8ED.tmp\goopdateres_sw.dll AvastBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\goopdateres_sk.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\psuser.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\Locales\fa.pak setup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\Locales\zh-CN.pak setup.exe File opened for modification C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe setup.exe File created C:\Program Files (x86)\GUMA8ED.tmp\npAvastBrowserUpdate3.dll AvastBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUMA8ED.tmp\goopdateres_sl.dll AvastBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\goopdateres_te.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\Locales\en-US.pak setup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\Locales\es-419.pak setup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\Locales\ta.pak setup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\MEIPreload\preloaded_data.pb setup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\AvastBrowserUninstall.exe setup.exe File created C:\Program Files (x86)\GUMA8ED.tmp\goopdateres_el.dll AvastBrowserUpdateSetup.exe File opened for modification C:\Program Files\Crashpad\metadata chrmstp.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\goopdateres_sv.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\Installer\setup.exe setup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\goopdateres_fr.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\goopdateres_iw.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\goopdateres_sr.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\npAvastBrowserUpdate3.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\Locales\af.pak setup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\mojo_core.dll setup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowserProtect.exe setup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Application\SetupMetrics\d76fe119-2aaf-440b-8913-47d332810974.tmp chrmstp.exe File created C:\Program Files (x86)\GUMA8ED.tmp\AvastBrowserUpdate.exe AvastBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUMA8ED.tmp\goopdateres_zh-TW.dll AvastBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\goopdateres_es.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\goopdateres_ms.dll AvastBrowserUpdate.exe File opened for modification C:\Program Files\Crashpad\settings.dat setup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\vulkan-1.dll setup.exe File created C:\Program Files (x86)\GUMA8ED.tmp\goopdateres_en.dll AvastBrowserUpdateSetup.exe File opened for modification C:\Program Files (x86)\AVAST Software\Browser\Application\SetupMetrics\20230915073457.pma chrmstp.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\acuapi.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\Locales\sl.pak setup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Application\SetupMetrics\b5c2a2e1-7451-42f7-a213-338f106231b2.tmp setup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\Extensions\external_extensions.json setup.exe File created C:\Program Files (x86)\GUMA8ED.tmp\goopdateres_ar.dll AvastBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUMA8ED.tmp\goopdateres_pt-BR.dll AvastBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\goopdateres_ml.dll AvastBrowserUpdate.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\Locales\pt-BR.pak setup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Application\SetupMetrics\20230915073457.pma~RFe5a8483.TMP chrmstp.exe File created C:\Program Files (x86)\GUMA8ED.tmp\AvastBrowserUpdateComRegisterShell64.exe AvastBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\Locales\fi.pak setup.exe File created C:\Program Files (x86)\GUMA8ED.tmp\AvastBrowserUpdateBroker.exe AvastBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\Locales\it.pak setup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\Locales\ja.pak setup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Temp\source888_977726965\Safer-bin\118.0.22807.71\Locales\pl.pak setup.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5aa2f8.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{19C3AB22-3718-4E4D-B203-242F5001565B} msiexec.exe File opened for modification C:\Windows\Installer\MSIA53A.tmp msiexec.exe File created C:\Windows\Installer\e5aa2fc.msi msiexec.exe File created C:\Windows\Installer\e5aa2f8.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 11 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ajD257.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ajD257.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AvastBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AvastBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AvastBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AvastBrowser.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4424021B-831C-4F50-A74F-1AF30ADA650C}\AppName = "AvastBrowserUpdateWebPlugin.exe" AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4424021B-831C-4F50-A74F-1AF30ADA650C}\AppPath = "C:\\Program Files (x86)\\AVAST Software\\Browser\\Update\\1.8.1631.4" AvastBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4424021B-831C-4F50-A74F-1AF30ADA650C}\Policy = "3" AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62593C70-ACF0-44CC-8716-990919D46A85} AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62593C70-ACF0-44CC-8716-990919D46A85}\AppName = "AvastBrowserUpdateBroker.exe" AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62593C70-ACF0-44CC-8716-990919D46A85}\AppPath = "C:\\Program Files (x86)\\AVAST Software\\Browser\\Update\\1.8.1631.4" AvastBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62593C70-ACF0-44CC-8716-990919D46A85}\Policy = "3" AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4424021B-831C-4F50-A74F-1AF30ADA650C} AvastBrowserUpdate.exe -
Modifies data under HKEY_USERS 29 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" AvastBrowserUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 2d5d4d5ca01edd492728e9afa25a6998253cc759bf8335f77c32648536cd1de7 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E AvastBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" AvastBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" AvastBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 0812000089aeb393a1fed901 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser\Update\ AvastBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser AvastBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser\Update\hostprefix = "beta-" AvastBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser\Update\MachineId = "000058d4b27a012b9e3e4541471e6c69" AvastBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" AvastBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser\Update AvastBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser\Update\endpoint = "update.avastbrowser.com" AvastBrowserUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVAST Software AvastBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser\Update\devmode = "0" AvastBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" AvastBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" AvastBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser\Update\MachineIdDate = "20230915" AvastBrowserUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry AvastBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software AvastBrowserUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D1FB6CD-9205-365A-907A-8AB76BC52400}\ProgID\ = "AvastUpdate.Update3COMClassService.1.0" AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C32E10AE-6600-4A1E-8BEA-EF89A3072F93}\ProxyStubClsid32 AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\NumMethods\ = "9" AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191}\ProxyStubClsid32\ = "{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E3A7FED-773C-3232-B213-43DD2C627B4C}\LocalizedString = "@C:\\Program Files (x86)\\AVAST Software\\Browser\\Update\\1.8.1631.4\\goopdate.dll,-3000" AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AB71627-A1C4-35E8-975E-327931339608}\AppID = "{5AB71627-A1C4-35E8-975E-327931339608}" AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D2A777F-793D-3683-8D01-62DB24DAC371}\ProgID\ = "AvastUpdate.Update3WebSvc.1.0" AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D37D106C-CDD2-4821-BC7A-F08990DDCA74}\ProxyStubClsid32 AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7B73E65-20BA-407F-8A89-DF649EF82559}\ProxyStubClsid32 AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191}\NumMethods\ = "8" AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E3A7FED-773C-3232-B213-43DD2C627B4C}\VersionIndependentProgID AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB785069-B832-4423-B813-47F7422BA6E5}\ = "ICoCreateAsync" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C32E10AE-6600-4A1E-8BEA-EF89A3072F93}\NumMethods\ = "17" AvastBrowserUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\22BA3C918173D4E42B3042F2051065B5\Version = "17303135" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6D1FB6CD-9205-365A-907A-8AB76BC52400} AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastUpdate.CoCreateAsync\CurVer\ = "AvastUpdate.CoCreateAsync.1.0" AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AvastUpdate.CoCreateAsync.1.0 AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{925547A3-663F-4673-A7B7-3FCACCDC4879}\NumMethods AvastBrowserUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AvastBrowserUpdate.exe AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D37D106C-CDD2-4821-BC7A-F08990DDCA74} AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45F7CBA5-258D-4852-AD0A-B18F3FB214F4}\ProxyStubClsid32\ = "{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}" AvastBrowserUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99F8769E-4FE9-3A40-9D6D-5424B8AC9F57}\InprocServer32 AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{079CAB07-5001-4E71-9D5A-B412842E5178}\ProxyStubClsid32\ = "{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastUpdate.ProcessLauncher\CurVer\ = "AvastUpdate.ProcessLauncher.1.0" AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AvastUpdate.CoreMachineClass\CLSID AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62593C70-ACF0-44CC-8716-990919D46A85}\Implemented Categories AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB785069-B832-4423-B813-47F7422BA6E5}\ProxyStubClsid32 AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ACFD3680-431F-4780-AACB-75739A1CD788}\InprocHandler32\ThreadingModel = "Both" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E21E991-301D-47FD-AB7A-99FBE864EF65}\ProxyStubClsid32\ = "{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}" AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2033652-2F07-34CC-9416-76BC5C9AD5F7}\LocalServer32 AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A} AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45F7CBA5-258D-4852-AD0A-B18F3FB214F4}\NumMethods\ = "4" AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E21E991-301D-47FD-AB7A-99FBE864EF65} AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{079CAB07-5001-4E71-9D5A-B412842E5178}\NumMethods\ = "41" AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6399AFB-987A-3571-BBAD-C388F0879754} AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-vnd.beta-update.avastbrowser.com.update3webcontrol.3 AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\AppID setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AvastQH\DefaultIcon setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{079CAB07-5001-4E71-9D5A-B412842E5178}\NumMethods AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C7E81D6-0463-485E-8DF5-2ADAD81FAF40}\NumMethods AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}\ = "PSFactoryBuffer" AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7EECC1B-3003-303A-B4DA-8E8F5A85F13C}\VersionIndependentProgID AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CEBE594-0680-4815-86E1-615A6BE65E0E}\NumMethods AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D37D106C-CDD2-4821-BC7A-F08990DDCA74}\NumMethods AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AvastUpdate.ProcessLauncher.1.0 AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C50E3A4-12A8-41FB-9941-E8EEB222E07E}\ProxyStubClsid32\ = "{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}" AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A708F91-06A3-409E-83BC-4A5CF10C8025}\NumMethods AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\ = "IProgressWndEvents" AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270}\ProxyStubClsid32\ = "{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}" AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{079CAB07-5001-4E71-9D5A-B412842E5178}\ProxyStubClsid32 AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastQH\Capabilities\ApplicationName = "Avast Secure Browser Helper" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DD8E03F-6BE1-41E2-B931-A37C7D1C0317}\NumMethods AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C7E81D6-0463-485E-8DF5-2ADAD81FAF40}\ProxyStubClsid32\ = "{3A6CE939-10CE-42FC-BDEF-A77E6DEB610F}" AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D37D106C-CDD2-4821-BC7A-F08990DDCA74}\NumMethods AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{079CAB07-5001-4E71-9D5A-B412842E5178}\NumMethods\ = "41" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{804EC8ED-BF49-41ED-BCD0-CA1D716D3E98}\NumMethods\ = "10" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}\ = "IAppVersion" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E21E991-301D-47FD-AB7A-99FBE864EF65}\NumMethods\ = "41" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E21E991-301D-47FD-AB7A-99FBE864EF65}\NumMethods\ = "41" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8159E37-5EDF-4E6D-8E6D-E558E8DDC2A0}\NumMethods\ = "5" AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E3A7FED-773C-3232-B213-43DD2C627B4C} AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{079CAB07-5001-4E71-9D5A-B412842E5178} AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC} AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C32E10AE-6600-4A1E-8BEA-EF89A3072F93}\NumMethods AvastBrowserUpdateComRegisterShell64.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ajD257.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 ajD257.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ajD257.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe 2344 avast_secure_browser_setup.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1804 AvastBrowser.exe 1804 AvastBrowser.exe 1804 AvastBrowser.exe 2680 AvastBrowser.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 400 AvastBrowserUpdate.exe Token: SeDebugPrivilege 400 AvastBrowserUpdate.exe Token: SeDebugPrivilege 400 AvastBrowserUpdate.exe Token: 33 1416 AvastBrowserInstaller.exe Token: SeIncBasePriorityPrivilege 1416 AvastBrowserInstaller.exe Token: SeDebugPrivilege 400 AvastBrowserUpdate.exe Token: SeIncreaseQuotaPrivilege 2264 ajD257.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe Token: SeCreatePagefilePrivilege 1804 AvastBrowser.exe Token: SeShutdownPrivilege 1804 AvastBrowser.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2008 AvastBrowser.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2344 avast_secure_browser_setup.exe 2264 ajD257.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2264 2344 avast_secure_browser_setup.exe 93 PID 2344 wrote to memory of 2264 2344 avast_secure_browser_setup.exe 93 PID 2344 wrote to memory of 2264 2344 avast_secure_browser_setup.exe 93 PID 2264 wrote to memory of 3044 2264 ajD257.exe 100 PID 2264 wrote to memory of 3044 2264 ajD257.exe 100 PID 2264 wrote to memory of 3044 2264 ajD257.exe 100 PID 3044 wrote to memory of 400 3044 AvastBrowserUpdateSetup.exe 101 PID 3044 wrote to memory of 400 3044 AvastBrowserUpdateSetup.exe 101 PID 3044 wrote to memory of 400 3044 AvastBrowserUpdateSetup.exe 101 PID 400 wrote to memory of 4704 400 AvastBrowserUpdate.exe 102 PID 400 wrote to memory of 4704 400 AvastBrowserUpdate.exe 102 PID 400 wrote to memory of 4704 400 AvastBrowserUpdate.exe 102 PID 400 wrote to memory of 3004 400 AvastBrowserUpdate.exe 103 PID 400 wrote to memory of 3004 400 AvastBrowserUpdate.exe 103 PID 400 wrote to memory of 3004 400 AvastBrowserUpdate.exe 103 PID 3004 wrote to memory of 4596 3004 AvastBrowserUpdate.exe 104 PID 3004 wrote to memory of 4596 3004 AvastBrowserUpdate.exe 104 PID 3004 wrote to memory of 2976 3004 AvastBrowserUpdate.exe 105 PID 3004 wrote to memory of 2976 3004 AvastBrowserUpdate.exe 105 PID 3004 wrote to memory of 556 3004 AvastBrowserUpdate.exe 106 PID 3004 wrote to memory of 556 3004 AvastBrowserUpdate.exe 106 PID 400 wrote to memory of 3976 400 AvastBrowserUpdate.exe 107 PID 400 wrote to memory of 3976 400 AvastBrowserUpdate.exe 107 PID 400 wrote to memory of 3976 400 AvastBrowserUpdate.exe 107 PID 400 wrote to memory of 1196 400 AvastBrowserUpdate.exe 108 PID 400 wrote to memory of 1196 400 AvastBrowserUpdate.exe 108 PID 400 wrote to memory of 1196 400 AvastBrowserUpdate.exe 108 PID 2800 wrote to memory of 1416 2800 AvastBrowserUpdate.exe 110 PID 2800 wrote to memory of 1416 2800 AvastBrowserUpdate.exe 110 PID 1416 wrote to memory of 888 1416 AvastBrowserInstaller.exe 111 PID 1416 wrote to memory of 888 1416 AvastBrowserInstaller.exe 111 PID 888 wrote to memory of 2168 888 setup.exe 112 PID 888 wrote to memory of 2168 888 setup.exe 112 PID 2800 wrote to memory of 5012 2800 AvastBrowserUpdate.exe 114 PID 2800 wrote to memory of 5012 2800 AvastBrowserUpdate.exe 114 PID 2800 wrote to memory of 5012 2800 AvastBrowserUpdate.exe 114 PID 2800 wrote to memory of 4604 2800 AvastBrowserUpdate.exe 115 PID 2800 wrote to memory of 4604 2800 AvastBrowserUpdate.exe 115 PID 1804 wrote to memory of 1948 1804 AvastBrowser.exe 118 PID 1804 wrote to memory of 1948 1804 AvastBrowser.exe 118 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 PID 1804 wrote to memory of 1020 1804 AvastBrowser.exe 119 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\avast_secure_browser_setup.exe"C:\Users\Admin\AppData\Local\Temp\avast_secure_browser_setup.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\ajD257.exe"C:\Users\Admin\AppData\Local\Temp\ajD257.exe" /relaunch=8 /was_elevated=1 /tagdata2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\nscD7D4.tmp\AvastBrowserUpdateSetup.exeAvastBrowserUpdateSetup.exe /silent /install "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en-US&brand=9998&installargs=--no-create-user-shortcuts --host-prefix%3Dbeta- --reset-default-win10 --auto-import-data%3Dsafezone --private-browsing&hostprefix=beta-"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Program Files (x86)\GUMA8ED.tmp\AvastBrowserUpdate.exe"C:\Program Files (x86)\GUMA8ED.tmp\AvastBrowserUpdate.exe" /silent /install "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en-US&brand=9998&installargs=--no-create-user-shortcuts --host-prefix%3Dbeta- --reset-default-win10 --auto-import-data%3Dsafezone --private-browsing&hostprefix=beta-"4⤵
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4704
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\AvastBrowserUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4596
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\AvastBrowserUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2976
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\AvastBrowserUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:556
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezZEMzdDNzYwLThGRUQtNDhBNS1BNEE0LUNFQzA5NUIyRDhERH0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTYzMS40IiBzaGVsbF92ZXJzaW9uPSIxLjguMTYzMS40IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0ie0QzRDM2RTA5LTIzMDItNEIxRC1CMjkwLUUyQjg5MzMzNEE4Nn0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9Ins3RTIxMjA2RS1GN0NGLTQxRkMtQTQ3NS1BOUUxMUMyMDg5MDZ9IiB1c2VyaWRfZGF0ZT0iMjAyMzEwMTQiIG1hY2hpbmVpZD0iezAwMDA1OEQ0LUIyN0EtMDEyQi05RTNFLTQ1NDE0NzFFNkM2OX0iIG1hY2hpbmVpZF9kYXRlPSIyMDIzMTAxNCIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9IntDNzE4M0M2NS05OTg2LTQ0QzQtOEVERC1DOUJDQTIxOThGRTR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezZEMzdDNzYwLThGRUQtNDhBNS1BNEE0LUNFQzA5NUIyRDhERH0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjMxLjQiIGxhbmc9ImVuLVVTIiBicmFuZD0iOTk5OCIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTQ4NCIvPjwvYXBwPjwvcmVxdWVzdD45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3976
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /handoff "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en-US&brand=9998&installargs=--no-create-user-shortcuts --host-prefix%3Dbeta- --reset-default-win10 --auto-import-data%3Dsafezone --private-browsing&hostprefix=beta-" /installsource otherinstallcmd /sessionid "{D3D36E09-2302-4B1D-B290-E2B893334A86}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196
-
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exeAvastBrowser.exe --heartbeat --install --create-profile3⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=118.0.22807.71 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffaa3fc6870,0x7ffaa3fc6880,0x7ffaa3fc68904⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1944 --field-trial-handle=1956,i,10760902683495150884,7856385706117582920,262144 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1956,i,10760902683495150884,7856385706117582920,262144 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2416 --field-trial-handle=1956,i,10760902683495150884,7856385706117582920,262144 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --disable-nacl --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3004 --field-trial-handle=1956,i,10760902683495150884,7856385706117582920,262144 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4388
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --disable-nacl --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3200 --field-trial-handle=1956,i,10760902683495150884,7856385706117582920,262144 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:3628
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --disable-nacl --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3332 --field-trial-handle=1956,i,10760902683495150884,7856385706117582920,262144 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:2804
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4116 --field-trial-handle=1956,i,10760902683495150884,7856385706117582920,262144 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:456
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4120 --field-trial-handle=1956,i,10760902683495150884,7856385706117582920,262144 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3372
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 --field-trial-handle=1956,i,10760902683495150884,7856385706117582920,262144 /prefetch:84⤵
- Executes dropped EXE
PID:3824
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --disable-protect4⤵
- Executes dropped EXE
PID:4948
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\Installer\chrmstp.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1092 -
C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\Installer\chrmstp.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=118.0.22807.71 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff6cf1c39d0,0x7ff6cf1c39e0,0x7ff6cf1c39f05⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3084
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\Installer\chrmstp.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\AVAST Software\Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=05⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1968 -
C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\Installer\chrmstp.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=118.0.22807.71 --initial-client-data=0x270,0x274,0x278,0x26c,0x27c,0x7ff6cf1c39d0,0x7ff6cf1c39e0,0x7ff6cf1c39f06⤵
- Executes dropped EXE
PID:3228
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=shortcut-pin-helper /prefetch:8 taskbarpin "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:2008
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk"6⤵
- Checks computer location settings
- Executes dropped EXE
PID:2996
-
-
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exeAvastBrowser.exe --silent-launch3⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:2680 -
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=118.0.22807.71 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaa3fc6870,0x7ffaa3fc6880,0x7ffaa3fc68904⤵
- Executes dropped EXE
PID:4172
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2236 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:24⤵
- Executes dropped EXE
PID:1624
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2564 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵
- Executes dropped EXE
PID:3852
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵
- Executes dropped EXE
PID:4400
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3544 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵
- Executes dropped EXE
PID:644
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=728 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵
- Executes dropped EXE
PID:5084
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2744 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵
- Executes dropped EXE
PID:3512
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3632 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵
- Executes dropped EXE
PID:4876
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3552 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵
- Executes dropped EXE
PID:3952
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=724 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵
- Executes dropped EXE
PID:1248 -
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=118.0.22807.71 --initial-client-data=0xf8,0xfc,0x100,0x74,0x104,0x7ffaa3fc6870,0x7ffaa3fc6880,0x7ffaa3fc68905⤵PID:1660
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3536 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵
- Executes dropped EXE
PID:4760
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3572 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵
- Executes dropped EXE
PID:928
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3544 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵
- Executes dropped EXE
PID:5468
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3752 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:5600
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3588 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:5620
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3884 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:5692
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4144 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:5728
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4296 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:5820
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4008 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:5932
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3928 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:6000
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4280 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:6072
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3640 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:5220
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4024 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:5240
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3712 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:5084
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4580 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:5168
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4640 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:5496
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4804 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:5552
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --disable-nacl --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=4596 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:14⤵PID:2804
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3936 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:4932
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4476 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:6028
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5008 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:3952
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --disable-nacl --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=4204 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:14⤵PID:3232
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --disable-nacl --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=3920 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:14⤵PID:5960
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3664 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:5520
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4132 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:84⤵PID:5128
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --disable-nacl --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=5260 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:14⤵PID:1072
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --disable-nacl --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=5100 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:14⤵PID:5760
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --disable-nacl --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=4572 --field-trial-handle=2240,i,3335132576453716933,1353138141455637654,262144 /prefetch:14⤵PID:5084
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\Installer\setup.exesetup.exe /silent --create-shortcuts=0 --install-level=1 --system-level3⤵PID:5436
-
C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\Installer\setup.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=118.0.22807.71 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff73e8539d0,0x7ff73e8539e0,0x7ff73e8539f04⤵PID:5728
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=shortcut-pin-helper /prefetch:8 taskbarpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk"4⤵PID:4460
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk"4⤵PID:5956
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exeAvastBrowser.exe --check-run=src=installer3⤵PID:1248
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1980 --field-trial-handle=1212,i,6820009082262952046,13445517733455638394,262144 /prefetch:24⤵PID:4600
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2564 --field-trial-handle=1212,i,6820009082262952046,13445517733455638394,262144 /prefetch:84⤵PID:1400
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1212,i,6820009082262952046,13445517733455638394,262144 /prefetch:84⤵PID:4732
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --disable-nacl --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3100 --field-trial-handle=1212,i,6820009082262952046,13445517733455638394,262144 /prefetch:14⤵PID:3892
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --disable-nacl --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3412 --field-trial-handle=1212,i,6820009082262952046,13445517733455638394,262144 /prefetch:14⤵PID:6052
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --disable-nacl --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3160 --field-trial-handle=1212,i,6820009082262952046,13445517733455638394,262144 /prefetch:14⤵PID:928
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --disable-nacl --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4480 --field-trial-handle=1212,i,6820009082262952046,13445517733455638394,262144 /prefetch:14⤵PID:4052
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --disable-nacl --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4852 --field-trial-handle=1212,i,6820009082262952046,13445517733455638394,262144 /prefetch:14⤵PID:5028
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --disable-nacl --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4800 --field-trial-handle=1212,i,6820009082262952046,13445517733455638394,262144 /prefetch:14⤵PID:3704
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --disable-nacl --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4976 --field-trial-handle=1212,i,6820009082262952046,13445517733455638394,262144 /prefetch:14⤵PID:5792
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3504 --field-trial-handle=1212,i,6820009082262952046,13445517733455638394,262144 /prefetch:84⤵PID:404
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Admin\Desktop\Avast Secure Browser.lnk"4⤵PID:4652
-
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{2F159E77-4CD5-4DCB-8BC2-F0D5CCAEA104}\AvastBrowserInstaller.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{2F159E77-4CD5-4DCB-8BC2-F0D5CCAEA104}\AvastBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --host-prefix=beta- --show-developer-mode --suppress-first-run-bubbles --adblock-mode-default=2 --default-search-id=3 --default-search=bing.com --no-create-user-shortcuts --host-prefix=beta- --reset-default-win10 --auto-import-data=safezone --private-browsing --system-level2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{2F159E77-4CD5-4DCB-8BC2-F0D5CCAEA104}\CR_45FCF.tmp\setup.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{2F159E77-4CD5-4DCB-8BC2-F0D5CCAEA104}\CR_45FCF.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{2F159E77-4CD5-4DCB-8BC2-F0D5CCAEA104}\CR_45FCF.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --host-prefix=beta- --show-developer-mode --suppress-first-run-bubbles --adblock-mode-default=2 --default-search-id=3 --default-search=bing.com --no-create-user-shortcuts --host-prefix=beta- --reset-default-win10 --auto-import-data=safezone --private-browsing --system-level3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{2F159E77-4CD5-4DCB-8BC2-F0D5CCAEA104}\CR_45FCF.tmp\setup.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{2F159E77-4CD5-4DCB-8BC2-F0D5CCAEA104}\CR_45FCF.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=118.0.22807.71 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff75ee439d0,0x7ff75ee439e0,0x7ff75ee439f04⤵
- Executes dropped EXE
PID:2168
-
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\AvastBrowserCrashHandler.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\AvastBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
PID:5012
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\AvastBrowserCrashHandler64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\AvastBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
PID:4604
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\elevation_service.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1088
-
C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\elevation_service.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1084
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=118.0.22807.71 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaa3fc6870,0x7ffaa3fc6880,0x7ffaa3fc68901⤵
- Executes dropped EXE
PID:1016
-
C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\elevation_service.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1076
-
C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\elevation_service.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4648
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=heartbeat --hourly1⤵
- Executes dropped EXE
PID:3180 -
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --heartbeat --hourly2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:3660 -
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=118.0.22807.71 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ffaa3fc6870,0x7ffaa3fc6880,0x7ffaa3fc68903⤵
- Executes dropped EXE
PID:4060
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1964 --field-trial-handle=1968,i,4269308791283885175,8366222934635185201,262144 /prefetch:23⤵
- Executes dropped EXE
PID:3448
-
-
C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=936 --field-trial-handle=1968,i,4269308791283885175,8366222934635185201,262144 /prefetch:83⤵
- Executes dropped EXE
PID:4944
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /c1⤵
- Executes dropped EXE
PID:4492 -
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /cr2⤵
- Executes dropped EXE
PID:1884
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\AvastBrowserCrashHandler.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\AvastBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
PID:3456
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\AvastBrowserCrashHandler64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1631.4\AvastBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
PID:1548
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
PID:4836 -
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /registermsihelper2⤵
- Executes dropped EXE
PID:404
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4616
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /svc1⤵
- Writes to the Master Boot Record (MBR)
- Modifies data under HKEY_USERS
PID:3772
-
C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\elevation_service.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\elevation_service.exe"1⤵PID:4760
-
C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\elevation_service.exe"C:\Program Files (x86)\AVAST Software\Browser\Application\118.0.22807.71\elevation_service.exe"1⤵PID:6040
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Defense Evasion
Modify Registry
4Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5ad0e254cde5a20b6014f10311eeb872f
SHA1a6139ad38ebb9cea3f8d24d73632af695f27bf59
SHA256a06c95f49b012bab5c2b2359b22456619ab1520f527592f2ef90ffc720628b26
SHA512137c6db4c97967e6ffa4f3d78392e21e666140567977f2dab455dbd28a17353930679fbbca491c7854523878aea64a7135452fa9243bbfce04777c706043bb46
-
Filesize
3.7MB
MD5bba4aa35278fe608b879538bb8c155e0
SHA155ccb00b71355958425a828d63e1dac7ef191543
SHA25623781774568a0c4ce268f434f7cd815aeb8b3167b60a179fee803eb685c52624
SHA5127dcf14f3f40905f5fd3ccc049cc2c8173b17782ff8a66a0650cab9fa8c10c12f77df2597f2c96a5e850f24581f86465272c3ee59d345fa69e2da888a86a90ab7
-
C:\Program Files (x86)\AVAST Software\Browser\Application\SetupMetrics\553c5263-891e-4da3-89ae-d1653e57bc3c.tmp
Filesize488B
MD575559bc98a8dd0d2265e376aa0779d9c
SHA16f5bc3b03c489df1c1e5a521820cc952501dd629
SHA2569a3806ffda783797cffa34ddcd2d6aedc5d9b6e229089d9b3b252bba28acfbed
SHA51272ecabfe5aaacd5beca5c2e5c90c598f45e5b3298d0e1fb7ab0d69d8a262d0cab682a96fc96e522e4e744f6f15c6182b6e597041afccadcebec1fcf52481275e
-
Filesize
5.8MB
MD51deb81b483e500b96aabc4c8761e642e
SHA1389a03ce92bd5869f24caccae43855331b4a9800
SHA2567a48d929d17de49160db68b3be58aba7d354f73f7292125adbb024bcd65d82c5
SHA512703eb1e3cad9349e1772d552b30e69ce07b3fb80b78311c0f698a79ca7cfb04d424bda1b722f4d8c586d9862ed56e1c2b99cd2d7df64509d3d66d1862e9ed936
-
Filesize
131KB
MD550cc978f72dacfec8e1f61acea2d12da
SHA1a0d7dd0e6f6eec6f0c56e260778238dc3a5fb705
SHA2562c7af2eb48f51a42f93824a2022fce7ad0b2df1a348560c76aabef5d666da2e8
SHA512efd27a7aca756d0c4e4e5e1d34f55e2c255bfc75296ae270ba7b6f75a0d221cba2fa38e4c7439ddda3bc7a339f07c961fc6e47a949084dc57299ba3ce2026683
-
Filesize
152KB
MD5bab0e5fc48a37c6d18e2aea27007746a
SHA18be3f947b183aed390f0c7daf3c40b6bc451322f
SHA25662dde1ae0cf875694fa0cd748685f4615ccfe8d146a2f57ebd5dcedee4782ca2
SHA5123228a1806935e35e42a190c4a23e229337388ecb59b213d513733109472a0f20a4cd8da827ddf9d2ae1b1b8613fd044ed02a7027052a3f1ce8e475ec88bcb2c7
-
Filesize
186KB
MD5008b382cdb77eb7811d572937805de53
SHA1b339ce200f027307c3588096a413906d5c348b95
SHA25617dce0905356c7eebc78dbba0913aa1476ed84cfc09284abfb8aa7147fe89004
SHA5122bc380bcb872bfb8b61ee24442df21ccc101f56f05d766f41a3f34b103d0be2e6569ed371c3f9011b2b806911d6e5c4b56208ce387d45027d382b7f2d6da986e
-
C:\Program Files (x86)\AVAST Software\Browser\Update\Download\{A8504530-742B-42BC-895D-2BAD6406F698}\118.0.22807.71\AvastBrowserInstaller.exe
Filesize106.0MB
MD5ff39ca82e74a0e8f8ae73a58e0b6978a
SHA1f8005a3ee4049bd8ee5cc2c41179066f3dff2f2d
SHA256c7d3de4acc2a4528d5e822c63121a9dffd77f510109c2b8849c29a369ed309bf
SHA5120e1a21393e8a33b3390a70b8371d967b154dbb2af62ed177eb6799369ed17a0ef996182707a6ba0635de9ed793b2b512f1c51a5d348ad7ad249b39905135412c
-
Filesize
26B
MD587960953edddafab87942b30910e1a9a
SHA1ff04fbef2b35182a6ce9ed34c7a53f6bde2467ee
SHA25603fc6ac48694c20096a166f1a7d51bb7399b370b7b424d2ca1646ae3e421791a
SHA5120b97fa32f19cf9827315ac259847b3204e1c4f120495f1f6b33ac864977b14338d0ee2bf1a1cc57a4ddb918eeeac99546d82957fa08440b9995538cb73e02b1c
-
Filesize
27B
MD589655a2527651eb67c2f7189190b50af
SHA167330a468431c3af91b65765579ef30c88cb465c
SHA256615a8502c5987df2f6eade3e9b25cdc314f4060e42b7af6350415b0f8e2f171e
SHA512c6631a6dd659812adca833d9beeaf018ba87b62d62e944b3e9de526c39743c6ff7cae134c305257af2b8fd7fd9b7ff566e78851eb16b2ad71412550c00e30b74
-
Filesize
28B
MD57d0a6f7d0198b691fd741740c22f48a8
SHA1f0d3fe0d2197f8550fda876c06da19310137da33
SHA2568f4f7086ff2bf4816a6f1d4b71ecdb997020b7e8873fed61bf298b49a9a6ba88
SHA5120ed4968937b19381addcdef423f74d0322791712cbd867ce458e1a8e0e913f92e6030f29a6f41734a71e140f4f0ad88308994c01ecd05cb4760f9ad3228aecb0
-
Filesize
27B
MD564c6b11f9e21af3f69356b9a340d1007
SHA17f30dbdaf1e945935b0c6682910a213981f81642
SHA256e149477a4fd12dbd8e1cd8916f122f098e043a1753280122fb964cd14c97a0b3
SHA5124d0f39f9861408be5036c3998f6802e976e5148c70be0789e1bb2eca0828641a35b193260f66a44d922117aa33a067cd1781e96016236e74f226f079aed075f4
-
Filesize
28B
MD5a77a5c7f12ad3918d6ae5890c7721d07
SHA1f2c0722011d03bc5778e3021911ddc970b2923d7
SHA2563d63be14aa205362609bcf9b4d664ba286d033d0d588df5288c996c2d055ad97
SHA5122f30f5cbaca723bead15f7d7e42fc4e217135eac057c12243f85b0754b93c9b513aca4995963c3c260ee98a9ec919d246bf56d902e0c3ed31d33e4f7a5544b1a
-
Filesize
131KB
MD550cc978f72dacfec8e1f61acea2d12da
SHA1a0d7dd0e6f6eec6f0c56e260778238dc3a5fb705
SHA2562c7af2eb48f51a42f93824a2022fce7ad0b2df1a348560c76aabef5d666da2e8
SHA512efd27a7aca756d0c4e4e5e1d34f55e2c255bfc75296ae270ba7b6f75a0d221cba2fa38e4c7439ddda3bc7a339f07c961fc6e47a949084dc57299ba3ce2026683
-
Filesize
152KB
MD5bab0e5fc48a37c6d18e2aea27007746a
SHA18be3f947b183aed390f0c7daf3c40b6bc451322f
SHA25662dde1ae0cf875694fa0cd748685f4615ccfe8d146a2f57ebd5dcedee4782ca2
SHA5123228a1806935e35e42a190c4a23e229337388ecb59b213d513733109472a0f20a4cd8da827ddf9d2ae1b1b8613fd044ed02a7027052a3f1ce8e475ec88bcb2c7
-
Filesize
186KB
MD5008b382cdb77eb7811d572937805de53
SHA1b339ce200f027307c3588096a413906d5c348b95
SHA25617dce0905356c7eebc78dbba0913aa1476ed84cfc09284abfb8aa7147fe89004
SHA5122bc380bcb872bfb8b61ee24442df21ccc101f56f05d766f41a3f34b103d0be2e6569ed371c3f9011b2b806911d6e5c4b56208ce387d45027d382b7f2d6da986e
-
Filesize
186KB
MD5008b382cdb77eb7811d572937805de53
SHA1b339ce200f027307c3588096a413906d5c348b95
SHA25617dce0905356c7eebc78dbba0913aa1476ed84cfc09284abfb8aa7147fe89004
SHA5122bc380bcb872bfb8b61ee24442df21ccc101f56f05d766f41a3f34b103d0be2e6569ed371c3f9011b2b806911d6e5c4b56208ce387d45027d382b7f2d6da986e
-
Filesize
428KB
MD55702ce24eff2ce37e98ce9f12b515e5f
SHA1fca6790be58360c0d165f2290e2f1f615a904b13
SHA256f9b34dbb670de6bd85b50e6682bcdc97275737fa8478cf444db21bd04c45b0ee
SHA51255059606985caf27a3bef331ec4e7593e2ed702123cc3094fb2f907ac2e692c878a11ea01e006b8f70c30cbd8f0bd6245018061765e7c169523633e021d7a968
-
Filesize
495KB
MD58b06fd52b58667f52866d1418a309625
SHA10f7e7c7d08e89c6da32a54f6c0dd44235d9e8e99
SHA25629bf5df67f542ed38cc61b1e0899f59885a097bc72a40f08e006927a0b8bf2f2
SHA51279c029518e44ce875de5ab0f50fb4fcca788d94bd55ede9e190cf3777ef52d103899647b44dcaf67a7cb472b6de975b435063ccf6d67bd710a128805c1b405e5
-
Filesize
1.4MB
MD56b0399eaee3d3f8668facc835649e7d6
SHA1960f1db80910e1f3875572e60210621694dd33be
SHA2562170b71910bfc3daa160b2d0675f40ba6516b58db6151fce220e77a904215b5a
SHA512e5e669ccef97a850df75a1ce33b737bcb64b024f1599f3f63a4f55762e56c087e7d05dcf4876b081be6f5e4c5735276f80bd502a38edada3293055b21e5b61d0
-
Filesize
1.4MB
MD56b0399eaee3d3f8668facc835649e7d6
SHA1960f1db80910e1f3875572e60210621694dd33be
SHA2562170b71910bfc3daa160b2d0675f40ba6516b58db6151fce220e77a904215b5a
SHA512e5e669ccef97a850df75a1ce33b737bcb64b024f1599f3f63a4f55762e56c087e7d05dcf4876b081be6f5e4c5735276f80bd502a38edada3293055b21e5b61d0
-
Filesize
42KB
MD51f38fac4bea77244ba8e5f867e8c43e9
SHA1a81515c4eba7ae5bd6195c4ac17605fc0263efb8
SHA256da8ad629ad5ab0037a5deb146a0ae46a6896dfc3db475ecc9813a4b13ff2832d
SHA51206c2bcc9546a849c63cc7345320528f16ac7bab267d258883e52d8a55ccc997e13f1ebe765b50cf16ea28a534c94f97b5074369c1b496e18313d3662073701a5
-
Filesize
41KB
MD56e446b5cb462880b13e965594ded6bed
SHA1a30f72f36d9d390780017e0fef8719d9fa04f214
SHA25617b730aaa18b3739dc32b2642c9c9c37eef851814fd88062a3b74bbcc391df0f
SHA512820753be644c66a8cb18632dfda202621a529e8a4bcabc95ba8422ca0a117cd385659552edf57c99b0c39ab79cbd13c0f9bc3d275e929118587ddd6092b0b826
-
Filesize
44KB
MD592df1a264f92c0a04a62e9174fa4bf5b
SHA19141f94fba8c7ee0f9be2875a918fd95b3ad7b30
SHA2560e7f9cf7756498f891b3630f3eb812ca6ecc1e30cf42da5cf90a3bd3afbb3a56
SHA51237befeed94a63bbe262e7b37b4f5bfbcbf51a58155d0a63d27e5d379f1e1ea136dd5f7d45f4dcdc93b9b8bef5b4804de9f425925ba7cdcf4649a764303c0be6c
-
Filesize
44KB
MD5e333fd3cd6e94e2e1ff6ce4c502ce1c7
SHA1a6aa89ed5c4fc072251fac1d9b95c115dcc7bdaa
SHA256286ec415f3675d0351fe18f2236616eb69bf362960fbc0d3a470753e9b416f6c
SHA512abfed8c216e93867ef840105be2e39c2db409c89e8b6bcd4c7e53a5f5f399c5bddfca0ccee4a098e0255412bfe14fb6681ef9ea9e1a6c259ee7bc94aba69dd96
-
Filesize
44KB
MD5fd0e1242e4265cb1fda0bc4d860e492e
SHA1e978caec71098bd5bb157ba6745a476aed181ed3
SHA2562aaf74829e904912ac6e8cae5e8371a5ec4038a8fcd5213f4e9a97e4b44981c5
SHA512ed9a132e19751ad0f4914d51fb353d05f655ddbaed84e2ec07c3e9fe13e0c4351ae8de78e7b4893479ec5fb899227f3fb0d5af0a08638b11887404228fb70e7a
-
Filesize
43KB
MD5028057962779e6290eefac48edc99976
SHA1460434fb3007be992ef15f9ce344f00ac2b7bc7e
SHA2566f18b8f74bc4f2e2b732b09162e5e12a90fbdedc8d44ca67bf57f6e9c60ce472
SHA512d3ec806bad5090057667e0bc372e62c10c4ecd2784667e0b1a15224c7e7655e34c9c29739b5c2ee03e1debed8662686b706cfd5e455480344a4ae511b45a9106
-
Filesize
43KB
MD5ed7c7e9d4088ececb9f7bc3822f1ffc8
SHA152e457856b058e870c0c376f4238a9d3a598737c
SHA2567931405cc305e2d236e1d26b4a5e03d478d2137afe1b5ca78da667dd1bb77dc7
SHA5124612ff47e27e44d800aba4f0198aa6dc349b677bffdac58cdf1204d834e0fe24bf463455d1e5c5b7c5a875c6201ee425ea63e41a6f60afccc018be5e446f90a0
-
Filesize
45KB
MD57d31ac4e5ed0724aa79558ac86e6c35a
SHA1a6b19545874904f1cf52bcf405a50af95ea5b9a6
SHA256b2184751aabb9dad80bbbf5e981ef9d7737ff48199d9e210df86d5c50f3f5df8
SHA5127a1058c7f176cfb5ce2c9e816173cc6af1fa218571016b0cd274a2bc9044a4e1db1dc102aaddfb623d6627a144c52d27990fe1a7942c8a3555b415f09c67ceb4
-
Filesize
45KB
MD5d9b9e3e6b77cca7080f124e78b2462c0
SHA11a270a4a03317e5e69cf33bbe63a9f80209b1a53
SHA256fee6e6387e0df0716c4b15b5b297a85b18a8af76025312d844176f3215b4185d
SHA512c7f3ec02f3dda1474746c2a88dfa6cafc7e516b7b1622db8a4287de41ec43da715952456d78939b54dbad35c15943366dc48a52d6e3e43e4342d8374dbad0220
-
Filesize
43KB
MD54ea9165200c99cfb9bf17fe1124d3648
SHA1ff75d71ded42120c65eb0f796f6ddd4937b1142b
SHA256aaca991a3dcf5f56c7151ca9fa79f15a51dd34b4132eed80f347304f9c6c4c9f
SHA512997c712f3b7ad07a0239305b34a90db18e2a7dd7cda750434ff02c87b971b39a0b68f2358535f46edb443c06d9fc149d845f91eb1990df2c7ece3c06a23e9bd0
-
Filesize
42KB
MD5dab9fd7c77f73c8a7a0201fecbe3e882
SHA17c8836d026d4b5feb2e64141f2567218f8fe6edc
SHA256efba6c4686bdd2021e1a6e03b109e955cc1fcdd0d36036bd9a66c78eef5c9fcd
SHA512e687bae81fc2c536197dc95edbfa70f013a7a3f19aee3b8b0b18325a8110a33b92213e082757295192a4f66e0b1e6ab4362fcc2a70da105ff1f469528748b3c0
-
Filesize
44KB
MD51857a1a05852d0aad09e3b7f27bccc45
SHA13afaad8daa9a019cf32fac6b82d5641a4247b591
SHA256c634e56c9b9c165a3b230ec94d02ae4aa4725b7aaae57dad8f17c2be58d15fc3
SHA512962db68f1fce9de892847df558dbb8fddabd1bd4d5a3c3b5cedb97681fb315b4d0366a41fee32877a96a34d60dcdc721b5b3fd221418f63f6acbd8d56e579728
-
Filesize
45KB
MD572ea3bdc5d4f0f951518d03aeccd2bf6
SHA101156af60ca96f6f5b29a773a89930ee188318b4
SHA25653d3839dd7f3e9a12fc192667bcf9d721034a0a7c1940dbe540fe841cd4ed3ea
SHA512b7ccde88474d3849c3d55bb3209f6938fdfaf343dc44f4a26bc195b4abe9c476a8fdae1133ebad9a5a852c3908bf828f1ea8d7e51c92000833b6892f0c6db1a3
-
Filesize
43KB
MD5ebf1ab8035e5d22d748fbfe58ad5b569
SHA1525d1a6fa85a147a0bc46ecb536019aca54c23d6
SHA256ef5325ccf0a97fb550030e0fadce9349039d124cee390226fbb30296205d49a8
SHA5127cfbd9bd54a56c333e78b35e38390f5207e0d17777ba2d28742e4cb413e10c17851ebe3e88a34ae8ab8807d6092057b600ecf0a9e9dbd52de40549418e6c7d12
-
Filesize
42KB
MD540aa4e15b44245d0320c2d6cd85bb42a
SHA1b06b1ff202ba5332ee5a65d011414f0e8969ce2b
SHA256277979b950dea3372ac9df4c95ec9c8f7e8549e714b6a78a8d77be141d53c007
SHA5124ced0c4198305f8dcb71ead6520d7962ded65c033696df29311f20b677bcde3e62e25de890cb0a6c4dee6ceb1cfe41b2b61a08663beb57eb6d3873edfde4162b
-
Filesize
43KB
MD5501cbb4a49ddd3abfb8929b44213dd54
SHA1073c9619c1d7eb7b893eba3e2065470d373ac292
SHA256902cd4b195c0fa1f58d83ff2b7b7e85237f6fdb7cee06d593393422eb1cfaa0d
SHA5126585e2616817a91a70696a51849d08ea34c582b6a3fffd95d9de9ba0a5b8560e2684c049856106b6dbfe50ea9ea1c29c31dc8e197559e4863b89731bd7dcd38d
-
Filesize
44KB
MD53875ba78fb49cbbd8ea8a258e3dc53d3
SHA162fdc568d19aaf3b3537464acc356946b85c2ed0
SHA256a07e9b984284d8a3b8d948393364299f87565e45e8003583e32f2670b085442a
SHA5123516f9994cb8c957c7967cb1276cd9929f2b410ebcab428c02d6b4abe20e13bc8717f148d7f59236e75b171946dc7ab38c568299f47f8dadf4f7739aefd71268
-
Filesize
45KB
MD5552d2a7da0b056d6e8db9f8e143c5f97
SHA17d88e63e6d8ba3224902a40dba0293b727010f37
SHA2569c29f6536e064f753f8fba0b26efe32f80a83f48daa416ef53d3b55cbce02aa5
SHA512c48cf4cb54001a8a3490f45500fdc81806da1a663139814452fc8d952ccb4b1caa3d38fcddeb1be772d1f65d455537a62e1db41083dc9d9763f109857224dc80
-
Filesize
45KB
MD50dde60e0de5ade02a339b76fadd5ed33
SHA14ef9d16e772388101f02757b18faa2082e67234d
SHA2560f4b68558b910436c1184b9e8e682a7183a748a9a0ee99631336be9a71e9956b
SHA512e1f2f8772ce6ab329069eaddce9f710009425465892eb059c83a87b4c9fc9c49e353c20521d93692da48bb4af586b7a9782f16a17f32d07762e712da33460cdd
-
Filesize
43KB
MD5550a2dff384afe5e4b8339e48a43dcaa
SHA169e2e67340e13191567af9625771fadf25878ae5
SHA2563df2afd18c225d6ea7400c4a8b5f2412a02265a98b2f258b969e276a5bf23c94
SHA5126530d98d42d01d83f2493df213cffbd72cb06341cec640bc0303e8d80f7e8cc176899bb9dc3a7cdd790d71301af301ac78db17f7774665ed7036ca070d9eb13a
-
Filesize
44KB
MD536a21d299298d7c0709f7bfe0bf0cad8
SHA1baad265e2bf82fc21d1f363d7e61ba81fec1d701
SHA256ed27ebc725fc07129ddefa4932eb1cfbf77cdc8617f0c37ccb9104eb2379b57f
SHA51238b65be12d96d40840471680cc7a28c9647205155436eae2247981830ea6a5375f2e377dbf9b1e79ddc19dd65522f44f7a6b6d8cdf4178e91bc1c59eaba6cf60
-
Filesize
44KB
MD516e63288e7d55c8880f30860d43410f5
SHA1668fe406ed6977d6d689ea24e21b55a62280efde
SHA256035af5641b1751c78b1c626d16bc103654be5eefe9e8d15b53bd24f5313d8a5e
SHA51228ff6c3416f6012cf8beeb72a740efd32df463f6d26ecd54d9046580325267f1537756d37b9d07f0c247746199727550b5af365f0262f221d35d200a27c2253c
-
Filesize
43KB
MD5250ecd64822e2a3b86523469dda45c36
SHA1e94ccfa2de0b1f69576c2183eec57994542ac544
SHA256dd530fdcd7a5bff02c217ec409852a33455c7bc3dab13e1380bbde5af188bfcb
SHA512544a46500e5e89077e91298c032a7222c2cb5867b33fc6749486ee59bcfdd24db61aa617ffc9f0e62235b0cb191904118235e31be7a5fc6740630749ab8e2915
-
Filesize
43KB
MD546c2f35b5a91501a671fc3ce63a8c202
SHA11fc33e0faa71dcd7e7c8068f8e268a1b117fb0ce
SHA25682255b1acd999198e4116796ad94b3f1e31a95666a52319fd27b390f5dca516f
SHA512a8cc15c12415b490624a993453cf23288c6a40dbe8d7e6b133f363881f60ae47ce0e412bcebb60c433134740be94d83a03169f68d835d5079ebc5192cf47b0f3
-
Filesize
45KB
MD5902f5c4add30b9665df17c46849cb20b
SHA10a4a086c9e9da4225445bf52376a38f748f3af47
SHA256bc3c543182ccacc02ddd1706719961745767206a4468d8685cd00a4279c12328
SHA512cbd0c475a37b5eaca040e0e7943f84a90e3c24995bd4b61ae7220cd9562aea3b83593b7a8e3d22b586dfae67bcfec1d531ca3924cf77170f41e539313f99763e
-
Filesize
41KB
MD55315b828cb27f4b142eb3770c77d600f
SHA10582c18fcb5a0214e58c404713a3699319fa7385
SHA2562780d95b9f649e6df20d7afa65f6f4193f07fea877333d96807ad0d8b7cb17a0
SHA51273d452890df20bbc61eaf73e800cbe1a7cc014da7fb4e8bfec90ecde4e523b35804c436a737ffe21d8fef569edbfbd819bdc667ffecb46636cceede9c5e10082
-
Filesize
40KB
MD564895710fa9f8b5cf9703e8e4bec6d25
SHA14e29b6fa9ee435a046e618a95302c04662a0bafb
SHA25653402867e91a018160e35b027f3266bb364f6072ad641d8f583cef0ee3255986
SHA512354e5a39d1bec4a436a217f296044dcb2025cc75eefb961822a59a12624043fa6c9d873a834fba8fc8ad9a9bdc7fefd3616dae98c7302819f579c7cdfb7a871d
-
Filesize
45KB
MD529d26e1da2cd11575ba121aa36f0a638
SHA1abf359f445ea199ad8773586e72fd660036e8c84
SHA256252c0acb781ceab837f7ec927cc41dc09c2d0d57ac6975c111d0b561ed3cd1ac
SHA512e482ff4094368c3055daf5b69e1215e7d41719c1f4789785d05baf4a49c28d4ad142ab9aedab37c7df69d14234e9ba79331f51fa644db671f2b7394c3ba000fb
-
Filesize
39KB
MD5e9f5c3854fcd642f23ce4c4ab659ec28
SHA163c29acc295dccb38be5746e48902328bbc3e9df
SHA256fa4ecaa06a8d0df5bd60c056946b63650497bf6a853ea0bdd93cbe411b96c26d
SHA512167edc03400da59a06878ab3a8c27b5ac9498b28973345a483abeacfaca10884f34eb739d423058ebda50c4afc5a94bce57d6ca606e84a84cbe482b331409112
-
Filesize
43KB
MD5e105561482f05e65eaf98c2814400c5c
SHA1f68a0f610dd48746f9a4a0e835528426d6fad47a
SHA256a5595bb4278165894446433c27bfebf78231570ad53b0c69e5d0df86e4724aa7
SHA5127aa61a8b4e012b79243f7328f7fb572b6e8be4382251dc2ee27c282b3d0347d274ca4f553b0e0184dcbfb369feacb5991718e9abefb85e57655384e0c1126cec
-
Filesize
44KB
MD573745046a61605f22b9eddc34629a81a
SHA1d8181ed29b3df33788eced0adb72178f7deacfb4
SHA2565e790d8a5ea811c4f5fcd90f0820e8bcef1202f3f5e98d820e529ec47f875fca
SHA512106ddedaab46e3322401437ed842225b1cdacd1fc4d01a79eb6195ae4d449f4f20569def23aeb0a28c23199af5e95c49abb8c69d7db9906395818592ce6095d7
-
Filesize
46KB
MD5c9091349771b6ee27024e49afe316cf2
SHA17adb311a5cfc584c717e6f1957842dfbf69a7cf1
SHA256890cf80909d652ed6e220f5809880ba796b9d0981e16cb69b0e245c7c30a2082
SHA5123cbf605462ffc847418009c41b9f526ff40774054bba92a2fc510c8823e268454023114ca5685a5b94a5246e6019acffb92902d031399fa2ac50bca9bac094ca
-
Filesize
44KB
MD5e9eaf89a970341e8a588fc7b5d31f411
SHA152d94df567d1353db5ffc44ccf2ba5224831a0b5
SHA256f1c134607740645f05111944f1a860143af8cbfd828d0a439f8d5bf8888ec975
SHA5124fadc8a6841efbadc52a790174dde437dd125b56fa8bd1ed929bd8b2ddbe18a6dd2591edbcf5ace6d0ae5700fe82cfb6d85700cf993e8bd5a94a9c070f3c0683
-
Filesize
43KB
MD561fe0b035cab068a1e89bafe0bd73629
SHA1dccb630c3d7a2dbec283f87bc966ee96b11e6ccd
SHA25603464e5e7808aa74d8f24f395b29b75c56abdf750cfe671a7ce388f0299de63f
SHA512ee3de599b059db1f7888052e573f447d92970b7ea6c9db1c09f8df3339d2191be21a766e56369f667b75f7b26f770d3dc8adcb920eebcd8316530edf506ffcdf
-
Filesize
44KB
MD56b426996c9d7a6b5c7b83d09e9b9a6b3
SHA1e3f3137cceee850132e302c7f67c691f018428bb
SHA25673650e199c53eda546a2f342e7d19fae3c5de4252a71e0044f461db796519629
SHA512ae66ca8cc9cd16d934226f9d1962659e8de6a400b978ea1793a035c6729c0ad648bca47e036bbeeb56c02ccb0b08832879f2f451b814264b828d514f3cf47d2a
-
Filesize
43KB
MD5e163b26a7a806ef48774ffad0067bc24
SHA1b1883272d34abf3bb5654aecce8439950cf6fcac
SHA256348bc8bed07c3625236399e9d5762f432bb9539a21fc969dd63b275ba7c9d31f
SHA512924c038de6f1f6a87dcdec3b32a1ccd766344186c88a1945a9684b0e0f12f346787da84c38a7a538a9153e62ca46ea7a30f0776ec09a0dae978fc2613c7d432c
-
Filesize
44KB
MD5c3d9b238ed70b3de4692e32b5bb7bacf
SHA190733f68e13d927d338927fee3bb02d1a47831fd
SHA2560d8eff876be13900aa77ff340c8a224ff606c1d204a01f09a0bfcf754ec9b0b5
SHA512e17936184cfbd9cdbe9dc2d6abd5590646557a2e1f396c2d2900d381c471e68fb651ab1b7c4131adcbe409746d548d341f72eb402315122f5c1d6afbad09215c
-
Filesize
40B
MD5be271805f65a23f0728718025d12999e
SHA18bc3f4fdf9859d7983588275b011b67830bc9957
SHA25641f33d99b05cefcba2f51d7420fd886e68bd25d201fdffc55d9207cf75de6423
SHA512b9b2b5a58b2c8e43d1e16f80e7f28a34b3cf5c40d9ebba283bf62fb327c9a7ec81f02e231ef323d72138b7dc92518ddb4bf795bf2a8dbe3e6b485a5b4d1069f7
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\781940be-3ee9-4da4-817a-740d48cc48d5.tmp
Filesize168KB
MD58ffa5fca99440903fd2e3e96c4dfcf4e
SHA13fb616139a2fe070340032489c5f809c739ff295
SHA2562c9d821ed66c82eefbe486efd4e9b6d52651a6ec2980761add8f22e2c3051065
SHA5120dc51168ced3123731eaa990e19f12d21f7e37b3e234132969b429008d903e880c74c7754d7705a669315aade1bb9a971dd8d35851b7032d1a4ca4764c79f482
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\_locales\en\messages.json
Filesize118B
MD5c01bda904507ad435bc35744985c4ef7
SHA12c298313661fef987782c54829d0f16dd8b129f2
SHA256661505cb11e4b456a6eff122a081aa95e742b405de833106761a90193b2789ba
SHA51252870e5b03ab7db71a9588e775b379bacfa34a4d6afa856d4b09902ceb86b8f92b5b610c4e6db164a13a8fa92241030bc110fc6688a612185902af6e24d1aa83
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\_metadata\verified_contents.json
Filesize3KB
MD53b2a50d7f62c2f625f7c387156787be2
SHA1df8673ad4217f02dfe7c4b598a7958c33fcbcae1
SHA2563a0671a0faf80cdfe5243551fb51e19e29f4558f23872509de530b69187d18a2
SHA512828274213b3bfd5c2f848f962710edd486bf50218e2f27bb8401f5955a96b17f29070130be0c4388d155a8fc919d3df09ca409fe886c8e6e570c2858b181d28a
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\background.js
Filesize94KB
MD587f8d66dcdc3d645abf008203579e72d
SHA12a691a082596020ea17868b6698387e2df7d249e
SHA2566d7197c2e84136f40bcde741bf7f047241cd05d7ce416e74a34f9a652d8c38b9
SHA512eba0b6e8625b13627b40e218c67c85ab79edb7c25cf4acf1397baa1642f689423eb5e53ba1b60ef1d14ed459504283d9d382a11b44c64f11ee8540a9a8f0f7c5
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\background.js.LICENSE.txt
Filesize336B
MD5275fe79abee3b697f1673c8bd9c58856
SHA1cf2b1a01feb5dba1eadb49e8fe087675fe70a7fd
SHA256d33efbdf4d309bfa4448199551371ff81d5f57661b781faf79d256554e038595
SHA512f6c93cc7bb4d678fcd51ba4024371915d614621b0f526130ae0a51ac4711c8cacc8881282538674867c11b0e37c1f0cfb5a64bb047c92594e0a4d4c25b26a932
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\img\icons\icon128.png
Filesize2KB
MD58d2e9f24ccdc58f1e14c1dd7ccc87274
SHA10dd95be46b5ab54cc437a4193d52774554cda857
SHA256b9d1842ea885c7431161806f39889967e9db9a7f6979c2ecd4da46ac344e6649
SHA512ec26920e66ba87e62b2e5898a42c1376f4952063a3f0c2932d0c26d9f8a32300ddb5ba7cce26827636b8d6c7e04e901dce9d0c193fd796de744919ad82b0ca12
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\img\icons\icon16-active.png
Filesize384B
MD57305121e28476f6b440fc21199bcc987
SHA1d23ac11334ffe6ed2a4c068c88f48ed3056fba1d
SHA2565887411ffe405d0036d5ae35f733dce33c58552933fa298cc78fb3466864464b
SHA512ed7dbd8f1617b7d4c1b8b09939ce8e5b4be2271892dbe5ddf68b43b326a28d48ca6ca46c53dd81fd9f98065f2a61cff7fe22cd98ad4dc7b8c1cf0acfe4b4dee6
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\img\icons\icon48.png
Filesize700B
MD55774f763006cf6aa70cc18922524f993
SHA19b5e2adf1e3bba57fbc72a71240a584b3682fb42
SHA256231afb7130b2e9ea943e42091b16dccb5e628649d8c55818b7fac632f5220260
SHA5121014b66eeacab93fe3c60225febe6657296ebf11ca2e30e8598479f889b2dc91a83bc97b4b1558cb9a0f7347a883295e992676b5944da67d0edaf7732763f09e
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\img\logos\avast\icon.png
Filesize3KB
MD594a73def8b7e2c9ca07b0d974acae57b
SHA15dc258192300325ade68e7ce5079006e7ade23f9
SHA256a0ea771f573c37d239707dbe484aa1de5764f77581f6eabe4c856a01d84445a7
SHA512b5c3bbf626987c3b7f80e534d889430235a7950a1d9e1df48d67b9e3d7d9824eadc6d7871d46e0ab4875edaca8c7dab7d5109b658d8ea0a98ccbef9e47b0174a
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\img\logos\avast\icon.svg
Filesize5KB
MD591a7c3ec0467f0e288f6afa178656bee
SHA1e631f3800708f0ba1436200342726a3cb588f119
SHA25688954d793a1c88f81a124b6cd9455bb7c99727ba49f99a437ae21aa1471dae92
SHA512040cf05168ef32067205a34daa863720d698bf2aa8fc7a9243b5854de2080b51ed03164933ec67f5edd8d9a5ab7b4bad09551f100b5ddffbd164141ac8ad2a7f
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\img\logos\avg\icon.png
Filesize3KB
MD506918658a5144d15920ce3089802bbdb
SHA158df1500c80c86c68f08499d636679cc13090021
SHA256b2cfb79adc45a5587a0b187580a72fe778ac14c4c073bd624efee07de9c27785
SHA512e5da10ec6ad6161b9757fdc37572c405283512ae14b8cb431358d72da295fdd3cb2ebcd0e5ba414dbd84bf12aec5eb229ea8111f0509f9d008cb5098f9605953
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\img\logos\avg\icon.svg
Filesize5KB
MD544b895cde80fde31846a76eb84925017
SHA10a7bab1bc7f7c05e53e78ccc0000cbd0ec763689
SHA25698f371676bb73135c55eb5e40262bbfeadefc717d0bf175b8da627136bf07164
SHA512009db3c97f0112966efc9f17ec3e66c74c4ce9eaaa404a5c356c3e201d2d5e7ae62225423f176cbb1c826d13abe7b589a43e40b461b7deb3a5a4a6ec0de7b5a8
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\img\logos\ccleaner\icon.png
Filesize4KB
MD5e173f076151ecaa315777a1cdc6394c5
SHA10c3423744ac9c011d4f40b9e416bf9bd0748c753
SHA256ee060039ee5d705cad81a871f1678864a801f91a2e800f93985eb00a0d23a16c
SHA512069f004e642256f07dc078164dfd02912639d803aff32337080b4e78fb71e84965a1c01ab16357bda0eab50b1382aeebc172c2fad9d11b68028d055ba9e40bfc
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\img\logos\ccleaner\icon.svg
Filesize9KB
MD553d3147175fffe2d71eed5db7ab21138
SHA14f3c397950706342b86506e33229fad0592747bc
SHA256fd9001d35b016899e7b80302ce3f754508390a5d5775a337aeee12d0cb1a919a
SHA5124b0160e80c258e43cd9087380876ec7815d30dff1954dcf2662ef2a4085dfe564fe7b998044832afac26c902fe5f744fd7507ddda7ddc37be956a25265de23b3
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\manifest.json
Filesize1KB
MD55ae34cdc26ba019a74d5c0ac2b5f02ab
SHA14b886991747f84b731a306bd93d5e4fe8d9eb115
SHA25624df681c011ea8465b3d24535fe15971765d03889c95db1b2eb055149c12ac48
SHA5122e1109522c5d0d9b1c59a394d6b8fcdcac4ea503c6331f107b7eb4e8c2155786e4beafd491b1558eb48b6523dcd6032e5a52835f5990caa83c28129f758a2cfb
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\popup.html
Filesize210B
MD5533e314c6b3d2d31a1d89f8885c80983
SHA164605122a9279193b2465d88dede450471935779
SHA25698050462e9480795ab7e63cc3f097a4bf6b8292e1fb27eaadfb0e4ca6e7adbd0
SHA5121696447537d7f0370a7a1c296e59f709021ddf0eacba62de33c9fb794309aab1eaee3a5c9534a26c0a10d6f7ecf81a707c932346fc90c8c147e905c5bd560f77
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\Temp\scoped_dir2680_1153276037\CRX_INSTALL\popup.js
Filesize7KB
MD5064c23ff02beb11fa3b94e12406241d7
SHA10ddad5b7bad977697001f21cb54fd976e0dddb4f
SHA2569a8bebd2f119e3b079d8b5f2edc2fe66938204acf74b655afae23be626943701
SHA5126ff94b042242e21c0b852aab11f21d361962a249ace7e1d1074a651589b740460a6bf4f0ae859fd17024860a1e747815b672875d3ece722dbb38d1722f944cbc
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\beghmmhchncjignfbfnemngnlnjdmbcb\2.6.234_0\_locales\en\messages.json
Filesize1KB
MD570c7984777731215a65a737b98c49dfe
SHA160da2b4e5a80334aff5cab61d67fa0facc62f2f8
SHA256fbc68d0c4ed3346ae2a84580168d43b8ce12bc97564e04131ce47a0c3328f1b3
SHA5122609a01feb2f4aac8edb180d854dbb5c93e9b053791d2bfe9c1bc3d7baacb8fcc75c0953d7e150b2203ee1a2f4e65fffdd281bcbfc2fa29326576d7b887052b6
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\beghmmhchncjignfbfnemngnlnjdmbcb\2.6.234_0\_metadata\verified_contents.json
Filesize11KB
MD53687d33b30e48c1a4963342fc51f3251
SHA13c5a1e4b09b593f17f6f246129576db5b76f3c98
SHA256a01e098ee58d0d73f4f6abe4dac2e201274355b21ac93b4155f8746083ed9e5c
SHA5121a1eeb45c0797bc0d490a2415fde38eb732363b7f9ddb343a2a5e9bdac9dd763f6b23f410a291a989c2d247391baf5a585bc01e3ae72a7b98b44fee867ff1c35
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\beghmmhchncjignfbfnemngnlnjdmbcb\2.6.234_0\js\content.bundle.js
Filesize60KB
MD5a34fe451d63cdb19c308f905eae03b5b
SHA1ca8de49274e95b51e9b3fc2d589c5b0342126451
SHA256d721ee3e0f776c2e90dd7dee4c1a9f8135ac4fe0c585d84c857b90366dae1317
SHA5126f5eb4dc8bbfaa96de8ecbf8f1f060dccfd391965d4e277c2ff39d148627cffb5baaeb9529c56c64dc2d07049a7c8c1c0d243f06e08ddac7512b3b383c81091d
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\beghmmhchncjignfbfnemngnlnjdmbcb\2.6.234_0\js\fpattr.bundle.js
Filesize17KB
MD5f7329f8be839fb2081e14eba04c3d69b
SHA178ba8673b10ac2ba0c6b923f53eb831fb9f69cad
SHA256453fbe43e6db9f98adcd53cb67d5745a2f9bd70dca76e7bb40583e19314888c1
SHA512aac579506a9e1859176425279b1e86e75f0df58ca61e450d4db8edd3846bf52601c3f29a83e641ef67702bd8afe650d88eea2216727962dfe3df6fbc05dbeab7
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\dmfdacibleoapmpfdgonigdfinmekhgp\2.1.0.330_0\_metadata\verified_contents.json
Filesize43KB
MD523454e2aad55583bfcbd935c4e745d02
SHA1b13d92a7bbd7321de82b39f44e690fa189caaa32
SHA256e2720bea09f4c4b479884e1604ace175712e5418ec9853f9a3675076a96b003a
SHA512459dc4149bcc90f125cade528d4560629f8bbd74d6ca71879e177602ae0bb333999c1240678c47c6541cd90e1322a6fb07f8cb96154675859e0acde37dff2266
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck\22.2.1686_0\_locales\en\messages.json
Filesize21KB
MD539d0c222fb31af2056c642f771241a2a
SHA1b285ddc9839c9b671d86d50c692ad3a1bfa72ca2
SHA2560431626acf7a05da2ed2877def20371374042204d6e7179df442b522cbb6e5ed
SHA512898eac511107f6660cdaf1664d51ce28f857dba45fda4dee823b1bdbd300a306685dc33fc5d1f8d2f97783d5b88525e6f621e0163241c2609d5535835276d142
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck\22.2.1686_0\common\libs\csl.parser.js
Filesize80KB
MD5a1c1f29ec4cd8387b9ce9a8f2f732258
SHA13e856da99bf0ae4b54fa2ecda033b0d1ccb7c714
SHA256caf0305bb13c311b5d5d323e1f7f3d1a1e031f80260cf249177ef48adcb75ae7
SHA5120c30cbe28699e7f67a8ce2cf078e009ab694e6c16796db22cde5a9b0edf0298e00b5707eed118d372849835388388299ee7659130c226d9a2ec677d26db8aaba
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck\22.2.1686_0\common\libs\eventemitter2.js
Filesize22KB
MD50746c1d401b5da13b4148578b3d7e210
SHA113d6df32621c65e948a15e9aed81bee21b015f15
SHA256ad32b841ca7a7b2557d460d3ded6c56a4b815f99cc812c6c64687700c270835b
SHA512cdb838b26062156c3ea98b1434b69224c2948028e413dce26b5d32b803d4337ab2964994164a5b1fa0900f5a7034c9586d83b13054118c759a64e70ae4317ef1
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck\22.2.1686_0\common\libs\jquery.js
Filesize285KB
MD5ad8b8081c725ec3b58674bdeacbfeb75
SHA151b789b456c939f24f1959727e974e7f87ac6458
SHA256844cf21ec47d7a95fb70769c13eb0bd1b44cc96468b191c8eacf77a6a383c31f
SHA512c6415e23cebbb608f159d131d6366321d25b1c55c5c3dd28d8fe560d96eeb20b49473029b10a1a3760e8cb7a6eb6244421686756286288b167b828bef4986df3
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck\22.2.1686_0\common\libs\mustache.js
Filesize21KB
MD55e06a419d5f86324f162211889f3db74
SHA1f7618df2aa605c053c74c5e8dbc5a26fb7212e1d
SHA2568ff199979125a713991e986fb7e27a296719a23ac9de7076a8783c4c7dd730ae
SHA512c5ebc399012c1d5dcb92aafb8df2a684d5cad9822bb2516eae45df37a41fe1f7827c0fa6535d2785f4b50e3388e3d234f43c8f42ac81f6a700b4a4b7ef8602ec
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck\22.2.1686_0\common\scripts\ial.js
Filesize191KB
MD55df090cec4f788ed57c6f9d1682dfd5b
SHA1f8d9999f58de5fda1615c1407c4cd7e59e0d69e0
SHA2565bef2b345000994a4d3488da83176932dc1e0ddd82a6f2579dfcaf014d1ad283
SHA5123c13e1c548ce9290a73f5f25fd96d41363b2aa9eaf8318fbadcef1e2b0ace5fa4af6a68b419f07cd631f257087fe2a51a48bc690bb2e2616a7f85b5e5ce6f54f
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck\22.2.1686_0\common\scripts\templates.js
Filesize90KB
MD583eb93379bde7ef2907975d56f11c4a6
SHA171ac11fc6ae5103a7481a4b2680a09bc3400b6e8
SHA25604c1d6a2ca17941eae235e6803f78805897de839b909ef3dc48dbd10cac3531e
SHA512c9890021cbdb02eb17e267b7d7363bb157e39f57d8fade426fe00f8c6e47b1ece7994b6abdfa60cb7376b94af757faacc339d4d3cabed718891523e0ad4ac38a
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck\22.2.1686_0\common\ui\css\extension.css
Filesize1.9MB
MD5655e3dffbf0f46a2722f6eca37b364b6
SHA1be67192eb5cbdb9f9e957e38e113bd13e5db6c1f
SHA256b67869bb1c865e855615e5f535db39c97cb83b44ae234b92f5906d87af170f3c
SHA5122f4fc6878e3ee812da3e73c143237d02ffdbfe72ef3dc85477de67ee8fbcd79a3e22365b3c1ff08524865ba88130b97a284840a6332c3735147f60f12a557ff1
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck\22.2.1686_0\common\ui\fonts\fonts.css
Filesize3KB
MD5fc0e972aef2a4f647d883d1af454df88
SHA1c729a7f106f404a9fc1d28be4a9903990a339500
SHA256b337e52da06f05bdefedd8f03dcd76b118d2832a15733a4b38e583a95eb4afe9
SHA5125695d40bb683d053561db680c5fac8de2ad42119374517b9c9c9eaa3fc751ab1e2016740e942ddc1fd5cbef639c3f071c26bfa5e399d185b921cff19312c76df
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck\22.2.1686_0\scripts\extension.js
Filesize1KB
MD56adebd787d18ab4111f4c1b6907df8e5
SHA1aaf5d503f01a23537ea06f4ae6a99224f7b9ae39
SHA2563c18bdb0ae398853e3c2113dc740b88b8a825024c2fa1f834858f405a5b4c2c8
SHA512ebf18fb84a6c4e62179861cb248a8f00890d94981c87d4ce01d34a55c91ef059d5146e53eca9061641441d723e05775cb0e53632d8b1d112eb3fdf9043103a96
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\gjcfnponmdkenfdibginkmlmediekpnm\1.18.0.604_0\content.js
Filesize590B
MD582279d316f0ba5a36b0efcb360a2745f
SHA1d017a7174d4eea75f9328671d9b4d260ec70d467
SHA25607deaeb33fcaef920d0ac408538e8983f35396e4f75c6a476207ce68a8ce3f29
SHA5123083f3ed9343ec901985d57f72ca02f89ab4a55b92776ab9d97f913a6a1ed2b05d46bc6cc9b54ac033160469d0c5b700fdad553f3f7b9f10ccf0a7f870817ffc
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\onochehmbbbmkaffnheflmfpfjgppblm\2.8.527_0\_locales\en\messages.json
Filesize7KB
MD5b8645df606dd756306208ec441e9c0dd
SHA18ebd4f5103dc792b6a563768d1c3d6e3b4729c54
SHA2566dde990f4e64d1ecbde90db9d3939f33b3b5c3d1b89704dbb8ec84df8f046de2
SHA51225b256e3ae975c4928d1ab696e821a4be3d5534090902573136f9cb9e3c8005e77e159918d418eb6d6a2c6c7156564d7e7846fb4ab923494ff0d2b0df1304011
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\onochehmbbbmkaffnheflmfpfjgppblm\2.8.527_0\_metadata\verified_contents.json
Filesize22KB
MD599c85d780ee9e3697f2778693d3e3194
SHA1e465aefd547525edbec4e099bf24bd39b18898b7
SHA2568d35435bce9e5a8a926c5693286af9f2f46c004dcdbd24a7b62f14a35a97a6b4
SHA512f56da9c21db261ce89e38aef3576a6a31afff252fcc427416f4e478cdf149e27330628daed03a80f80b206730c3673252ffbfc2aad6bd8d242acab9a0dc8bb22
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Extensions\onochehmbbbmkaffnheflmfpfjgppblm\2.8.527_0\js\options.bundle.js.LICENSE.txt
Filesize2KB
MD54e994bc011dc4913520bd9f4cefd135a
SHA1de9aa409a953bce76c488dd9b7297a23f63eb909
SHA256923090b15eca2d9a8c7f02431cbc23961b45e34a33c6ca0df8c162abc6f91688
SHA5122d64ebcf3b135c6249d4883c54de3f9bc0cef36c9c071b1295816ee416481659ee1f62d06c92c1b4a92e48c88cb29312398d8cf4e54d3dd5112d801ef3b080db
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Local Storage\leveldb\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Network\Network Persistent State
Filesize405B
MD56dc2c467d01aa4c8bd520d2c9a125e4e
SHA1d4cf9ff16858602469a95fc59aa1b0c1d88b42e3
SHA2568e34934b88f5c1ad558fbdb3f8ea7a3f491fe86515f9c0bc63616b9db8e41997
SHA512df120d53eca1289db3e535439ffc34b39ebd7f269ffa0a972bd077bc22a8ed058dd66f2e4c025b477f64312d2a636d0e1e3590033afa40be5f2338a5a66f292f
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Network\Network Persistent State
Filesize464B
MD51dde7edd4741ff9aff140ba0a48a6cf2
SHA190eccf332d95aed35efe03a75fbb36e53a524713
SHA25631e5e6c50297324effab87e40f3a3b53a0aae72074a5af0ef4b5f04bf9370f50
SHA5129c6369ce29779139f4ee265f9f4e2028763c91bc24483d3e463f5f218c6452618a2528118a6c6d308e12d9493c525dd52912bba964f7efee15b96551db7a24cf
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Network\Network Persistent State~RFe5a7a71.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Network\SCT Auditing Pending Reports
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
188B
MD5058d4ab724efd642a694e7cfd2202228
SHA1d72e505c362043792f030c455d48c1d7d096a467
SHA2564b12a09479777cd4316195d2866ce7ce34d9c2cd889df9262f0bdcba13c2f46a
SHA512d5ecde7d019a37c660771dd776c9c5c4fd42e15d41e34d5f46d6d0e76aa719228ebbdc6338d3448198b69295b5e19c27a2dbfae007b1a6d5db37ce9e9ba68710
-
Filesize
188B
MD556a8ff5fa18147444c3ed4c2499745d3
SHA10db212029a69f272744c34672998f093adca08aa
SHA2561e13b5b69dc45a9f94d38787be62ab00690c568017270ebebf4d06a09e9a0be6
SHA51268b9b14fe5a8b30227843f573fec49c56f7bd8279ede7258008558ffe89d5e5128d9829736673d1ff4e60919f96ecb6aa1b6c25d56104c821f8d6ec7c58d3259
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Network\TransportSecurity~RFe5bd1b4.TMP
Filesize188B
MD5e93387e2ec37d4482e95761e5abe7b17
SHA1807c3763b50e4d92765fe424f45fb2edb64cea5c
SHA256c6c8484a660e88a9b87cb67715f0bd58ea72b665933df7353f0c2b295dae04d6
SHA51242f170a72657620f3e7f553c91a15c82d4418f56818448a85a1e476ce7df2eaf3d5352b1efa86289d9d0a7ad379ac9df0079fe72c8e0c9e3f2deb99a36d4fac5
-
Filesize
8KB
MD5648960a77d3bd208ebf30927526b3e8d
SHA12a272dec13a2e6638dfbee2a7e5443a2ad4231ad
SHA256c237144a6518ee47acdad8e3fc34758d9358b9fd4ccfe4b1567f3e514e6248b2
SHA51282a63167a12bec6833cc42c306859a3c789011c86bdce3976d64745228f7abae705b8b70f9d1b8e4b55cf31a650d3c499093d158ec359763d39ff9f9ee00410d
-
Filesize
8KB
MD594c7e853097887c43dcc35e45a55e07d
SHA10c5a348f5186012c067bdb78d1279ecc63d924a8
SHA256de75902bd06d374201ff43989e3be34c0d75f05952a094d89c934c2284ef4796
SHA5124b11a32b950fc29ae6a86d7a82983253ccc62e86be484ea5aab5abc8d98771fa7ffd80be290ac256ab450dfa3bec3a29d979182ddfd48bbdaa13252b731d053a
-
Filesize
9KB
MD5a73023c16d3798d4f328c506ce0de29c
SHA14663e885c2a982a075733c43fac6a91e22a92829
SHA256c26ec6a2e46498ad364d55d1e6034281ace0cd0f827b8a233c4aa0985e52c171
SHA51289b834185828eb44686916c8db69a39ed9b0b742453779f500b73e4cbeaf682dc3398dbca985424a8e6e632fb88f1625668e87cf9fffdf7c6f9351fd6ae99358
-
Filesize
4KB
MD5ac474088fd642efa8c08b1f095cd5d65
SHA15a6965fb42704ae52be9e6e508e5d99df8431ef5
SHA256f08f5b28ede8a980596fe6eee9144d27fa1ba61c376cc7244e59774e015b3ada
SHA512bb29bb2b65b406100d0cf1b3de21cbe0e34b8473c3f05cc5d3510eb69c68d56a7bd77121436a9b809f13c7e2acb455db2009eea509c254b0cf83bb916c732623
-
Filesize
8KB
MD5e1e6d5a240b3089fc78168fdf6efd1de
SHA17ca04820930a3e7c19156b8f8d5b1f73cd75f8bf
SHA256ddaf3f13cde5f635203c9de95b9255d6030e7f64509c8966913d068c1c2be25b
SHA5129449604e066562c4c7da42c27b002a88ee3f98d09e9cbbd73ac05debbf79bb3ca12a3e5199a28ac02d3309397b221a5f323dde3a30325d60840b2bbf5164bdbb
-
Filesize
6KB
MD52ff32752934d135579d6e9cf10e934f9
SHA1330562237b07ea9ea59b99c5ba6b4b562159c06a
SHA25650f47172a6d9b852d5921074718a01aca2d276fa040c6d35e50f097b0423e9a8
SHA512616a989190befc954da92e9e4690ac73623fcaf17bac1a37285428495275978c24ae26321aa712b85779b7b0abe8fe3a40acc0a00e480bff7856b4d57275130b
-
Filesize
16KB
MD53cb43dac048fc415d89ead5b9c026415
SHA17507bb72f4bb5604318954a8d383682b7d342541
SHA2565faab4cf10cf0b9da025e7f7214881441fa70eedf0310e6290ad32ae93515306
SHA512b3702646d0ac52055f414c1398418ca6e624210b11f6094dc3cfa6102200ca6875b884368289265dec3314eee1efb38d04f1997d0802bf3119a37498f8bb7d4f
-
Filesize
16KB
MD5ad827967c6caa794be100f0be12b1d6b
SHA1e8516d3619e80f77f0c4e17e3bde4131543f1592
SHA2564bc4fd3d330b32b028dfabe7d9a43724710dfb719ac0eca67c33cb7cfd5240df
SHA512d5cd31c11d1a18e70022e25327bd4802dc56f4828f913aa6638ee146958e0e7de3a3522a9cf1291793b40a2b265b15549f1443afbe9bdc9e7c13dbf80919069c
-
Filesize
26KB
MD5588fe0d9b9d51e56f18e8c14814d00f7
SHA1c067db890f48106a8391ca1346f61897b135fa9b
SHA256d59b6e8133f1f618b8bc06a756ce8491c1561159e2fdca959ee08f674fbfa703
SHA512174a1084ed9690c7f955668f8ae06fa5247b26a46b961925fdc8846bb72f0d6f2cec4f1df39195f68365156a58cd2c4f391763fe89536d067e6dc239160c890a
-
Filesize
14KB
MD538af27aec040f82d291a147c00603a81
SHA1140d9589b779019283bc90e23f661b502c74636c
SHA2564710be68b9ab90d6b3b6039b3403d0d552284d0ff505ec78d74b427097b26cff
SHA512fc348a24e116a047409f659d0bbb24731bfb00b7d934325432a95705cdbbb561750fa471ada5ee9d1f7793194bb1d8fa4f1c156273f11fb9eaa2d03e60645933
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD5cbc03181bf6d308d061ef2ed39652d6f
SHA15c3c4313145ddde59dcd4ce17f292c6ceebe582b
SHA2560e8f3229e288d2bde46e5e7994251ec041501d91709162d5b0f12a60395d9d21
SHA512aa6290e89af7e343b1d21a7b45905069f16c715b237a8f166ab8e8e7437d7d806b5588879d7bb26a5795ee694c90600368693ac35f27fe257e76b1c97946bb33
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c0140.TMP
Filesize72B
MD5d54f3f1004bea94546faa79d42b57f3c
SHA1a65957d1d908bdcbb87bbc83c5395f662f6ffc54
SHA2560c1c97cf1190d4df59227ca41d3ab44dc8b997609e3be452c4fb2fd0d003997c
SHA512ca989d8efc2bff6f805b32f74772fdf7a69fe5f4aeee15d72b7b6a6e1b3c676369244d13cd2609b1438834d4307e70e4a433911f1ac255c81dc47d50001da9f7
-
C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Default\Site Characteristics Database\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
3KB
MD5573e8afb1249ebac7f3c3e77c9bc4f55
SHA10c899e8dcaf720a5f6f414377861f8a60542913f
SHA256477b12452244d135b60d6beb9f6821db20b9baa3718ac379d8a80437abb71b7f
SHA512934e1a09538906ef558851c8d12d19981f045de16ef5efb05ce081ec958d216b032fb869dc82f0a5db4ea7794f575d0dd2bb787d55353d63796c139fcb0d6bdf
-
Filesize
3KB
MD5d3cd017d3f30785a1be5ecd257109a75
SHA160e882ef30b40f18eeec8a25cd1c596ae46e4465
SHA25675f5a08c0e4e08c7485f2ed6f9e99f1bcb7024fd3a26593707bc61683421e04e
SHA512ef2e3bd96dcfb0c1765f2801fdc924fac69f7373ba038744e8ba53128bafad0647ac4cd94d7812279dbdf46f49205ef3308c22a08d1899c5b3a961e5a28f7e00
-
Filesize
3KB
MD550706f0fd942a39a5991815477148648
SHA1363ecd032a63149ac0a4275e4636bde73f40869a
SHA256fc9be171e80e86c221659873ec0ddebeaf3cef7d4a28dbb10ac343640c8caf6f
SHA512593a903df0b58798f176f1a4c18a670b0462ff59b9ee60877265b176f14cc58ea81305bfea148fbf25312657fb4a573c4de4def351f274205bfed2845a72a375
-
Filesize
6KB
MD5a725d733d29389c1d8ee5340bb86c450
SHA11d47665dca7efbbbaf493dfec7c376e0e90ebe85
SHA2569fadaabf398edc240280290b28af8853476e84a3ff19f4eeca722d2f75dfbc5e
SHA51285b8bdaa477f08758594d4ed814e6f08dd919826555e07b0016b22efbde2eddbc94271a3f0869e6619ead6ed1ae93fe4d44ac5ba093d8b432a27f9a9b71535df
-
Filesize
3KB
MD5ac90bb0252f190d733a0d44802972bd2
SHA18f34ef451e919974cfddc5f66a38929544e7406f
SHA2566f34c568e55ff06a5cf49e01a4aa343fbb1a99c771424ef11f8d05d85a85947e
SHA51233a650d4dc4300254156913cbcf7c36452bf5150897b9d347c97730733c1b2c53b2350dd06bc1e419f8659b253a812035a65eaa5429720026b8a1961bde1b28d
-
Filesize
3KB
MD505a4d01d6699c261ff9f25d4ed750de6
SHA1415c658dd02daa0f20c368b8a94ba6e1efc22887
SHA256a8bf01f17bb1f56599f050f6f9d5bad52146e4801e59efc9d3bb8ea11b83c776
SHA512051c9cd87b31fecbde1007d5f51a4e57b9f30fba267003200991cc6be0fc4dfa2ae8ae3d896cae61b4914c772153587bd08992d06135667a443c9744ec57ec7b
-
Filesize
1KB
MD5e6b488a28fe325d2c7b7c070bab24b8c
SHA1160ab6d95cfaac6d7f0200b670541fccdb412223
SHA2567a47157d65c513ee6a625f1854ec48764dfe252af5474d79c0a64012a31ec45a
SHA51289c9c985f0d2c4dc35ad46b97063fcbdd067fee008b329430cba1951fd51fa9a4f9d9fcb75ff78b10d04599483b9a8fe286df458f6a63d7a82cc0a87e20a3f11
-
Filesize
2.8MB
MD5db9caa5e33f6fd038e432d2b1cbe7175
SHA12b23e91c9463a74e26c1ff9b8640a22cc6f18af7
SHA25657018fb5fba3de2db3e613140a3847068ab680a45cb4dcc4291bcff6117a06a8
SHA512d70e008c5fe4b443ec822259e9114aaccf283a3f979b8ef2de174dcbf4935525a81428eb3b7cf0d22495bce439257b6ee36f66d33ae5fec6da46314c167c719f
-
Filesize
3.1MB
MD5dcfac8ebda720c56524614a57b325795
SHA1b8f8d9db41e8e795fb5fc442d3beea3d24e4bf11
SHA2560ffe299b4efa9c54b32cb86ee20ded9ab3154dda2800a0e35d944eb33aa3c3c1
SHA5129f4654b99714f105a870ddac95c5cb62f9f0c0ece0df6d7556311bb432329c956c021349d4c36ef8f8160f936c5774bbd6ff83285a0a3cb2e373002a84f91206
-
Filesize
1.3MB
MD53b61ef97ab41ba28cc1bc2760d4611b4
SHA1a7398b2aef941af4516b5c30b0eaf4cac0500a1d
SHA256b37f40e960029a833673ab28188bc4f38c3705baf1970c42cf686ac1b5059124
SHA5129fac361ff6ff5248237cab73527a6d36bc30c1473ab253e4c1b76e1b3b28ec56145bd5c2ca62c99abb653aa47ebdbd6faee397f581955320729dffbb072802e0
-
Filesize
2.8MB
MD5a5b89fd877f0371d8ba5c64753364409
SHA19d1bbdf1eb2793e9a1d3dc5971d20698aefd8998
SHA256f447fe42a51ca2204b62388624dab97ac001c58f17c48fb04148601e43585c9a
SHA51297f44e4517955fe555e19f253e41e89faa8512aa8d101b901806fd9085446f5e9dbfc106a87e535395f9f870e1385a148e6404c856920618452940d196d61ac2
-
Filesize
841KB
MD593b98f82cbdcb70deb4d8d18f7fd7fdf
SHA1833d146d2f744a63e670a482acc83e983c2bde11
SHA25683a7d8931be107545ff0353aabab16973dac2560a280020c9e582d0bf15bab56
SHA512685cfca56add2643d5797d0deceeac5fd5bb4d6aff03c679636f00f093ecdd4b280632913ade569198d05f12223b229aaba4b9f859ca2fcdf531c18c9f73d591
-
Filesize
5.8MB
MD51deb81b483e500b96aabc4c8761e642e
SHA1389a03ce92bd5869f24caccae43855331b4a9800
SHA2567a48d929d17de49160db68b3be58aba7d354f73f7292125adbb024bcd65d82c5
SHA512703eb1e3cad9349e1772d552b30e69ce07b3fb80b78311c0f698a79ca7cfb04d424bda1b722f4d8c586d9862ed56e1c2b99cd2d7df64509d3d66d1862e9ed936
-
Filesize
5.8MB
MD51deb81b483e500b96aabc4c8761e642e
SHA1389a03ce92bd5869f24caccae43855331b4a9800
SHA2567a48d929d17de49160db68b3be58aba7d354f73f7292125adbb024bcd65d82c5
SHA512703eb1e3cad9349e1772d552b30e69ce07b3fb80b78311c0f698a79ca7cfb04d424bda1b722f4d8c586d9862ed56e1c2b99cd2d7df64509d3d66d1862e9ed936
-
Filesize
44B
MD52ec65a257499e518b624e07fa5a6bec7
SHA16fda961264c69d30c1db21e72d07c4cc7c73ffb5
SHA256fac1758f6f77b68e6590cb530c84091c308b96475118bf9c0f9d9aead73f7d7d
SHA512b56cd3ba7c5a16fa736c2b746854024fd18b83ef64be3b9aa2a1c1b370e33837d44d9373522ea8f465a6e46c522ae589cd936d74151abda577749e982841a734
-
Filesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
26KB
MD581cd20ec0ef548964b8cc25c959633e8
SHA13a2b113fde85bf599aa5636d1024042e721d1d88
SHA25694b950cc656333930f6bd95ee474dbd067b9a0840677fdee8c53f7d738656a6b
SHA5121e571eb53ccc72d40dc44b46d4d110c4e79460b2ea198f8d739ce7057b114c4ad56332729283f0beb4694a94ba59732768d7de11487ab25109c365e2b6873361
-
Filesize
1.6MB
MD5aa47427ef91955ca851284c59d32b29b
SHA148629191e099df41a0cb750b6ff0701fc0e07346
SHA256d54f5d408a4a2d3b80dff71af9534d2119cf5284bd3ffb67ef48ac75419e5436
SHA5125fdb16f918cb6bfea8b3b80dd3282c2f02f50f1710df6d9dfbdbfc7124df331ead05a3ec2fff1857d18559dbeb20bded5fda80c0e3ef38ea3bb359c28ca3f917
-
Filesize
1.6MB
MD5aa47427ef91955ca851284c59d32b29b
SHA148629191e099df41a0cb750b6ff0701fc0e07346
SHA256d54f5d408a4a2d3b80dff71af9534d2119cf5284bd3ffb67ef48ac75419e5436
SHA5125fdb16f918cb6bfea8b3b80dd3282c2f02f50f1710df6d9dfbdbfc7124df331ead05a3ec2fff1857d18559dbeb20bded5fda80c0e3ef38ea3bb359c28ca3f917
-
Filesize
1.6MB
MD5aa47427ef91955ca851284c59d32b29b
SHA148629191e099df41a0cb750b6ff0701fc0e07346
SHA256d54f5d408a4a2d3b80dff71af9534d2119cf5284bd3ffb67ef48ac75419e5436
SHA5125fdb16f918cb6bfea8b3b80dd3282c2f02f50f1710df6d9dfbdbfc7124df331ead05a3ec2fff1857d18559dbeb20bded5fda80c0e3ef38ea3bb359c28ca3f917
-
Filesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
Filesize
124KB
MD59618e15b04a4ddb39ed6c496575f6f95
SHA11c28f8750e5555776b3c80b187c5d15a443a7412
SHA256a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
-
Filesize
2.1MB
MD504091b9dc274a8aeceaa250d9d5aed4e
SHA139a8988a05b866ec3505be1650e521d2b3e71c1b
SHA256dd54abccddbfdf9ad318f2434ea61fe16c446b0e0eb1b86f6f06124c6e3708eb
SHA5127b2fc948b84d71f39b124690eb9fc4110d49b9750874171be634f39b747613e3380d4ff3968dae26eac127b66838f09781f8716549cc74046a36f9c8c5e8008b
-
Filesize
2.1MB
MD504091b9dc274a8aeceaa250d9d5aed4e
SHA139a8988a05b866ec3505be1650e521d2b3e71c1b
SHA256dd54abccddbfdf9ad318f2434ea61fe16c446b0e0eb1b86f6f06124c6e3708eb
SHA5127b2fc948b84d71f39b124690eb9fc4110d49b9750874171be634f39b747613e3380d4ff3968dae26eac127b66838f09781f8716549cc74046a36f9c8c5e8008b
-
Filesize
126KB
MD526ae155bc699bb8d535006d9889366ec
SHA147990e176505ba8fe8c9aa43018c71ce84702ed8
SHA2567fd5d84381997482870359c50f43eeb52228ae3f75311405c6e80fb79203aea9
SHA51203a21e68b8c5d5e2206bcd4b2795b6fabda9b6bafe5339f213dcfe7297a557cde93b85321f0fdc7b14fb7c602b71d8e0673c326994a43e72e6cab532843a7161
-
Filesize
126KB
MD526ae155bc699bb8d535006d9889366ec
SHA147990e176505ba8fe8c9aa43018c71ce84702ed8
SHA2567fd5d84381997482870359c50f43eeb52228ae3f75311405c6e80fb79203aea9
SHA51203a21e68b8c5d5e2206bcd4b2795b6fabda9b6bafe5339f213dcfe7297a557cde93b85321f0fdc7b14fb7c602b71d8e0673c326994a43e72e6cab532843a7161
-
Filesize
126KB
MD526ae155bc699bb8d535006d9889366ec
SHA147990e176505ba8fe8c9aa43018c71ce84702ed8
SHA2567fd5d84381997482870359c50f43eeb52228ae3f75311405c6e80fb79203aea9
SHA51203a21e68b8c5d5e2206bcd4b2795b6fabda9b6bafe5339f213dcfe7297a557cde93b85321f0fdc7b14fb7c602b71d8e0673c326994a43e72e6cab532843a7161
-
Filesize
195KB
MD5f6e528af6e8b1e819c5c9f8138d38098
SHA1f4e3e035648be7711aade5d1ae594d1069efd816
SHA256e0922e33fdbc433e36fa069791b6ced6e8d3177544b1331bd0e181ad600c628e
SHA512389bed7716d725f598a85f5e8a3806a351c40992dd5ed9bc1c4e4450b150d0d74f28df61d7cb0cbf6ebf681f49a454f9b04aec86a88fac9b7a33e6cdf964bb48
-
Filesize
195KB
MD5f6e528af6e8b1e819c5c9f8138d38098
SHA1f4e3e035648be7711aade5d1ae594d1069efd816
SHA256e0922e33fdbc433e36fa069791b6ced6e8d3177544b1331bd0e181ad600c628e
SHA512389bed7716d725f598a85f5e8a3806a351c40992dd5ed9bc1c4e4450b150d0d74f28df61d7cb0cbf6ebf681f49a454f9b04aec86a88fac9b7a33e6cdf964bb48
-
Filesize
127KB
MD56b740d7060e09cfee3523704436ba00f
SHA1f369460d22992b8a468f08fc19f208de52e2cb18
SHA25665c041a218bf05cfe824ebc155b4bf5749b3a2eca84be5e8f092927f09152b1b
SHA5122c0cf9c8470d70a381c8ee0c09c81a6a643123c8bd96a5b32eaabf368d347cbd2eb771488a7ea150bd817b8fd2cc5b8ac84dd81830e5e6e31b9f01bc4ae50486
-
Filesize
127KB
MD56b740d7060e09cfee3523704436ba00f
SHA1f369460d22992b8a468f08fc19f208de52e2cb18
SHA25665c041a218bf05cfe824ebc155b4bf5749b3a2eca84be5e8f092927f09152b1b
SHA5122c0cf9c8470d70a381c8ee0c09c81a6a643123c8bd96a5b32eaabf368d347cbd2eb771488a7ea150bd817b8fd2cc5b8ac84dd81830e5e6e31b9f01bc4ae50486
-
Filesize
36KB
MD50acda819bacbed7d368f036847960ae3
SHA18a4367182e41076e28870ef60efa8630ecdf846c
SHA2562508170aa8ed183c2dba984cb22c0d622359963b4ee0099c734875b862b17800
SHA512d501737aa62fae54552f382ab87e749ef9f3bc1349fd0945fa3eca9ebbcd6c690961a5f764aafe994f396bc303fa44d9670969b84810fa5fcadd1a20a469d321
-
Filesize
36KB
MD50acda819bacbed7d368f036847960ae3
SHA18a4367182e41076e28870ef60efa8630ecdf846c
SHA2562508170aa8ed183c2dba984cb22c0d622359963b4ee0099c734875b862b17800
SHA512d501737aa62fae54552f382ab87e749ef9f3bc1349fd0945fa3eca9ebbcd6c690961a5f764aafe994f396bc303fa44d9670969b84810fa5fcadd1a20a469d321
-
Filesize
93KB
MD53f2dd5b3899d0abf2ed4e7749d85900a
SHA1682f8f786422a25ab5f525fb1d30928ab3f094c7
SHA2566d81bd6f69d6005d0ebeea74ff185842dfd1df5ec1c84304370b88bde38da497
SHA5123474a8e6d9550dff4b75af772248b2f48a95820554d10f27ac9dbc9178c659d8f7fde4ecfec26f648d5a93bdac3ec838b8ff581fb65f36d5b9e2475b16f659c1
-
Filesize
93KB
MD53f2dd5b3899d0abf2ed4e7749d85900a
SHA1682f8f786422a25ab5f525fb1d30928ab3f094c7
SHA2566d81bd6f69d6005d0ebeea74ff185842dfd1df5ec1c84304370b88bde38da497
SHA5123474a8e6d9550dff4b75af772248b2f48a95820554d10f27ac9dbc9178c659d8f7fde4ecfec26f648d5a93bdac3ec838b8ff581fb65f36d5b9e2475b16f659c1
-
Filesize
2.1MB
MD504091b9dc274a8aeceaa250d9d5aed4e
SHA139a8988a05b866ec3505be1650e521d2b3e71c1b
SHA256dd54abccddbfdf9ad318f2434ea61fe16c446b0e0eb1b86f6f06124c6e3708eb
SHA5127b2fc948b84d71f39b124690eb9fc4110d49b9750874171be634f39b747613e3380d4ff3968dae26eac127b66838f09781f8716549cc74046a36f9c8c5e8008b
-
Filesize
195KB
MD5f6e528af6e8b1e819c5c9f8138d38098
SHA1f4e3e035648be7711aade5d1ae594d1069efd816
SHA256e0922e33fdbc433e36fa069791b6ced6e8d3177544b1331bd0e181ad600c628e
SHA512389bed7716d725f598a85f5e8a3806a351c40992dd5ed9bc1c4e4450b150d0d74f28df61d7cb0cbf6ebf681f49a454f9b04aec86a88fac9b7a33e6cdf964bb48
-
Filesize
127KB
MD56b740d7060e09cfee3523704436ba00f
SHA1f369460d22992b8a468f08fc19f208de52e2cb18
SHA25665c041a218bf05cfe824ebc155b4bf5749b3a2eca84be5e8f092927f09152b1b
SHA5122c0cf9c8470d70a381c8ee0c09c81a6a643123c8bd96a5b32eaabf368d347cbd2eb771488a7ea150bd817b8fd2cc5b8ac84dd81830e5e6e31b9f01bc4ae50486
-
Filesize
36KB
MD50acda819bacbed7d368f036847960ae3
SHA18a4367182e41076e28870ef60efa8630ecdf846c
SHA2562508170aa8ed183c2dba984cb22c0d622359963b4ee0099c734875b862b17800
SHA512d501737aa62fae54552f382ab87e749ef9f3bc1349fd0945fa3eca9ebbcd6c690961a5f764aafe994f396bc303fa44d9670969b84810fa5fcadd1a20a469d321
-
Filesize
1.4MB
MD55512238e49f6b28cf07344bc0145090e
SHA1d9062c6611c4fb51e13b7ff59c17e00b0ace981a
SHA2568f4beddf28c2680def9bfef0ea20b5440bd9f296b5540c2d1ca4a395077d15f4
SHA512763bb0fe18eef1c7bd0dab088d06d3dba257c8d39bc4025fbcd67cb98b517fb3b498fd94136d4cd467ac270638242ed27c8089c7afb4031e4b2c80886c1dfd12
-
Filesize
93KB
MD53f2dd5b3899d0abf2ed4e7749d85900a
SHA1682f8f786422a25ab5f525fb1d30928ab3f094c7
SHA2566d81bd6f69d6005d0ebeea74ff185842dfd1df5ec1c84304370b88bde38da497
SHA5123474a8e6d9550dff4b75af772248b2f48a95820554d10f27ac9dbc9178c659d8f7fde4ecfec26f648d5a93bdac3ec838b8ff581fb65f36d5b9e2475b16f659c1
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2680_1987480925\3733a2ba-fb45-43c3-87ed-96f5831f7311.tmp
Filesize85KB
MD559a39635945da117f76a1b9017c6c106
SHA1553248b89ec725e74c9bcb52a18cad152948049a
SHA256bd1ee6dcdfb4315efe162991159904eb185b27134601cde77092b17596bdf431
SHA512a9c2f0e07002c97869da4ef6ed71862e8d1e0d9fb06e446368b45120c279ee089f1bd282660eb994a8f3c596f9a37cde852878e63cbf10bca206d76858e1addc
-
Filesize
3KB
MD575e461d8925e8468b3994dc838bfb68d
SHA140a05fdacfcc9f153cd3df62a95c75fe148fc0fe
SHA256fef31cd788c1845647cb739db304cb65fa21129a93500f51d8865ce52f75a0d3
SHA512880c83b8414bd441d20d61360b7018b4f6fcb68c2affd8b1e32b1d9317e86dda8f9eba925df31b552011d5158eee2f30970756b26b2e77f3cb91ae35c8c37cc0
-
Filesize
6KB
MD52ee58c8732aea4203ecb92e16e5ac68c
SHA1f8cff9d53e57833e10ad2cb2489fb75a57ea7003
SHA256cbd20bdea1a73d4cc506fbafb729d201d01fa08f1884f4495289672f34f398c8
SHA512f6deeb2e330be99e4d5ac63625f7b7f2a052ef2f778c99657714245e9b2ad912dae5029e8dfcd5affc13bc4c892d4ea508db471f009d6c550030c477ee98d87d
-
Filesize
428B
MD5ff713828113f6377533d41a36bff5ebd
SHA17157c2333be0a6df2db2dc0c25d36738acc823f4
SHA25660657bad3b62a195d588178203e25df302ecdb8b51fcc49cc4f628aed8998dfb
SHA512b55bd6b59b57003785db6a8f7e0f46b2ff4db619b4ea143c09f1e456ff1c5efffa46226984849cd8da98f48c06a79a4d00edccba3b7e1d4423e448f1be001113
-
Filesize
6KB
MD59764406c182b5e377dc9e8023968e82e
SHA153999b0d5620d8e80f357edf7230560feec1d40b
SHA256d8254fc7b70c9f3f5e16176f6bfba0fabf44e10de59b4a32ad53a5fcabf15b2c
SHA5125b6595aec0cf73c52bb74f5b97ed92cb21fa68649911027328dfd89a0445d03bf26322fc98e410f9eaa748c01128058dfa55ae912ea5b6db6a73a433327efc8b
-
Filesize
19KB
MD5b382e5f2a1c1821512f9ccdb6b8f72c8
SHA175c4a8cdf200b60710ba705150861f4d083ee33c
SHA256a834a7075ce16c5383c604195bfe0e58e6d5763238438ea4ebfb5a45f8d2ad59
SHA5120a892a1b259c94d0a98c5ab2c84a402eb5240dd67c42df61d6d7edf2930424316b1ab6667cd69bf0ffe65ce0db772bbdfbca1037aad36238ad5d01f058f993b0
-
Filesize
5.7MB
MD5f36f05628b515262db197b15c7065b40
SHA174a8005379f26dd0de952acab4e3fc5459cde243
SHA25667abd9e211b354fa222e7926c2876c4b3a7aca239c0af47c756ee1b6db6e6d31
SHA512280390b1cf1b6b1e75eaa157adaf89135963d366b48686d48921a654527f9c1505c195ca1fc16dc85b8f13b2994841ca7877a63af708883418a1d588afa3dbe8
-
Filesize
5.7MB
MD5f36f05628b515262db197b15c7065b40
SHA174a8005379f26dd0de952acab4e3fc5459cde243
SHA25667abd9e211b354fa222e7926c2876c4b3a7aca239c0af47c756ee1b6db6e6d31
SHA512280390b1cf1b6b1e75eaa157adaf89135963d366b48686d48921a654527f9c1505c195ca1fc16dc85b8f13b2994841ca7877a63af708883418a1d588afa3dbe8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Avast Secure Browser.lnk
Filesize2KB
MD53b6ce0016362f55b573f4a00c778f6ef
SHA1df26539ec27f94d2cb04527cdde13bd6bc7af245
SHA256446547856699c77cca29bae3217d3a1cf67660d8b0c223dcffd7197e087a7e96
SHA512abae61980e71fc76224cab6ccf765ad365104ca2600f9584cdc0c623f306b45a969ab6ee5a03887a476df99c8e0133a9b93e325f0958c6d55ad52c5ecadef3dc
-
Filesize
32KB
MD5ef1c6be2e8262f676dbf8609e5a2704a
SHA1fe2c19a070749465b5e1bb2d3c14af29004cf34b
SHA256283626acb52e60c9b06d2a5c1a115c2c07dec6ad3fa6eab4f0f243c5287e3018
SHA512f87396d25add33d31ae3524f98f219df097ebef50e0c17611c88a041eb39f737895144173783d017a5afd5a53e151771516e12f15c0367517911528e2d8df399