Analysis
- max time kernel
261s - max time network
263s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
17/02/2024, 15:22
Errors
General
- Target SecuriteInfo.com.Adware.Downware.20091.25676.15900.exe
- Size 1.7MB
- Sample240217-ssaymsgb5v
- SHA256 f72ee83436cb1f82366bfaafb14a4c0cb99826c02166fc0bd21fb6e7eb5190c6
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Creates new service(s) 1 TTPs
- Drops file in Drivers directory 33 IoCs
- Sets service image path in registry 2 TTPs 32 IoCs
- Uses Session Manager for persistence 2 TTPs 8 IoCs
Creates Session Manager registry key to run executable early in system boot.
- Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 4 IoCs
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks for any installed AV software in registry 1 TTPs 63 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Downloads MZ/PE file
- Modifies Installed Components in the registry 2 TTPs 7 IoCs
- Sets file execution options in registry 2 TTPs 2 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 26 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Checks computer location settings 2 TTPs 36 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory 8 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 5 IoCs
- Executes dropped EXE 64 IoCs
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Loads dropped DLL 64 IoCs
- Registers COM server for autorun 1 TTPs 58 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 35 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies Internet Explorer settings 1 TTPs 16 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 48 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 20 IoCs
- Suspicious use of SendNotifyMessage 12 IoCs
- Suspicious use of SetWindowsHookEx 33 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.Downware.20091.25676.15900.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.Downware.20091.25676.15900.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1KHBG.tmp\SecuriteInfo.com.Adware.Downware.20091.25676.15900.tmp"C:\Users\Admin\AppData\Local\Temp\is-1KHBG.tmp\SecuriteInfo.com.Adware.Downware.20091.25676.15900.tmp" /SL5="$50066,875149,815616,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.Downware.20091.25676.15900.exe"2⤵
- Checks for any installed AV software in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SF0B2.tmp\prod0_extract\saBSI.exe"C:\Users\Admin\AppData\Local\Temp\is-SF0B2.tmp\prod0_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe"C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91082 PaidDistribution=true saBsiVersion=4.1.1.818 CountryCode=GB /no_self_update4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe"C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade5⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\McAfee\Temp1960374124\installer.exe"C:\Program Files\McAfee\Temp1960374124\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade6⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\sc.exesc.exe create "McAfee WebAdvisor" binPath= "\"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe\"" start= auto DisplayName= "McAfee WebAdvisor"7⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"8⤵
- Loads dropped DLL
-
-
-
C:\Windows\SYSTEM32\sc.exesc.exe description "McAfee WebAdvisor" "McAfee WebAdvisor Service"7⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
C:\Windows\SYSTEM32\sc.exesc.exe failure "McAfee WebAdvisor" reset= 3600 actions= restart/1/restart/1000/restart/3000/restart/30000/restart/1800000//07⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc.exe start "McAfee WebAdvisor"7⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"7⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"8⤵
- Loads dropped DLL
-
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-SF0B2.tmp\prod1_extract\avg_secure_browser_setup.exe"C:\Users\Admin\AppData\Local\Temp\is-SF0B2.tmp\prod1_extract\avg_secure_browser_setup.exe" /s /run_source=avg_ads_is_control /is_pixel_psh=BjYV6dEwQNU93tDtyIoUcs6sK0GR1FZ51jLxN40ChS8SK0uiLZckEycLCTn4NuRB2UTLfE7Zd1PlLmF /make-default3⤵
- Checks BIOS information in registry
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsyDD8.tmp\AVGBrowserUpdateSetup.exeAVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9230&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --reset-default-win10 --auto-import-data%3Dmsedge --import-cookies --auto-launch-chrome"4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\GUM1807.tmp\AVGBrowserUpdate.exe"C:\Program Files (x86)\GUM1807.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9230&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --reset-default-win10 --auto-import-data%3Dmsedge --import-cookies --auto-launch-chrome"5⤵
- Sets file execution options in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY1MC41IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY1MC41IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0ie0YzNjRDMzhCLUMxQUYtNDVGMS1CNjdBLTFERjYyMTA1RDk1Qn0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9Ins1MzYwMEIyQy0yQzVELTQ0RDQtQUY1MC00MzlCQjU2NjEzNEN9IiB1c2VyaWRfZGF0ZT0iMjAyNDAyMTciIG1hY2hpbmVpZD0iezAwMDA1OEQ0LUIyN0EtMDEyQi05RTNFLTQ1NDE0NzFFNkM2OX0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDIxNyIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9InsxMEFDMTY3Ny00QzVELTQwODgtOTI2My03MDYzQTQzOUJCRDN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjUwLjUiIGxhbmc9ImVuLVVTIiBicmFuZD0iOTIzMCIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iODYwIi8-PC9hcHA-PC9yZXF1ZXN0Pg6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9230&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --reset-default-win10 --auto-import-data%3Dmsedge --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{F364C38B-C1AF-45F1-B67A-1DF62105D95B}" /silent6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --heartbeat --install --create-profile4⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2024 --field-trial-handle=2028,i,4034766957093773936,3586245274669209683,262144 --variations-seed-version /prefetch:25⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2664 --field-trial-handle=2028,i,4034766957093773936,3586245274669209683,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2424 --field-trial-handle=2028,i,4034766957093773936,3586245274669209683,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3388 --field-trial-handle=2028,i,4034766957093773936,3586245274669209683,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3224 --field-trial-handle=2028,i,4034766957093773936,3586245274669209683,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3760 --field-trial-handle=2028,i,4034766957093773936,3586245274669209683,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3784 --field-trial-handle=2028,i,4034766957093773936,3586245274669209683,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4284 --field-trial-handle=2028,i,4034766957093773936,3586245274669209683,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4560 --field-trial-handle=2028,i,4034766957093773936,3586245274669209683,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4596 --field-trial-handle=2028,i,4034766957093773936,3586245274669209683,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --silent-launch4⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=121.0.23861.160 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffebef03c80,0x7ffebef03c8c,0x7ffebef03c985⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2176 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:25⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2540 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2568 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3380 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3788 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4352 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4464 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --enable-protect5⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=121.0.23861.160 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffebef03c80,0x7ffebef03c8c,0x7ffebef03c986⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe"C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe" --registration reg-task --taskintr PT10M --runonce6⤵
- Executes dropped EXE
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4344 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4632 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4428 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5204 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5368 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5512 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5192 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5780 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5356 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6052 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6208 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6352 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6036 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6604 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6744 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=7012 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7040 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6496 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7308 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7436 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7584 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7736 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7884 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7744 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8140 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8284 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8432 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8428 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=8460 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6784 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=6796 --field-trial-handle=2180,i,17231662342271307282,10937337820780956050,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
-
C:\Program Files\AVG\Browser\Application\121.0.23861.160\Installer\setup.exesetup.exe /silent --create-shortcuts=0 --install-level=1 --system-level4⤵
-
C:\Program Files\AVG\Browser\Application\121.0.23861.160\Installer\setup.exe"C:\Program Files\AVG\Browser\Application\121.0.23861.160\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=121.0.23861.160 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ff635441500,0x7ff63544150c,0x7ff6354415185⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 taskbarpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"5⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"5⤵
- Checks computer location settings
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --check-run=src=installer4⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=121.0.23861.160 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffebef03c80,0x7ffebef03c8c,0x7ffebef03c985⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2260 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2580 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3208 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3368 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4500 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4680 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4832 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5024 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"5⤵
- Checks computer location settings
- Modifies registry class
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5504 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"5⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5748 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5816 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --enable-protect5⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=121.0.23861.160 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffebef03c80,0x7ffebef03c8c,0x7ffebef03c986⤵
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=6228 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5800 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"5⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=6500 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"5⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"5⤵
- Checks computer location settings
- Checks processor information in registry
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=6404 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe"5⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6424 --field-trial-handle=2264,i,3676469946235568179,8366073801933308543,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-SF0B2.tmp\prod2_extract\avg_antivirus_free_setup.exe"C:\Users\Admin\AppData\Local\Temp\is-SF0B2.tmp\prod2_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTu5f8VlLZhNjJqkrlmof7VDRHnE2QbD3QcRlhzXmkRX6jmDRcLpLhpCwj28Y2M82YngoIRHpCqR3⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\asw.29f2ebc930e537ff\avg_antivirus_free_online_setup.exe"C:\Windows\Temp\asw.29f2ebc930e537ff\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTu5f8VlLZhNjJqkrlmof7VDRHnE2QbD3QcRlhzXmkRX6jmDRcLpLhpCwj28Y2M82YngoIRHpCqR /cookie:mmm_irs_ppi_902_451_o /ga_clientid:c3f2a329-959d-44ea-a306-e341acf4dd9a /edat_dir:C:\Windows\Temp\asw.29f2ebc930e537ff4⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\asw-9218aa1e-7421-4189-8863-b7b89b006be7\common\icarus.exeC:\Windows\Temp\asw-9218aa1e-7421-4189-8863-b7b89b006be7\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-9218aa1e-7421-4189-8863-b7b89b006be7\icarus-info.xml /install /silent /ws /psh:92pTu5f8VlLZhNjJqkrlmof7VDRHnE2QbD3QcRlhzXmkRX6jmDRcLpLhpCwj28Y2M82YngoIRHpCqR /cookie:mmm_irs_ppi_902_451_o /track-guid:c3f2a329-959d-44ea-a306-e341acf4dd9a /edat_dir:C:\Windows\Temp\asw.29f2ebc930e537ff5⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\asw-9218aa1e-7421-4189-8863-b7b89b006be7\avg-av\icarus.exeC:\Windows\Temp\asw-9218aa1e-7421-4189-8863-b7b89b006be7\avg-av\icarus.exe /silent /ws /psh:92pTu5f8VlLZhNjJqkrlmof7VDRHnE2QbD3QcRlhzXmkRX6jmDRcLpLhpCwj28Y2M82YngoIRHpCqR /cookie:mmm_irs_ppi_902_451_o /track-guid:c3f2a329-959d-44ea-a306-e341acf4dd9a /edat_dir:C:\Windows\Temp\asw.29f2ebc930e537ff /er_master:master_ep_f641fbe7-ffe2-427a-b13a-29a5a3183bea /er_ui:ui_ep_89ae185b-fae9-4165-a242-211a8ad3cd6f /er_slave:avg-av_slave_ep_608e3770-e6ce-4f8d-928d-02636efcc28d /slave:avg-av6⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Uses Session Manager for persistence
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:sw_avgNdis7⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:avgNdisFlt /catalog:avgNdisFlt.cat7⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRdr2.cat7⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgHwid.cat7⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgVmm.cat7⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRvrt.cat7⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer /reg7⤵
- Checks for any installed AV software in registry
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer7⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"7⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\aswAMSI.dll"7⤵
- Checks for any installed AV software in registry
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\asOutExt.dll"7⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Modifies registry class
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\asOutExt.dll"7⤵
- Checks for any installed AV software in registry
- Registers COM server for autorun
- Checks processor information in registry
- Modifies registry class
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /catinstall:"C:\Program Files\AVG\Antivirus\crts.cat" /basename:pkg_{af98c830-528a-46b9-a60e-2db5d9a76b77}.cat /crtid:E89476E7569FC7413EA11A4461D6E3E784B8B6997⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\wsc_proxy.exe"C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /svc /register /ppl_svc7⤵
- Checks for any installed AV software in registry
-
C:\Program Files\AVG\Antivirus\avDump.exe"C:\Program Files\AVG\Antivirus\avDump.exe" --pid 6392 --exception_ptr 00000024291DE5F0 --thread_id 7024 --dump_level 0 --handle_data 1 --dump_file "C:\ProgramData\AVG\Antivirus\log\unp310890772750047119x-manual.mdmp" --comment "Cause: VectoredExceptionHandler" --min_interval 608⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
-
-
C:\Program Files\Common Files\AVG\Overseer\overseer.exe"C:\Program Files\Common Files\AVG\Overseer\overseer.exe" /skip_uptime /skip_remediations7⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\Program Files\AVG\Antivirus\defs\24021702\engsup.exe"C:\Program Files\AVG\Antivirus\defs\24021702\engsup.exe" /avg /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie7⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
-
C:\Windows\Temp\asw-9218aa1e-7421-4189-8863-b7b89b006be7\avg-av-vps\icarus.exeC:\Windows\Temp\asw-9218aa1e-7421-4189-8863-b7b89b006be7\avg-av-vps\icarus.exe /silent /ws /psh:92pTu5f8VlLZhNjJqkrlmof7VDRHnE2QbD3QcRlhzXmkRX6jmDRcLpLhpCwj28Y2M82YngoIRHpCqR /cookie:mmm_irs_ppi_902_451_o /track-guid:c3f2a329-959d-44ea-a306-e341acf4dd9a /edat_dir:C:\Windows\Temp\asw.29f2ebc930e537ff /er_master:master_ep_f641fbe7-ffe2-427a-b13a-29a5a3183bea /er_ui:ui_ep_89ae185b-fae9-4165-a242-211a8ad3cd6f /er_slave:avg-av-vps_slave_ep_cf7226bc-edfa-4300-9e03-908ace6be370 /slave:avg-av-vps6⤵
- Uses Session Manager for persistence
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\AVG\Antivirus\defs\24021702\engsup.exe"C:\Program Files\AVG\Antivirus\defs\24021702\engsup.exe" /prepare_definitions_folder7⤵
- Drops file in Drivers directory
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{1476653C-0325-4D05-A64D-349291FADD03}\AVGBrowserInstaller.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{1476653C-0325-4D05-A64D-349291FADD03}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --reset-default-win10 --auto-import-data=msedge --import-cookies --auto-launch-chrome --system-level2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{1476653C-0325-4D05-A64D-349291FADD03}\CR_2F4B5.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{1476653C-0325-4D05-A64D-349291FADD03}\CR_2F4B5.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{1476653C-0325-4D05-A64D-349291FADD03}\CR_2F4B5.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --reset-default-win10 --auto-import-data=msedge --import-cookies --auto-launch-chrome --system-level3⤵
- Modifies Installed Components in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{1476653C-0325-4D05-A64D-349291FADD03}\CR_2F4B5.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{1476653C-0325-4D05-A64D-349291FADD03}\CR_2F4B5.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=121.0.23861.160 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ff611561500,0x7ff61156150c,0x7ff6115615184⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\McAfee\WebAdvisor\UIHost.exe"C:\Program Files\McAfee\WebAdvisor\UIHost.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=121.0.23861.160 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffebef03c80,0x7ffebef03c8c,0x7ffebef03c981⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\AVG\Browser\Application\121.0.23861.160\elevation_service.exe"C:\Program Files\AVG\Browser\Application\121.0.23861.160\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\121.0.23861.160\elevation_service.exe"C:\Program Files\AVG\Browser\Application\121.0.23861.160\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Program Files\AVG\Browser\Application\121.0.23861.160\elevation_service.exe"C:\Program Files\AVG\Browser\Application\121.0.23861.160\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\121.0.23861.160\elevation_service.exe"C:\Program Files\AVG\Browser\Application\121.0.23861.160\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\AVG\Browser\Application\121.0.23861.160\elevation_service.exe"C:\Program Files\AVG\Browser\Application\121.0.23861.160\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Browser\Application\121.0.23861.160\elevation_service.exe"C:\Program Files\AVG\Browser\Application\121.0.23861.160\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" /silent_welcome1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=gpu-process --field-trial-handle=9256,6585471518921552806,12869747041434066462,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,ForcedColors,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --no-sandbox --disable-gpu-driver-bug-workarounds --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=disable --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --proxy-auto-detect --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --gpu-preferences=SAAAAAAAAADgAABwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --mojo-platform-channel-handle=9276 /prefetch:22⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=9256,6585471518921552806,12869747041434066462,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,ForcedColors,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=none --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=disable --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --proxy-auto-detect --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --mojo-platform-channel-handle=9604 /prefetch:82⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=9256,6585471518921552806,12869747041434066462,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,ForcedColors,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=utility --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=disable --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --proxy-auto-detect --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --mojo-platform-channel-handle=9564 /prefetch:82⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --field-trial-handle=9256,6585471518921552806,12869747041434066462,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,ForcedColors,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=disable --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --proxy-auto-detect --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=9556 /prefetch:12⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\avg_antivirus_free_setup.exe"C:\Users\Admin\Desktop\avg_antivirus_free_setup.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw.75eb17459e314e5f\avg_antivirus_free_online_setup.exe"C:\Windows\Temp\asw.75eb17459e314e5f\avg_antivirus_free_online_setup.exe" /cookie:mmm_irs_ppi_902_451_o /ga_clientid:66f21053-5798-4644-96fe-683f01a94990 /edat_dir:C:\Windows\Temp\asw.75eb17459e314e5f2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw-ab830aa0-047f-442e-8946-b59c62a60f30\common\icarus.exeC:\Windows\Temp\asw-ab830aa0-047f-442e-8946-b59c62a60f30\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-ab830aa0-047f-442e-8946-b59c62a60f30\icarus-info.xml /install /cookie:mmm_irs_ppi_902_451_o /track-guid:66f21053-5798-4644-96fe-683f01a94990 /edat_dir:C:\Windows\Temp\asw.75eb17459e314e5f /sssid:21683⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw-ab830aa0-047f-442e-8946-b59c62a60f30\common\icarus_ui.exeC:\Windows\Temp\asw-ab830aa0-047f-442e-8946-b59c62a60f30\common\icarus_ui.exe /cookie:mmm_irs_ppi_902_451_o /track-guid:66f21053-5798-4644-96fe-683f01a94990 /edat_dir:C:\Windows\Temp\asw.75eb17459e314e5f /sssid:2168 /er_master:master_ep_091e9822-70e6-48f0-8c4e-0fe37e7f9b0a /er_ui:ui_ep_096ef443-5e2a-4f8f-9f3e-6498111b8c3c4⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Temp\asw-ab830aa0-047f-442e-8946-b59c62a60f30\avg-av-vps\icarus.exeC:\Windows\Temp\asw-ab830aa0-047f-442e-8946-b59c62a60f30\avg-av-vps\icarus.exe /cookie:mmm_irs_ppi_902_451_o /track-guid:66f21053-5798-4644-96fe-683f01a94990 /edat_dir:C:\Windows\Temp\asw.75eb17459e314e5f /sssid:2168 /er_master:master_ep_091e9822-70e6-48f0-8c4e-0fe37e7f9b0a /er_ui:ui_ep_096ef443-5e2a-4f8f-9f3e-6498111b8c3c /er_slave:avg-av-vps_slave_ep_67a487a3-d3f8-4977-b8d6-4394f60752a9 /slave:avg-av-vps4⤵
- Uses Session Manager for persistence
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\AVG\Antivirus\defs\24021702\engsup.exe"C:\Program Files\AVG\Antivirus\defs\24021702\engsup.exe" /prepare_definitions_folder5⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\Temp\asw-ab830aa0-047f-442e-8946-b59c62a60f30\avg-av\icarus.exeC:\Windows\Temp\asw-ab830aa0-047f-442e-8946-b59c62a60f30\avg-av\icarus.exe /cookie:mmm_irs_ppi_902_451_o /track-guid:66f21053-5798-4644-96fe-683f01a94990 /edat_dir:C:\Windows\Temp\asw.75eb17459e314e5f /sssid:2168 /er_master:master_ep_091e9822-70e6-48f0-8c4e-0fe37e7f9b0a /er_ui:ui_ep_096ef443-5e2a-4f8f-9f3e-6498111b8c3c /er_slave:avg-av_slave_ep_e27ab77d-dbe7-4539-9f66-f19a679d6226 /slave:avg-av4⤵
- Sets service image path in registry
- Uses Session Manager for persistence
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Registers COM server for autorun
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:sw_avgNdis5⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:avgNdisFlt /catalog:avgNdisFlt.cat5⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRdr2.cat5⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgHwid.cat5⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgVmm.cat5⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRvrt.cat5⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer /reg5⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer5⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" /U "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"5⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" /U "C:\Program Files\AVG\Antivirus\aswAMSI.dll"5⤵
- Checks for any installed AV software in registry
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"5⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\aswAMSI.dll"5⤵
- Checks for any installed AV software in registry
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\asOutExt.dll"5⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\asOutExt.dll"5⤵
- Checks for any installed AV software in registry
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /catinstall:"C:\Program Files\AVG\Antivirus\crts.cat" /basename:pkg_{af98c830-528a-46b9-a60e-2db5d9a76b77}.cat /crtid:E89476E7569FC7413EA11A4461D6E3E784B8B6995⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\wsc_proxy.exe"C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /svc /register /ppl_svc5⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\avDump.exe"C:\Program Files\AVG\Antivirus\avDump.exe" --pid 5584 --exception_ptr 0000001F0ECFED50 --thread_id 10068 --dump_level 0 --handle_data 1 --dump_file "C:\ProgramData\AVG\Antivirus\log\unp310890773599877945x-manual.mdmp" --comment "Cause: VectoredExceptionHandler" --min_interval 606⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\AVG\Overseer\overseer.exe"C:\Program Files\Common Files\AVG\Overseer\overseer.exe" /skip_uptime /skip_remediations5⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\defs\24021702\engsup.exe"C:\Program Files\AVG\Antivirus\defs\24021702\engsup.exe" /avg /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie5⤵
- Checks for any installed AV software in registry
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38d2855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
6Registry Run Keys / Startup Folder
6Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
6Registry Run Keys / Startup Folder
6Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Modify Registry
8Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
AVGBrowserInstaller.exe
@PaxHeader
AVGBrowserCrashHandler.exe
AVGBrowserCrashHandler64.exe
AVGBrowserUpdate.exe
AVGBrowserUpdateComRegisterShell64.exe
AVGBrowserUpdateCore.exe
goopdate.dll
goopdateres_am.dll
goopdateres_ar.dll
goopdateres_bg.dll
goopdateres_bn.dll
goopdateres_ca.dll
goopdateres_cs.dll
goopdateres_da.dll
goopdateres_de.dll
goopdateres_el.dll
goopdateres_en-GB.dll
goopdateres_en.dll
goopdateres_es-419.dll
goopdateres_es.dll
goopdateres_et.dll
goopdateres_fa.dll
goopdateres_fi.dll
goopdateres_fil.dll
goopdateres_fr.dll
goopdateres_gu.dll
goopdateres_hi.dll
goopdateres_hr.dll
goopdateres_hu.dll
goopdateres_id.dll
goopdateres_is.dll
goopdateres_it.dll
goopdateres_iw.dll
goopdateres_ja.dll
goopdateres_kn.dll
goopdateres_ko.dll
goopdateres_lt.dll
goopdateres_lv.dll
Base.dll
Boot.dll
aswClnTg.htm
aswClnTg.txt
aswInfTg.htm
aswInfTg.txt
uiLangRes.dll
AVGSvc.exe
AVGUI.exe
AavmRpch.dll
AvBugReport.exe
AvConsent.exe
AvDump.exe
AvEmUpdate.exe
AvLaunch.exe
BreachGuardSdk.dll
BrowserCleanup.ini
CommChannel.dll
CommonRes.dll
HTMLayout.dll
avgArDisk.sys
avgArPot.sys
avgBoot.exe
avgElam.sys
avgKbd.sys
avgMonFlt.sys
avgNetHub.sys
avgRdr2.sys
avgRvrt.sys
avgSP.sys
avgSnx.sys
avgStm.sys
avgVmm.sys
avgbidsdriver.sys
avgbidsh.sys
avgbuniv.sys
Boost.txt
Crypto++.txt
Detours.txt
EULA.txt
GSL.txt
ICU.txt
JsonCpp.txt
LZMA.txt
OpenSSL.txt
PCRE.txt
Xerces.txt
brotli.txt
bsdiff.txt
bzip2.txt
c-ares.txt
cURL.txt
cef.txt
dnscrypt-proxy.txt
intel_asm.txt
jansson.txt
lexbor.txt.ipending.c33e6386
libPNG.txt
libevent.txt
libsodium.txt
lzfse.txt
mbedTLS.txt
mhook.txt
nanopb.txt
nghttp2.txt
protobuf.txt
pugixml.txt
rapidjson.txt
sqlite.txt
unrar.txt
vxWidgets.txt
xmlParser.txt
xxHash.txt
yara.txt
zlib.txt
RegSvr.exe
aswPEAntivirus.exe
aswPEBrowser.exe
aswPECommander.exe
aswPEShell.exe
aswRegLib.dll
aswShMin.exe
background-loading.png
background.png
waikamd64.mst
wxbase315u_vc.dll
wxmsw315u_core_vc.dll
SecurityProductInformation.ini
SetupInf.exe
SupportTool.exe
TuneupSmartScan.dll
VisthAux.exe
anen.dll
asOutExt.dll
ashBase.dll
ashQuick.exe
ashServ.dll
ashShell.dll
ashTask.dll
ashUpd.exe
asulaunch.exe
aswAMSI.dll
aswAux.dll
aswAv.dll
aswAvBootTimeScanShMin.exe
aswBrowser.dll
aswChLic.exe
aswCmnBS.dll
aswCmnIS.dll
aswCmnOS.dll
aswDld.dll
aswEngLdr.dll
aswEngSrv.exe
aswIP.dll
aswLog.dll
aswProperty.dll
aswPropertyAv.dll
aswRunDll.exe
aswRvrt.dll
aswSqLt.dll
aswVmm.dll
aswW8ntf.dll
aswavdetection.dll
aswcomm.dll
aswdetallocator.dll
aswhook.dll
aswidpm.dll
aswidsagent.exe
aswntsqlite.dll
aswpsic.dll
aswremoval.dll
aswsecapi.dll
aswwinamapi.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
avg.local_vc142.crt.manifest
concrt140.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_1.dll
vcruntime140_threads.dll
avgToolsSvc.exe
browser_pass.dll
burger_client.dll
chrome_100_percent.pak
chrome_200_percent.pak
chrome_elf.dll
crts.cat
d3dcompiler_47.dll
dll_loader.dll
dnd_helper.dll
event_manager.dll
event_manager_burger.dll
event_manager_er.dll
event_manager_ga.dll
event_routing.dll
event_routing_rpc.dll
ffl2.dll
firefox_pass.exe
fltlib_wrapper.dll
gaming_hook.exe
about.js
antiRansomware.js
ask.ogg
browserDetection.js
browserDetectionWindow.html
browserExtensions.js
core.js
darkWebMonitor.js
dashboard.js
dataShredder.js
doNotDisturb.js
done.ogg
driverUpdater.js
feedbackForm.js
firewall.js
help.js
i18n.js
kin.js
libs.js
locale-fi.json.ipending.c33e6386
mainCss.css
mainCss_light.css
mainFont.css
mainLayout.js
mainLayoutCss.css
mainSprite.css
mainVars.json
mainWindow.html
myLicenses.js
napi.js
napiAdapter.js
napiExtensions.js
network.js
notifications.js
notify.ogg
offline.htm
overlay.html
pap.js
passwordProtection.js
plugins.js
ras.js
rescueDisk.js
scans.js
search.js
secureDns.js
sensitiveData.js
settings.js
shields.js
smartScan.js
software.js
svelteComponents.js
svelteInternal.js
svgInline.svg
system.js
threat.ogg
tray.js
tuneup.js
update.js
updatefile.json
virusChest.js
webCam.js
resources.ini
hns_tools.dll
icudtl.dat
jsbridge.dll
libEGL.dll
libGLESv2.dll
libcef.dll
libcrypto-3-x64.dll
libssl-3-x64.dll
libwaapi.dll
libwaheap.dll
libwalocal.dll
libwaresource.dll
libwautils.dll
libwavmodapi.dll
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
vi.pak
zh-CN.pak
zh-TW.pak
log.dll
mfc140.dll
mfc140u.dll
mfcm140.dll
mfcm140u.dll
module_lifetime.dll
nos.dll
ntp_time.dll
overseer.exe
perfstats.dll
process_monitor.dll
protobuf.dll
resources.pak
sched.exe
serialization.dll
update.xml
27658fd6-cab2-430a-827d-2fc92e44a2ba.ini
8955a353-51f6-4a67-903c-1f48f2a0e5a4.ini
c60418db-7028-4bf2-94d4-d8025bc54fe3.xml
ccbf7ac9-28b6-42b1-811c-c866457e40e6.cab
config.def
config.def
setup.ini
setup.ini
shepherdsync.dll
shred.exe
snapshot_blob.bin
snxhk.dll
streamback.dll
su_adapter.dll
su_common.dll
su_controller.dll
su_worker.exe
libEGL.dll
libGLESv2.dll
task_performance_logger.dll
tasks_core.dll
v8_context_snapshot.bin
vaarclient.dll
wa_3rd_party_host_32.exe
wa_3rd_party_host_64.exe
wsc.dll
wsc_proxy.exe
wsc_proxy.exe.manifest
AavmRpch.dll
AvDump.exe
RegSvr.exe
asOutExt.dll
ashShell.dll
aswAMSI.dll
aswBrowser.dll
aswCmnBS.dll
aswCmnIS.dll
aswCmnOS.dll
aswProperty.dll
aswPropertyAv.dll
aswRunDll.exe
aswhook.dll
API-MS-Win-core-xstate-l2-1-0.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
avg.local_vc142.crt.manifest
concrt140.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_threads.dll
dll_loader.dll
dnd_helper.dll
firefox_pass.exe
gaming_hook.exe
snxhk.dll
ArPot.dll
BCUEngine.dll
PushPin.dll
Sf2.dll
algo64.dll
aswAR.dll
aswArray.dll
aswBoot64.dll
aswCleanerDLL.dll
aswCmnBS.dll
aswCmnIS64.dll
aswCmnOS.dll
aswEngin.dll
aswFiDb.dll
aswHds.dll
aswJsFlt.dll
aswJsFlt64.dll
aswQcr.dll
aswRawFS64.dll
aswRep.dll
aswScan.dll
certs.map
db_agdx.dat
db_ap2.dat
db_array.dat
db_as.dat
db_bank.dat
db_cf.dat
db_cmd.nmp
db_cmd.sig
db_conb.dat
db_dex.nmp
db_dex.sig
db_dh.dat
db_dns.nmp
db_dns.sig
db_dsign.dat
db_dyna.nmp
db_dyna.sig
db_el.dat
db_elf.nmp
db_elf.sig
db_elfa.nmp
db_elfa.sig
db_evope.dat
db_ext.dat
db_fn.nmp
db_fn.sig
db_java.nmp
db_java.sig
db_js.nmp
db_js.sig
db_mx4.nmp
db_mx4.sig
db_mx95.nmp
db_mx95.sig
db_o7.nmp
db_o7.sig
db_o7c.dat
db_o7c.map
db_ob2.dat
db_pay.dat
db_pe.nmp
db_pe.sig
db_pe3.dat
db_pph.dat
db_qcr.dat
db_sl.nmp
db_sl.sig
db_snh.dat
db_sp.dat
db_str.nmp
db_str.sig
db_swf.nmp
db_swf.sig
db_symtrnl.dat
db_tx.dat
db_u.dat
db_w6.nmp
db_w6.sig
db_w6c.dat
db_w6c.map
db_wat.nmp
db_wat.sig
db_wh2.dat
db_xtn.map
def.ini
engsup.exe
exts.dll
fwAux.dll
gvma64.dat
idp.dat
list_d.txt
list_i.txt
swhealthex2.dll
uiext.dll
setup.exe
config.def
product-info.xml
aswOfferTool.exe
config.def
icarus_product.dll
product-info.xml
dataConfig.cab
OpenSans-Bold.ttf
OpenSans-Italic.ttf
OpenSans-Light.ttf
OpenSans-Regular.ttf
RobotoCondensed-Bold.ttf
RobotoCondensed-Regular.ttf
proximanova-bold.otf
proximanova-light.otf
proximanova-regular.otf
Blocked.htm
dnddetection.dat
dnddetection.dat.ver
dndrules.dat
dndrules.dat.ver
overseer_unattend.xml
profile.wprp
settings-24.1.8821.1479.ori
snx_gconfig.xml
icarus.log
icarus.ini
icarus.ini
icarus.ini
icarus.ini
icarus.ini
AvEmUpdate.log
AvEmUpdate.log
AnalyticsManager000.log
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
installer.exe
saBSI.exe
settings.dat
413a91c0-29f5-4d18-baa0-9fb64bae8793.tmp
Bookmarks
Bookmarks
BrowsingTopicsState
f_000005
f_000009
f_00000a
the-real-index
the-real-index
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
ai_chat.html
background.html
app.css
icon_16.png
icon_24.png
icon_64.png
icon_24.png
icon_64.png
animation.lottie.json
clear_chat.png
example_arrow.png
animation.lottie.json
clear_chat.png
example_arrow.png
ai_chat.bundle.js
background.bundle.js
background.bundle.js.LICENSE.txt
popup.bundle.js
manifest.json
messages.json
verified_contents.json
background.js
background.js.LICENSE.txt
content.js
icon128.png
icon16-active.png
icon.png
icon.svg
icon.png
icon.svg
icon.png
icon.svg
manifest.json
overlay.js
popup.html
popup.js
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
open-sans-v15-latin_latin-ext-300.eot
open-sans-v15-latin_latin-ext-300.svg
open-sans-v15-latin_latin-ext-300.ttf
open-sans-v15-latin_latin-ext-300.woff
open-sans-v15-latin_latin-ext-300.woff2
open-sans-v15-latin_latin-ext-600.eot
open-sans-v15-latin_latin-ext-600.svg
open-sans-v15-latin_latin-ext-600.ttf
open-sans-v15-latin_latin-ext-600.woff
open-sans-v15-latin_latin-ext-600.woff2
open-sans-v15-latin_latin-ext-700.eot
open-sans-v15-latin_latin-ext-700.svg
open-sans-v15-latin_latin-ext-700.ttf
open-sans-v15-latin_latin-ext-700.woff
open-sans-v15-latin_latin-ext-700.woff2
open-sans-v15-latin_latin-ext-regular.eot
open-sans-v15-latin_latin-ext-regular.svg
open-sans-v15-latin_latin-ext-regular.ttf
open-sans-v15-latin_latin-ext-regular.woff
open-sans-v15-latin_latin-ext-regular.woff2
icon-128.png
icon-16.png
icon-48.png
icon-on.svg
background.bundle.js
manifest.json
options.html
popup.html
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
background.html
app.css
icon_128.png
icon_48.png
icon_128.png
icon_48.png
customize.png
customize.png
background.bundle.js
background.bundle.js.LICENSE.txt
popup.bundle.js
popup.bundle.js.LICENSE.txt
sidebar.bundle.js
sidepanel.bundle.js
manifest.json
sidebar.html
sidepanel.html
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
MierB03-SubsetCyr-Bold.woff2
MierB03-SubsetCyr-ExtraBold.woff2
MierB03-SubsetCyr-Regular.woff2
MierB03-SubsetLatinA-Bold.woff2
MierB03-SubsetLatinA-ExtraBold.woff2
MierB03-SubsetLatinA-Regular.woff2
roboto-cyrillic-ext-400.woff2
roboto-cyrillic-ext-500.woff2
roboto-cyrillic-ext-700.woff2
roboto-latin-ext-400.woff2
roboto-latin-ext-500.woff2
roboto-latin-ext-700.woff2
popup.css
popup.html
popup.js
vue.js
a1.svg
arrowLeft.svg
arrowRight.svg
checkmark.svg
checkmark9.svg
checkmarkSmall.svg
chevron.svg
close.svg
cross.svg
eye.svg
fingerprint.svg
ad.svg
ae.svg
af.svg
ag.svg
ai.svg
al.svg
am.svg
ao.svg
ar.svg
as.svg
at.svg
au.svg
aw.svg
ax.svg
az.svg
ba.svg
bb.svg
bd.svg
be.svg
bf.svg
bg.svg
bh.svg
bi.svg
bj.svg
bm.svg
bn.svg
bo.svg
bq.svg
br.svg
bs.svg
bt.svg
bw.svg
by.svg
bz.svg
ca.svg
cc.svg
cd.svg
cf.svg
cg.svg
ch.svg
ci.svg
ck.svg
cl-vl.svg
cl.svg
cm.svg
cn.svg
co.svg
cr.svg
cu.svg
cv.svg
cw.svg
cx.svg
cy.svg
cz.svg
de.svg
dj.svg
dk.svg
dm.svg
do.svg
dz.svg
ec.svg
ee.svg
eg.svg
er.svg
es-ce.svg
es-cn.svg
es-ml.svg
es.svg
et.svg
eu.svg
fi.svg
fj.svg
fk.svg
fm-ksa.svg
fm-pni.svg
fm-trk.svg
fm-yap.svg
fm.svg
fo.svg
fr.svg
ga.svg
gb-eng.svg
gb-nir.svg
gb-sct.svg
gb-wls.svg
gd.svg
ge-ab.svg
ge-aj.svg
ge.svg
gf.svg
gg.svg
gh.svg
gi.svg
gl.svg
gm.svg
gn.svg
gq.svg
gr.svg
gs.svg
gt.svg
gu.svg
gy.svg
hk.svg
hn.svg
hr.svg
ht.svg
hu.svg
id.svg
ie.svg
il.svg
im.svg
in.svg
io.svg
iq.svg
ir.svg
is.svg
it.svg
je.svg
jm.svg
jo.svg
jp.svg
ke.svg
kg.svg
kh.svg
ki.svg
km.svg
kn.svg
kp.svg
kr.svg
kw.svg
ky.svg
kz.svg
la.svg
lb.svg
lc.svg
li.svg
lk.svg
lr.svg
ls.svg
lt.svg
lu.svg
lv.svg
ly.svg
ma.svg
mc.svg
md.svg
me.svg
mg.svg
mh.svg
mk.svg
ml.svg
mm.svg
mn.svg
mo.svg
mp.svg
mr.svg
ms.svg
mt.svg
mu.svg
mv.svg
mw.svg
mx.svg
my.svg
mz.svg
na.svg
nc.svg
ne.svg
nf.svg
ng.svg
ni.svg
nl-bq2.svg
nl-bq3.svg
nl.svg
no.svg
np.svg
nr.svg
nu.svg
nz.svg
om.svg
pa.svg
pe.svg
pf.svg
pg.svg
ph.svg
pk.svg
pl.svg
pn.svg
pr.svg
ps.svg
pt-30.svg
pt.svg
pw.svg
py.svg
qa.svg
re.svg
ro.svg
rs.svg
ru.svg
rw.svg
sa.svg
sb.svg
sc.svg
sd.svg
se.svg
sg.svg
sh-ta.svg
sh.svg
si.svg
sk.svg
sl.svg
sm.svg
sn.svg
so.svg
sr.svg
ss.svg
st.svg
sv.svg
sx.svg
sy.svg
sz.svg
tc.svg
td.svg
tg.svg
th.svg
tj.svg
tk.svg
tl.svg
tm.svg
tn.svg
to.svg
tr.svg
tt.svg
tv.svg
tw.svg
tz-eaz.svg
tz.svg
ua.svg
ug.svg
us.svg
uy.svg
uz.svg
va.svg
vc.svg
ve.svg
vg.svg
vn.svg
vu.svg
wf.svg
ws.svg
xk.svg
ye.svg
za.svg
zm.svg
zw.svg
icon128.png
icon16-active.png
icon16.png
icon19-active.png
icon19.png
icon24-active.png
icon24.png
icon256.png
icon32-active.png
icon32.png
icon38-active.png
icon38.png
icon48.png
icon64.png
info.svg
ipInfo.svg
lock.svg
markerGreen.svg
markerOrange.svg
markerRed.svg
offline.svg
processing.svg
sl.svg
upgrade.svg
warning.svg
manifest.json
messages.json
verified_contents.json
data_0
data_1
data_2
data_3
000003.log
LOG
MANIFEST-000001
MANIFEST-000001
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
e2e5f7b1-52fa-49d0-81d4-920e3d3d1b78.tmp
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences~RFe5903cf.TMP
Secure Preferences
Secure Preferences
Secure Preferences
Secure Preferences
49e8329dea02cb83_0
4d94a441acc65aba_0
7a97729fd054480b_0
d5b3ab5b955704a0_0
index
the-real-index
the-real-index
the-real-index~RFe5a3e33.TMP
the-real-index~RFe5a781f.TMP
index.txt
index.txt
index.txt~RFe5a3e62.TMP
ba23d8ecda68de77_0
ba23d8ecda68de77_1
the-real-index
the-real-index
the-real-index
the-real-index~RFe5976bd.TMP
CURRENT
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe590361.TMP
014a792e-a6f5-4776-8f7e-0ffec716ed60.tmp
06da7035-8991-4b9c-85f2-7ee1297c6db6.tmp
19d456ce-0a13-4ddf-b0b1-6d8ebc3f1db7.tmp
36a84e74-db7c-4521-9d2e-17f5ff7bfa75.tmp
876fe1ae-9efd-49c9-a022-e4e700ff5607.tmp
89e62170-2415-4b55-b1c1-644f04beff66.tmp
D566D7D7-DCD6-471C-8109-BE0AD33199E3
F07D8C6A-04B6-4025-869C-70A788D7B5C0
app6c868beaea3db583.tmp
appf846df2a52182bf5.tmp
f7ff2ac3-15ab-4b62-ac65-1ed3742f8e7a.tmp
SecuriteInfo.com.Adware.Downware.20091.25676.15900.tmp
AVG_AV.png
AVG_BRW.png
Logo.png
WebAdvisor.png
botva2.dll
prod0.zip
saBSI.exe
prod1.zip
avg_secure_browser_setup.exe
prod2.zip
avg_antivirus_free_setup.exe
uTorrent.png
nsv83B1.tmp
AVGBrowserUpdateSetup.exe
CR.History.tmp
CR.History.tmp
FF.places.tmp
JsisPlugins.dll
JsisPlugins.dll
Midex.dll
StdUtils.dll
jsis.dll
nsJSON.dll
thirdparty.dll
icon16.png
icon.png
icon.svg
webstore.js
icon_16.png
icon_16.png
ai_chat.png
amazon_music.png
apple_music.png
discord.png
evernote.png
facebook.png
genie.png
gmail.png
google_keep.png
linkedin.png
messenger.png
notion.png
onenote.png
outlook.png
selected.png
slack.png
spotify.png
teams.png
twitter.png
whatsapp.png
yahoo.png
youtube.png
youtube_music.png
gb.svg
app.html
options.css
KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2
KFOmCnqEu92Fr1Mu4WxKOzY.woff2
KFOmCnqEu92Fr1Mu4mxK.woff2
KFOmCnqEu92Fr1Mu5mxKOzY.woff2
KFOmCnqEu92Fr1Mu72xKOzY.woff2
KFOmCnqEu92Fr1Mu7GxKOzY.woff2
KFOmCnqEu92Fr1Mu7WxKOzY.woff2
KFOmCnqEu92Fr1Mu7mxKOzY.woff2
icon_128.png
icon_32.png
icon_48.png
ai_chat.png
arrow.png
conversation_logo.gif
conversation_logo.png
genie.png
messages.png
ai_chat.bundle.js.LICENSE.txt
b10e8c93-f90b-4b54-ab68-29bc8c32cc67.tmp
messages.json
messages.json
content.bundle.js
fpattr.bundle.js
options.bundle.js
the-real-index
the-real-index
AVG Secure Browser.lnk
AVG Secure Browser.lnk
default.dic
icarus_rvrt.exe
bug_report.exe
dump_process.exe
icarus.exe
icarus_ui.exe
product-def.xml
setupui.cont
icarus_mod.dll
icarus_product.dll
product-def.xml
avg_antivirus_free_online_setup.exe
ecoo.edat
memory/1820-1224-0x00007FF7D72B0000-0x00007FF7D72C0000-memory.dmp
memory/1820-1085-0x00007FF7D72B0000-0x00007FF7D72C0000-memory.dmp
memory/1820-884-0x00007FF7D5E70000-0x00007FF7D5E80000-memory.dmp
memory/1820-1327-0x00007FF7D72B0000-0x00007FF7D72C0000-memory.dmp
memory/1820-886-0x00007FF7D5E70000-0x00007FF7D5E80000-memory.dmp
memory/1820-1370-0x00007FF7CD080000-0x00007FF7CD090000-memory.dmp
memory/1820-887-0x00007FF7D5E70000-0x00007FF7D5E80000-memory.dmp
memory/1820-932-0x00007FF7D2870000-0x00007FF7D2880000-memory.dmp
memory/1820-1290-0x00007FF7CD080000-0x00007FF7CD090000-memory.dmp
memory/1820-1310-0x00007FF7D72B0000-0x00007FF7D72C0000-memory.dmp
memory/1820-1239-0x00007FF7D72B0000-0x00007FF7D72C0000-memory.dmp
memory/1820-1002-0x00007FF7CD080000-0x00007FF7CD090000-memory.dmp
memory/1820-931-0x00007FF78B4F0000-0x00007FF78B500000-memory.dmp
memory/1820-911-0x00007FF7D72B0000-0x00007FF7D72C0000-memory.dmp
memory/1820-904-0x00007FF7BF7B0000-0x00007FF7BF7C0000-memory.dmp
memory/1820-1234-0x00007FF7CD080000-0x00007FF7CD090000-memory.dmp
memory/1820-930-0x00007FF7CD080000-0x00007FF7CD090000-memory.dmp
memory/1820-914-0x00007FF772CE0000-0x00007FF772CF0000-memory.dmp
memory/1820-1027-0x00007FF7CD080000-0x00007FF7CD090000-memory.dmp
memory/1820-984-0x00007FF78B4F0000-0x00007FF78B500000-memory.dmp
memory/1820-983-0x00007FF7D72B0000-0x00007FF7D72C0000-memory.dmp
memory/1820-1178-0x00007FF7CD080000-0x00007FF7CD090000-memory.dmp
memory/1820-1188-0x00007FF7D72B0000-0x00007FF7D72C0000-memory.dmp
memory/1820-974-0x00007FF7BF7B0000-0x00007FF7BF7C0000-memory.dmp
memory/1820-1016-0x00007FF78B4F0000-0x00007FF78B500000-memory.dmp
memory/1820-1039-0x00007FF7BF7B0000-0x00007FF7BF7C0000-memory.dmp
memory/1820-1045-0x00007FF7CD080000-0x00007FF7CD090000-memory.dmp
memory/1820-1062-0x00007FF7BF7B0000-0x00007FF7BF7C0000-memory.dmp
memory/1820-1069-0x00007FF7CD080000-0x00007FF7CD090000-memory.dmp
memory/1820-1107-0x00007FF7CD080000-0x00007FF7CD090000-memory.dmp
memory/1820-1088-0x00007FF7BF7B0000-0x00007FF7BF7C0000-memory.dmp
memory/1820-885-0x00007FF7D5E70000-0x00007FF7D5E80000-memory.dmp
memory/1820-1048-0x00007FF7D72B0000-0x00007FF7D72C0000-memory.dmp
memory/1820-1009-0x00007FF7BF7B0000-0x00007FF7BF7C0000-memory.dmp
memory/1820-1031-0x00007FF7D72B0000-0x00007FF7D72C0000-memory.dmp
memory/1820-1148-0x00007FF7D72B0000-0x00007FF7D72C0000-memory.dmp
memory/1820-1145-0x00007FF7BF7B0000-0x00007FF7BF7C0000-memory.dmp
memory/1820-1143-0x00007FF7CD080000-0x00007FF7CD090000-memory.dmp
memory/1820-1173-0x00007FF7CD080000-0x00007FF7CD090000-memory.dmp
memory/1820-1165-0x00007FF7D72B0000-0x00007FF7D72C0000-memory.dmp
memory/1820-1205-0x00007FF7D72B0000-0x00007FF7D72C0000-memory.dmp
memory/1820-1217-0x00007FF7CD080000-0x00007FF7CD090000-memory.dmp
memory/1820-882-0x00007FF7D5E70000-0x00007FF7D5E80000-memory.dmp
memory/1820-1190-0x00007FF7CD080000-0x00007FF7CD090000-memory.dmp
memory/3320-27-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/3320-2-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/3320-682-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/3320-0-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/3732-64-0x00000000052E0000-0x00000000052EF000-memory.dmp
memory/3732-680-0x0000000000400000-0x000000000070F000-memory.dmp
memory/3732-43-0x0000000002710000-0x0000000002711000-memory.dmp
memory/3732-63-0x0000000000400000-0x000000000070F000-memory.dmp
memory/3732-41-0x0000000000400000-0x000000000070F000-memory.dmp
memory/3732-17-0x00000000052E0000-0x00000000052EF000-memory.dmp
memory/3732-29-0x00000000052E0000-0x00000000052EF000-memory.dmp
memory/3732-42-0x00000000052E0000-0x00000000052EF000-memory.dmp
memory/3732-28-0x0000000000400000-0x000000000070F000-memory.dmp
memory/3732-6-0x0000000002710000-0x0000000002711000-memory.dmp
memory/5884-13122-0x00007FFEDA050000-0x00007FFEDA060000-memory.dmp
memory/5884-13120-0x00007FFEDA170000-0x00007FFEDA439000-memory.dmp
memory/5884-13128-0x00007FFEDA170000-0x00007FFEDA439000-memory.dmp
memory/7064-13131-0x00007FFEDA050000-0x00007FFEDA060000-memory.dmp