Analysis
- max time kernel
2640s - max time network
2629s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
28/02/2024, 10:21
General
- Target LANcetChat-Installer.msi
- Size 42.4MB
- Sample240228-md5ltahc2v
- SHA256 ec1b6294a2f74cfcd017ae619f95f33cb44022bc1cc1e47b52c4e1bfeb1e3f29
Score
10/10
Malware Config
Extracted
Family
-
lumma
C2
-
https://forknegotationaow.shop/api
-
https://technologyenterdo.shop/api
-
https://detectordiscusser.shop/api
-
https://turkeyunlikelyofw.shop/api
-
https://associationokeo.shop/api
Signatures
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Drops file in Drivers directory 33 IoCs
- Sets service image path in registry 2 TTPs 15 IoCs
- Uses Session Manager for persistence 2 TTPs 4 IoCs
Creates Session Manager registry key to run executable early in system boot.
- Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 6 IoCs
- Blocklisted process makes network request 3 IoCs
- Checks for any installed AV software in registry 1 TTPs 48 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Downloads MZ/PE file
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Modifies Installed Components in the registry 2 TTPs 7 IoCs
- Sets file execution options in registry 2 TTPs 2 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 26 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Checks computer location settings 2 TTPs 33 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory 14 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 4 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Registers COM server for autorun 1 TTPs 36 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 35 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 15 IoCs
- Kills process with taskkill 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 12 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 24 IoCs
- Suspicious behavior: MapViewOfSection 8 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 37 IoCs
- Suspicious use of SetWindowsHookEx 19 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\LANcetChat-Installer.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4616B22B7091D9ECA55379FD7C9ABB2F C2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5F6865F691CCC61E2F1661AAE9F60B5A2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exeC:\Windows\system32\taskkill.exe /F /IM Messenger.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C813094CC046CB83E30050091E3E486F E Global\MSI00002⤵
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\taskkill.exeC:\Windows\system32\taskkill.exe /F /IM Messenger.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\cmd.exe/C "C:\Users\Admin\AppData\Local\Temp\{E8C5F798-3DE3-4DC6-BE3D-3457068843C9}.bat"3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe/C "C:\Users\Admin\AppData\Local\Temp\{E8C5F798-3DE3-4DC6-BE3D-3457068843C9}.bat"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe/C "C:\Users\Admin\AppData\Local\Temp\{E8C5F798-3DE3-4DC6-BE3D-3457068843C9}.bat"3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffc5059758,0x7fffc5059768,0x7fffc50597782⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4684 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5024 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5512 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4608 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2496 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4152 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1740 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3832 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4612 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=1392 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3872 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5692 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4960 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5584 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4008 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=3080 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=3400 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5488 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=1644 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1724 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=4952 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=5788 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5440 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=4604 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=5364 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=5928 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=5304 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=5400 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=5468 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=5252 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=5248 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=6368 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=5992 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=6252 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=5388 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=6836 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=6336 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=5992 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=6828 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=6644 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=7268 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6248 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=6800 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7268 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6884 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5864 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6992 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5740 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"2⤵
- Checks for any installed AV software in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\aj2321.exe"C:\Users\Admin\AppData\Local\Temp\aj2321.exe" /relaunch=8 /was_elevated=1 /tagdata3⤵
- Checks BIOS information in registry
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\nsh2543.tmp\AVGBrowserUpdateSetup.exeAVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9407&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --reset-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome"4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GUM63DB.tmp\AVGBrowserUpdate.exe"C:\Program Files (x86)\GUM63DB.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9407&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --reset-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome"5⤵
- Sets file execution options in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY1MC41IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY1MC41IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezJDOTQ5NkZFLUM1MjQtNENENS04OUY2LUUyOUI4QURCNDZGQX0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9InswNzREMTAxMy00NjcwLTQ0NTgtQkIxRC1ENzZFREVGMTIwMDR9IiB1c2VyaWRfZGF0ZT0iMjAyNDAyMjgiIG1hY2hpbmVpZD0iezAwMDA1OEQ0LUIyN0EtMDEyQi05RTNFLTQ1NDE0NzFFNkM2OX0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDIyOCIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9Ins3QkRCNDEyRC02MzkwLTQ1OEYtOTY4QS1ENjRCQjE3Rjc0NkJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjUwLjUiIGxhbmc9ImVuLVVTIiBicmFuZD0iOTQwNyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMzQxNiIvPjwvYXBwPjwvcmVxdWVzdD46⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9407&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --reset-default-win10 --auto-import-data%3Dchrome --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{2C9496FE-C524-4CD5-89F6-E29B8ADB46FA}" /silent6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --heartbeat --install --create-profile4⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2300 --field-trial-handle=2304,i,9229776374615777077,1926912598138044120,262144 --variations-seed-version /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2336 --field-trial-handle=2304,i,9229776374615777077,1926912598138044120,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2588 --field-trial-handle=2304,i,9229776374615777077,1926912598138044120,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3324 --field-trial-handle=2304,i,9229776374615777077,1926912598138044120,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3744 --field-trial-handle=2304,i,9229776374615777077,1926912598138044120,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3880 --field-trial-handle=2304,i,9229776374615777077,1926912598138044120,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4628 --field-trial-handle=2304,i,9229776374615777077,1926912598138044120,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4800 --field-trial-handle=2304,i,9229776374615777077,1926912598138044120,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5012 --field-trial-handle=2304,i,9229776374615777077,1926912598138044120,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2304,i,9229776374615777077,1926912598138044120,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5100 --field-trial-handle=2304,i,9229776374615777077,1926912598138044120,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --silent-launch4⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=121.0.23992.186 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd40c3c80,0x7fffd40c3c8c,0x7fffd40c3c985⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2096 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:25⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2640 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2664 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3408 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3868 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4052 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4192 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4152 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4800 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4960 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5096 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4792 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4944 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5508 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --enable-protect5⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=121.0.23992.186 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffd40c3c80,0x7fffd40c3c8c,0x7fffd40c3c986⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe"C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe" --registration reg-task --taskintr PT10M --runonce6⤵
- Executes dropped EXE
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5168 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5236 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4952 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4976 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5620 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5580 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5800 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5764 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5592 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5968 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6108 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6256 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6096 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5764 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5720 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5532 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5744 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4836 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4932 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=4992 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5032 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6280 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=5236 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=5720 --field-trial-handle=2100,i,1338438910439480357,691294409297077857,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
-
C:\Program Files\AVG\Browser\Application\121.0.23992.186\Installer\setup.exesetup.exe /silent --create-shortcuts=0 --install-level=1 --system-level4⤵
-
C:\Program Files\AVG\Browser\Application\121.0.23992.186\Installer\setup.exe"C:\Program Files\AVG\Browser\Application\121.0.23992.186\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=121.0.23992.186 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff6cb581500,0x7ff6cb58150c,0x7ff6cb5815185⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 taskbarpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"5⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"5⤵
- Checks computer location settings
- Modifies registry class
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --check-run=src=installer4⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=121.0.23992.186 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffd40c3c80,0x7fffd40c3c8c,0x7fffd40c3c985⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1956 --field-trial-handle=2008,i,8624794180822802142,7508969897505124865,262144 --variations-seed-version /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2636 --field-trial-handle=2008,i,8624794180822802142,7508969897505124865,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2184 --field-trial-handle=2008,i,8624794180822802142,7508969897505124865,262144 --variations-seed-version /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3196 --field-trial-handle=2008,i,8624794180822802142,7508969897505124865,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3472 --field-trial-handle=2008,i,8624794180822802142,7508969897505124865,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4480 --field-trial-handle=2008,i,8624794180822802142,7508969897505124865,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4520 --field-trial-handle=2008,i,8624794180822802142,7508969897505124865,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4652 --field-trial-handle=2008,i,8624794180822802142,7508969897505124865,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4472 --field-trial-handle=2008,i,8624794180822802142,7508969897505124865,262144 --variations-seed-version /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2008,i,8624794180822802142,7508969897505124865,262144 --variations-seed-version /prefetch:85⤵
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=1668 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --mojo-platform-channel-handle=5076 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --mojo-platform-channel-handle=6048 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --mojo-platform-channel-handle=7644 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6956 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4600 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --mojo-platform-channel-handle=7796 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7744 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7432 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7888 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5716 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5752 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --mojo-platform-channel-handle=5936 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Users\Admin\Downloads\ccsetup621 (1).exe"C:\Users\Admin\Downloads\ccsetup621 (1).exe"2⤵
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\CCleaner\CCleaner64.exe"C:\Program Files\CCleaner\CCleaner64.exe" /createSkipUAC3⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks processor information in registry
-
-
C:\Program Files\CCleaner\CCUpdate.exe"C:\Program Files\CCleaner\CCUpdate.exe" /reg3⤵
- Writes to the Master Boot Record (MBR)
-
C:\Program Files\CCleaner\CCUpdate.exeCCUpdate.exe /emupdater /applydll "C:\Program Files\CCleaner\Setup\954e70d0-e954-4702-bb7c-8a361bedd626.dll"4⤵
- Writes to the Master Boot Record (MBR)
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --single-argument http://www.ccleaner.com/go/app_releasenotes?p=1&v=&l=1033&b=1&a=03⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Checks SCSI registry key(s)
- Enumerates system info in registry
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=121.0.23992.186 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffd40c3c80,0x7fffd40c3c8c,0x7fffd40c3c984⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1824 --field-trial-handle=1828,i,5615377646964863564,9698746534060573288,262144 --variations-seed-version /prefetch:24⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2104 --field-trial-handle=1828,i,5615377646964863564,9698746534060573288,262144 --variations-seed-version /prefetch:84⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2692 --field-trial-handle=1828,i,5615377646964863564,9698746534060573288,262144 --variations-seed-version /prefetch:84⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3248 --field-trial-handle=1828,i,5615377646964863564,9698746534060573288,262144 --variations-seed-version /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3404 --field-trial-handle=1828,i,5615377646964863564,9698746534060573288,262144 --variations-seed-version /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4560 --field-trial-handle=1828,i,5615377646964863564,9698746534060573288,262144 --variations-seed-version /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4592 --field-trial-handle=1828,i,5615377646964863564,9698746534060573288,262144 --variations-seed-version /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4860 --field-trial-handle=1828,i,5615377646964863564,9698746534060573288,262144 --variations-seed-version /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5020 --field-trial-handle=1828,i,5615377646964863564,9698746534060573288,262144 --variations-seed-version /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5284 --field-trial-handle=1828,i,5615377646964863564,9698746534060573288,262144 --variations-seed-version /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4996 --field-trial-handle=1828,i,5615377646964863564,9698746534060573288,262144 --variations-seed-version /prefetch:84⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5576 --field-trial-handle=1828,i,5615377646964863564,9698746534060573288,262144 --variations-seed-version /prefetch:14⤵
-
-
-
C:\Program Files\CCleaner\CCleaner64.exe"C:\Program Files\CCleaner\CCleaner64.exe"3⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Checks system information in the registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\CCleaner\CCleaner64.exe"C:\Program Files\CCleaner\CCleaner64.exe" /monitor4⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks system information in the registry
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe"C:\Users\Admin\AppData\Local\Temp\{_av_312d9252-c71c-4c84-b171-f4ad46e22098}\Microstub.exe" /silent /ws /cookie:mmm_ccl_prm_006_675_a4⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\Temp\asw.7983f9203781819d\avg_antivirus_free_online_setup.exe"C:\Windows\Temp\asw.7983f9203781819d\avg_antivirus_free_online_setup.exe" /silent /ws /cookie:mmm_ccl_prm_006_675_a /cookie:mmm_ccl_prm_006_675_a /ga_clientid:af040a7c-8b9f-40ad-8caf-daead896d838 /edat_dir:C:\Windows\Temp\asw.7983f9203781819d5⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\Temp\asw-eb0ee5ca-f35f-4a05-a42d-2977e8b18429\common\icarus.exeC:\Windows\Temp\asw-eb0ee5ca-f35f-4a05-a42d-2977e8b18429\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-eb0ee5ca-f35f-4a05-a42d-2977e8b18429\icarus-info.xml /install /silent /ws /cookie:mmm_ccl_prm_006_675_a /track-guid:af040a7c-8b9f-40ad-8caf-daead896d838 /edat_dir:C:\Windows\Temp\asw.7983f9203781819d6⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
C:\Windows\Temp\asw-eb0ee5ca-f35f-4a05-a42d-2977e8b18429\avg-av-vps\icarus.exeC:\Windows\Temp\asw-eb0ee5ca-f35f-4a05-a42d-2977e8b18429\avg-av-vps\icarus.exe /silent /ws /cookie:mmm_ccl_prm_006_675_a /track-guid:af040a7c-8b9f-40ad-8caf-daead896d838 /edat_dir:C:\Windows\Temp\asw.7983f9203781819d /er_master:master_ep_6b13df1c-8260-44d0-8caa-dc6a47137664 /er_ui:ui_ep_ca55ce9d-e6ba-47d7-b0ef-bdc8940bbfa8 /er_slave:avg-av-vps_slave_ep_93bbfc41-0393-40d8-88ae-4a73a1493d5d /slave:avg-av-vps7⤵
- Uses Session Manager for persistence
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\defs\24022710\engsup.exe"C:\Program Files\AVG\Antivirus\defs\24022710\engsup.exe" /prepare_definitions_folder8⤵
- Drops file in Drivers directory
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Drops file in Program Files directory
-
-
-
C:\Windows\Temp\asw-eb0ee5ca-f35f-4a05-a42d-2977e8b18429\avg-av\icarus.exeC:\Windows\Temp\asw-eb0ee5ca-f35f-4a05-a42d-2977e8b18429\avg-av\icarus.exe /silent /ws /cookie:mmm_ccl_prm_006_675_a /track-guid:af040a7c-8b9f-40ad-8caf-daead896d838 /edat_dir:C:\Windows\Temp\asw.7983f9203781819d /er_master:master_ep_6b13df1c-8260-44d0-8caa-dc6a47137664 /er_ui:ui_ep_ca55ce9d-e6ba-47d7-b0ef-bdc8940bbfa8 /er_slave:avg-av_slave_ep_787f0f31-0321-4dfa-b243-9922bdf54fe0 /slave:avg-av7⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Uses Session Manager for persistence
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Registers COM server for autorun
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:sw_avgNdis8⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:avgNdisFlt /catalog:avgNdisFlt.cat8⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRdr2.cat8⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgHwid.cat8⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgVmm.cat8⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRvrt.cat8⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer /reg8⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer8⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"8⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Modifies Internet Explorer settings
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\aswAMSI.dll"8⤵
- Checks for any installed AV software in registry
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\asOutExt.dll"8⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Modifies registry class
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\asOutExt.dll"8⤵
- Checks for any installed AV software in registry
- Registers COM server for autorun
- Checks processor information in registry
- Modifies registry class
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /catinstall:"C:\Program Files\AVG\Antivirus\crts.cat" /basename:pkg_{af98c830-528a-46b9-a60e-2db5d9a76b77}.cat /crtid:E89476E7569FC7413EA11A4461D6E3E784B8B6998⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\wsc_proxy.exe"C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /svc /register /ppl_svc8⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\avDump.exe"C:\Program Files\AVG\Antivirus\avDump.exe" --pid 5112 --exception_ptr 00000091902FE860 --thread_id 10208 --dump_level 0 --handle_data 1 --dump_file "C:\ProgramData\AVG\Antivirus\log\unp310912512174674229x-manual.mdmp" --comment "Cause: VectoredExceptionHandler" --min_interval 609⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
-
-
C:\Program Files\Common Files\AVG\Overseer\overseer.exe"C:\Program Files\Common Files\AVG\Overseer\overseer.exe" /skip_uptime /skip_remediations8⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\Program Files\AVG\Antivirus\defs\24022710\engsup.exe"C:\Program Files\AVG\Antivirus\defs\24022710\engsup.exe" /avg /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie8⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --mojo-platform-channel-handle=6376 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --mojo-platform-channel-handle=7436 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --mojo-platform-channel-handle=6564 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --mojo-platform-channel-handle=5752 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --mojo-platform-channel-handle=1008 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --mojo-platform-channel-handle=7516 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --mojo-platform-channel-handle=244 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --mojo-platform-channel-handle=7968 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --mojo-platform-channel-handle=6716 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7636 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --mojo-platform-channel-handle=7108 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --mojo-platform-channel-handle=2776 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --mojo-platform-channel-handle=4656 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --mojo-platform-channel-handle=7276 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --mojo-platform-channel-handle=5808 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --mojo-platform-channel-handle=7472 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --mojo-platform-channel-handle=4736 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --mojo-platform-channel-handle=6360 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --mojo-platform-channel-handle=5796 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --mojo-platform-channel-handle=5876 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --mojo-platform-channel-handle=7124 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --mojo-platform-channel-handle=6556 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --mojo-platform-channel-handle=7024 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --mojo-platform-channel-handle=6664 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --mojo-platform-channel-handle=1628 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --mojo-platform-channel-handle=5432 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --mojo-platform-channel-handle=4956 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --mojo-platform-channel-handle=7432 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --mojo-platform-channel-handle=6592 --field-trial-handle=1928,i,14596283764060507841,1484168751105649386,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}1⤵
-
C:\Program Files (x86)\Softros Systems\Softros Messenger\Spell Checker\SoftrosSpellChecker.exe"C:\Program Files (x86)\Softros Systems\Softros Messenger\Spell Checker\SoftrosSpellChecker.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Softros Systems\Softros Messenger\Messenger.exe"C:\Program Files (x86)\Softros Systems\Softros Messenger\Messenger.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x4f41⤵
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{7795F812-8097-4473-99C8-9F682754BE99}\AVGBrowserInstaller.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{7795F812-8097-4473-99C8-9F682754BE99}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --reset-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --system-level2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{7795F812-8097-4473-99C8-9F682754BE99}\CR_BF447.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{7795F812-8097-4473-99C8-9F682754BE99}\CR_BF447.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{7795F812-8097-4473-99C8-9F682754BE99}\CR_BF447.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --reset-default-win10 --auto-import-data=chrome --import-cookies --auto-launch-chrome --system-level3⤵
- Modifies Installed Components in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{7795F812-8097-4473-99C8-9F682754BE99}\CR_BF447.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{7795F812-8097-4473-99C8-9F682754BE99}\CR_BF447.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=121.0.23992.186 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ff7f4a11500,0x7ff7f4a1150c,0x7ff7f4a115184⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=121.0.23992.186 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7fffd40c3c80,0x7fffd40c3c8c,0x7fffd40c3c981⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"1⤵
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /c1⤵
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /cr2⤵
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserCrashHandler.exe"2⤵
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1650.5\AVGBrowserCrashHandler64.exe"2⤵
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ua /installsource scheduler1⤵
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /registermsihelper2⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Writes to the Master Boot Record (MBR)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x4f41⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_@!Files_PAsw0rdZ_8861.zip\Free-Setup-Active\@!Files_PAsw0rdZ_8861.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\Downloads\New folder\Setup_Full_File.exe"C:\Users\Admin\Downloads\New folder\Setup_Full_File.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\wkhtmltopdf.exeC:\Users\Admin\AppData\Local\Temp\wkhtmltopdf.exe3⤵
-
-
-
C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"C:\Program Files\AVG\Browser\Application\121.0.23992.186\elevation_service.exe"1⤵
-
C:\Users\Admin\Downloads\New folder\Setup_Full_File.exe"C:\Users\Admin\Downloads\New folder\Setup_Full_File.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\wkhtmltopdf.exeC:\Users\Admin\AppData\Local\Temp\wkhtmltopdf.exe3⤵
-
-
-
C:\Users\Admin\Downloads\New folder\Setup_Full_File.exe"C:\Users\Admin\Downloads\New folder\Setup_Full_File.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\wkhtmltopdf.exeC:\Users\Admin\AppData\Local\Temp\wkhtmltopdf.exe3⤵
-
-
-
C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe"C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe"1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Users\Admin\Downloads\New folder\Setup_Full_File.exe"C:\Users\Admin\Downloads\New folder\Setup_Full_File.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe2⤵
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\wkhtmltopdf.exeC:\Users\Admin\AppData\Local\Temp\wkhtmltopdf.exe3⤵
-
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" /silent_welcome1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=gpu-process --field-trial-handle=7356,6128394507062210718,716894549724355925,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,ForcedColors,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --no-sandbox --disable-gpu-driver-bug-workarounds --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=disable --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --proxy-auto-detect --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --gpu-preferences=SAAAAAAAAADgAABwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --mojo-platform-channel-handle=7108 /prefetch:22⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=7356,6128394507062210718,716894549724355925,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,ForcedColors,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=none --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=disable --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --proxy-auto-detect --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --mojo-platform-channel-handle=5724 /prefetch:82⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x4f41⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe"C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe" --runonce1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_clnshimg.zip\ReadMe.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Users\Admin\AppData\Local\Temp\Temp1_clnshimg.zip\ClnShimg.com"C:\Users\Admin\AppData\Local\Temp\Temp1_clnshimg.zip\ClnShimg.com"1⤵
- Enumerates connected drives
- Drops file in System32 directory
-
C:\Windows\SysWOW64\explorer.exe"explorer.exe"2⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe"C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe" --runonce1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
6Registry Run Keys / Startup Folder
6Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
6Registry Run Keys / Startup Folder
6Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Modify Registry
7Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
e582026.rbs
e582028.rbs
e69029b.rbs
AVGBrowserCrashHandler.exe
AVGBrowserCrashHandler64.exe
npAvgBrowserUpdate3.dll
AVGBrowserUpdate.exe
AVGBrowserInstaller.exe
@PaxHeader
@PaxHeader
@PaxHeader
Messenger.exe
SoftrosSpellChecker.exe
SpellChecker.dll
SpellChecker.ini
admin.ini
Base.dll
Boot.dll
aswClnTg.htm
aswClnTg.txt
aswInfTg.htm
aswInfTg.txt
uiLangRes.dll
AVGSvc.exe
AVGUI.exe
AavmRpch.dll
AvBugReport.exe
AvConsent.exe
AvDump.exe
AvEmUpdate.exe
AvLaunch.exe
BreachGuardSdk.dll
BrowserCleanup.ini
CommChannel.dll
CommonRes.dll
HTMLayout.dll
avgArDisk.sys
avgArPot.sys
avgBoot.exe
avgElam.sys
avgKbd.sys
avgMonFlt.sys
avgNetHub.sys
avgRdr2.sys
avgRvrt.sys
avgSP.sys
avgSnx.sys
avgStm.sys
avgVmm.sys
avgbidsdriver.sys
avgbidsh.sys
avgbuniv.sys
Boost.txt
Crypto++.txt
Detours.txt
EULA.txt
GSL.txt
ICU.txt
JsonCpp.txt
LZMA.txt
OpenSSL.txt
PCRE.txt
Xerces.txt
brotli.txt
bsdiff.txt
bzip2.txt
c-ares.txt
cURL.txt
cef.txt
dnscrypt-proxy.txt
intel_asm.txt
jansson.txt
lexbor.txt.ipending.b05fa9e6
libPNG.txt
libevent.txt
libsodium.txt
lzfse.txt
mbedTLS.txt
mhook.txt
nanopb.txt
nghttp2.txt
protobuf.txt
pugixml.txt
rapidjson.txt
sqlite.txt
unrar.txt
vxWidgets.txt
xmlParser.txt
xxHash.txt
yara.txt
zlib.txt
RegSvr.exe
aswPEAntivirus.exe
aswPEBrowser.exe
aswPECommander.exe
aswPEShell.exe
aswRegLib.dll
aswShMin.exe
background-loading.png
background.png
waikamd64.mst
wxbase315u_vc.dll
wxmsw315u_core_vc.dll
SecurityProductInformation.ini
SetupInf.exe
SupportTool.exe
TuneupSmartScan.dll
VisthAux.exe
anen.dll
asOutExt.dll
ashBase.dll
ashQuick.exe
ashServ.dll
ashShell.dll
ashTask.dll
ashUpd.exe
asulaunch.exe
aswAMSI.dll
aswAux.dll
aswAv.dll
aswAvBootTimeScanShMin.exe
aswBrowser.dll
aswChLic.exe
aswCmnBS.dll
aswCmnIS.dll
aswCmnOS.dll
aswDld.dll
aswEngLdr.dll
aswEngSrv.exe
aswIP.dll
aswLog.dll
aswProperty.dll
aswPropertyAv.dll
aswRunDll.exe
aswRvrt.dll
aswSqLt.dll
aswVmm.dll
aswW8ntf.dll
aswavdetection.dll
aswcomm.dll
aswdetallocator.dll
aswhook.dll
aswidpm.dll
aswidsagent.exe
aswntsqlite.dll
aswpsic.dll
aswremoval.dll
aswsecapi.dll
aswwinamapi.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
avg.local_vc142.crt.manifest
concrt140.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_1.dll
vcruntime140_threads.dll
avgToolsSvc.exe
browser_pass.dll
burger_client.dll
chrome_100_percent.pak
chrome_200_percent.pak
chrome_elf.dll
crts.cat
d3dcompiler_47.dll
dll_loader.dll
dnd_helper.dll
event_manager.dll
event_manager_burger.dll
event_manager_er.dll
event_manager_ga.dll
event_routing.dll
event_routing_rpc.dll
ffl2.dll
firefox_pass.exe
fltlib_wrapper.dll
gaming_hook.exe
about.js
antiRansomware.js
ask.ogg
browserDetection.js
browserDetectionWindow.html
browserExtensions.js
core.js
darkWebMonitor.js
dashboard.js
dataShredder.js
doNotDisturb.js
done.ogg
driverUpdater.js
feedbackForm.js
firewall.js
help.js
i18n.js
kin.js
libs.js
locale-en_GB.json.ipending.b05fa9e6
mainCss.css
mainCss_light.css
mainFont.css
mainLayout.js
mainLayoutCss.css
mainSprite.css
mainVars.json
mainWindow.html
myLicenses.js
napi.js
napiAdapter.js
napiExtensions.js
network.js
notifications.js
notify.ogg
offline.htm
overlay.html
pap.js
passwordProtection.js
plugins.js
ras.js
rescueDisk.js
scans.js
search.js
secureDns.js
sensitiveData.js
settings.js
shields.js
smartScan.js
software.js
svelteComponents.js
svelteInternal.js
svgInline.svg
system.js
threat.ogg
tray.js
tuneup.js
update.js
updatefile.json
virusChest.js
webCam.js
resources.ini
hns_tools.dll
icudtl.dat
jsbridge.dll
libEGL.dll
libGLESv2.dll
libcef.dll
libcrypto-3-x64.dll
libssl-3-x64.dll
libwaapi.dll
libwaheap.dll
libwalocal.dll
libwaresource.dll
libwautils.dll
libwavmodapi.dll
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
vi.pak
zh-CN.pak
zh-TW.pak
log.dll
mfc140.dll
mfc140u.dll
mfcm140.dll
mfcm140u.dll
module_lifetime.dll
nos.dll
ntp_time.dll
overseer.exe
perfstats.dll
process_monitor.dll
protobuf.dll
resources.pak
sched.exe
serialization.dll
4d6d3a27-3b57-4cfc-b257-3384ea932351.ini
8d419757-2766-46fa-be49-d2cda73e054c.ini
c4a7a067-ceeb-4da2-ac08-c8df83cd88c1.xml
config.def
config.def
d0a42ce8-b0b3-4630-896f-79fc8442cd77.cab
setup.ini
shepherdsync.dll
shred.exe
snapshot_blob.bin
snxhk.dll
streamback.dll
su_adapter.dll
su_common.dll
su_controller.dll
su_worker.exe
libEGL.dll
libGLESv2.dll
task_performance_logger.dll
tasks_core.dll
v8_context_snapshot.bin
vaarclient.dll
wa_3rd_party_host_32.exe
wa_3rd_party_host_64.exe
wsc.dll
wsc_proxy.exe
wsc_proxy.exe.manifest
AavmRpch.dll
AvDump.exe
RegSvr.exe
asOutExt.dll
ashShell.dll
aswAMSI.dll
aswBrowser.dll
aswCmnBS.dll
aswCmnIS.dll
aswCmnOS.dll
aswProperty.dll
aswPropertyAv.dll
aswRunDll.exe
aswhook.dll
API-MS-Win-core-xstate-l2-1-0.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
avg.local_vc142.crt.manifest
concrt140.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_threads.dll
dll_loader.dll
dnd_helper.dll
firefox_pass.exe
gaming_hook.exe
snxhk.dll
ArPot.dll
ArPotEx32.dll
ArPotEx64.dll
BCUEngine.dll
PushPin.dll
Sf2.dll
algo64.dll
aswAR.dll
aswArray.dll
aswBoot64.dll
aswCleanerDLL.dll.ipending.e72a3041
aswCmnBS.dll
aswCmnIS64.dll
aswCmnOS.dll
aswEngin.dll
aswFiDb.dll
aswHds.dll
aswJsFlt.dll
aswJsFlt64.dll
aswQcr.dll
aswRawFS64.dll
aswRep.dll
aswScan.dll
certs.map
db_agdx.dat
db_ap2.dat
db_array.dat
db_as.dat
db_bank.dat
db_cf.dat
db_cmd.nmp
db_cmd.sig
db_conb.dat
db_dex.nmp
db_dex.sig
db_dh.dat
db_dns.nmp
db_dns.sig
db_dsign.dat
db_dyna.nmp
db_dyna.sig
db_el.dat
db_elf.nmp
db_elf.sig
db_elfa.nmp
db_elfa.sig
db_evope.dat
db_ext.dat
db_fn.nmp
db_fn.sig
db_java.nmp
db_java.sig
db_js.nmp
db_js.sig
db_mx4.nmp
db_mx4.sig
db_mx95.nmp
db_mx95.sig
db_o7.nmp
db_o7.sig
db_o7c.dat
db_o7c.map
db_ob2.dat
db_pay.dat
db_pe.nmp
db_pe.sig
db_pe3.dat
db_pph.dat
db_qcr.dat
db_sl.nmp
db_sl.sig
db_snh.dat
db_sp.dat
db_str.nmp
db_str.sig
db_swf.nmp
db_swf.sig
db_symtrnl.dat
db_tx.dat
db_u.dat
db_w6.nmp
db_w6.sig
db_w6c.dat
db_w6c.map
db_wat.nmp
db_wat.sig
db_wh2.dat
db_xtn.map
def.ini
engsup.exe
exts.dll
fwAux.dll
gvma64.dat
idp.dat
list_d.txt
list_i.txt
swhealthex2.dll
uiext.dll
AVGBrowserUninstall.exe
setup.exe
CCUpdate.exe
CCleaner64.exe
372f0473-cde0-471f-8d75-5ff6ea2fe6e7.ini
833bfa68-6fe4-43b7-857f-edb7dc810052.xml
954e70d0-e954-4702-bb7c-8a361bedd626.dll
gcapi_dll.dll
aswOfferTool.exe
config.def
icarus_product.dll
product-info.xml
OpenSans-Bold.ttf
OpenSans-Italic.ttf
OpenSans-Light.ttf
OpenSans-Regular.ttf
RobotoCondensed-Bold.ttf
RobotoCondensed-Regular.ttf
proximanova-bold.otf
proximanova-light.otf
proximanova-regular.otf
Blocked.htm
image001.png
dnddetection.dat
dnddetection.dat.ver
dndrules.dat
dndrules.dat.ver.ipending.b05fa9e6
overseer_unattend.xml
profile.wprp
settings-24.1.8821.1479.ori
snx_gconfig.xml
icarus.log
icarus.ini
icarus.ini
icarus.ini
icarus.ini
AvEmUpdate.log
AvEmUpdate.log
AvEmUpdate.log
Softros Messenger.lnk
Softros Messenger.lnk~RFe584949.TMP
Launch Softros Messenger.lnk
Launch Softros Messenger.lnk~RFe5848ac.TMP
30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
4E4160FB650E5091C535216313A4ECD3_1B14946C1933C2400CC03BD0D9355A22
settings.dat
1152d76d-447f-4290-85a0-71d0615606b4.tmp
Bookmarks
f_00001b
the-real-index
app.html
options.css
KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2
KFOmCnqEu92Fr1Mu4WxKOzY.woff2
KFOmCnqEu92Fr1Mu4mxK.woff2
KFOmCnqEu92Fr1Mu5mxKOzY.woff2
KFOmCnqEu92Fr1Mu72xKOzY.woff2
KFOmCnqEu92Fr1Mu7GxKOzY.woff2
KFOmCnqEu92Fr1Mu7mxKOzY.woff2
icon_128.png
icon_48.png
verified_contents.json
verified_contents.json
webstore.js
messages.json
manifest.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
background.html
app.css
icon_128.png
icon_16.png
icon_32.png
icon_48.png
icon_64.png
icon_128.png
icon_128_off.png
icon_128_paused.png
icon_16.png
icon_16_off.png
icon_16_paused.png
icon_32.png
icon_32_off.png
icon_32_paused.png
icon_48.png
icon_48_off.png
icon_48_paused.png
icon_64.png
arrow.png
balanced_mode.png
balanced_mode_active.png
essential_mode.png
essential_mode_active.png
expanded_icon.png
gear.png
header_background.png
header_logo.png
header_logo_off.png
header_logo_paused.png
info_icon.png
open.png
options_logo.png
options_logo_off.png
pro_strict.png
settings_icon.png
strict_close.png
strict_mode.png
strict_mode_active.png
support.png
whitelist_action.png
arrow.png
balanced_mode.png
balanced_mode_active.png
essential_mode.png
essential_mode_active.png
expanded_icon.png
gear.png
header_background.png
header_logo.png
header_logo_off.png
header_logo_paused.png
info_icon.png
open.png
options_logo.png
options_logo_off.png
pro_strict.png
settings_icon.png
strict_close.png
strict_mode.png
strict_mode_active.png
support.png
whitelist_action.png
background.bundle.js
logger.bundle.js
options.bundle.js
popup.bundle.js
logger.html
manifest.json
options.html
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
open-sans-v15-latin_latin-ext-300.eot
open-sans-v15-latin_latin-ext-300.svg
open-sans-v15-latin_latin-ext-300.ttf
open-sans-v15-latin_latin-ext-300.woff
open-sans-v15-latin_latin-ext-300.woff2
open-sans-v15-latin_latin-ext-600.eot
open-sans-v15-latin_latin-ext-600.svg
open-sans-v15-latin_latin-ext-600.ttf
open-sans-v15-latin_latin-ext-600.woff
open-sans-v15-latin_latin-ext-600.woff2
open-sans-v15-latin_latin-ext-700.eot
open-sans-v15-latin_latin-ext-700.svg
open-sans-v15-latin_latin-ext-700.ttf
open-sans-v15-latin_latin-ext-700.woff
open-sans-v15-latin_latin-ext-700.woff2
open-sans-v15-latin_latin-ext-regular.eot
open-sans-v15-latin_latin-ext-regular.svg
open-sans-v15-latin_latin-ext-regular.ttf
open-sans-v15-latin_latin-ext-regular.woff
open-sans-v15-latin_latin-ext-regular.woff2
icon-128.png
icon-16.png
icon-48.png
icon-on.svg
background.bundle.js
manifest.json
options.html
popup.html
data_0
data_2
data_3
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe66aa60.TMP
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe66aabe.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences~RFe669b7c.TMP
Secure Preferences
Secure Preferences
Secure Preferences
Secure Preferences
Secure Preferences
Secure Preferences
Secure Preferences
Secure Preferences~RFe669f25.TMP
the-real-index
the-real-index
the-real-index
the-real-index~RFe681625.TMP
index
MANIFEST-000001
d80bf499-41ca-4b01-8745-e91907c81da4.tmp
f716db6b-5b59-47d2-9f1e-5a9c7e148354.tmp
data_1
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe6638ab.TMP
Variations
0eb0978c-1b13-4559-9d1a-3f5547ea1b38.tmp
8046c0a9-7e2c-4c79-be34-5375f50839e6.tmp
f_000018
f_000025
f_000027
f_000028
f_00002a
f_00002c
f_00002f
f_000030
f_000031
f_000032
f_000033
f_00003f
f_000041
f_000043
f_00004d
f_00004e
f_00004f
f_000050
f_000051
f_000052
f_00006f
f_000070
f_00007b
f_00007d
f_00008c
f_000090
f_0000a8
f_00010d
f_000126
f_000134
f_00013d
f_000145
f_00014c
f_00014e
f_00015c
f_000165
01d27fe834a33964_0
38196693396fcf74_0
51b510eb0a50251a_0
51cd836ead9657d2_0
75e7e43ed917e86d_0
d22be50f53887a06_0
d9017049e286ac04_0
ead393fe9e367504_0
temp-index
temp-index
temp-index
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
CURRENT
MANIFEST-000001
000003.log
LOG.old
LOG.old
LOG.old~RFe6e926c.TMP
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
c701d062-a3c4-4178-bac1-b40508113e2c.tmp
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5ef5c8.TMP
the-real-index
the-real-index~RFe69ef69.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Module Info Cache
Module Info Cache
Module Info Cache
Module Info Cache
Module Info Cache
Module Info Cache~RFe5c5e06.TMP
persisted_first_party_sets.json
V01.log
WebCacheV01.dat
WebCacheV01.dat
WebCacheV01.dat
WebCacheV01.jfm
WebCacheV01.jfm
WebCacheV01.jfm
WebCacheV01.jfm
WebCacheV01.jfm
WebCacheV01.jfm
140cca5e-75d6-46aa-bfb7-c57c4adb773c.tmp
30d7b2ca-c306-4fe4-a2c5-178ebc0e8ca2.tmp
6a125b82-6801-4b0c-83f6-43e92314028e.tmp
78a46e98-0cfd-4c18-b17f-742ae07d9341.tmp
818b00f6-222b-469d-98d3-129d00b3729a.tmp
92545c6a-3d0b-46a5-8991-228b508c6950.tmp
AiFilesBack_43E41256_13BC_43C2_BBD9_3EE61F0F6377.bak
D566D7D7-DCD6-471C-8109-BE0AD33199E3
F07D8C6A-04B6-4025-869C-70A788D7B5C0
MSI6AA1.tmp
app23051a9011699ab0.tmp
app8a05b76d3fd691fc.tmp
asw9b2dcd51fcbf62e7.tmp
cnrcqtcx.qgu
AVGBrowserUpdateSetup.exe
AccessControl.dll
CR.History.tmp
CR.History.tmp
FF.places.tmp
Midex.dll
jsis.dll
nsJSON.dll
thirdparty.dll
ButtonEvent.dll
INetC.dll
System.dll
UserInfo.dll
asdk.dll
gcapi_dll.dll
nsDialogs.dll
nsProcess.dll
ServiceUninstaller.dll
pfBL.dll
pfUI.dll
CC_Logo_40x96.png
CC_logo_72x66.png
Montserrat-Regular.otf
PF_computer.png
nsy2BD4.tmp
JsisPlugins.dll
StdUtils.dll
sciterui.dll
ppxewexp.aqt
0b0b9417-0d38-455f-9211-8d15018c50a9.tmp
messages.json
messages.json
allowed.png
blocked.png
icon_close.png
logger_icon.png
logger_table_icon.jpg
pro.png
table_list_icon.png
table_regex_icon.png
warning.png
options.bundle.js.LICENSE.txt
messages.json
content.bundle.js
fpattr.bundle.js
options.bundle.js
KFOmCnqEu92Fr1Mu7WxKOzY.woff2
icon_16.png
icon_16.png
icon_64.png
ai_chat.png
amazon_music.png
apple_music.png
discord.png
evernote.png
facebook.png
genie.png
gmail.png
google_keep.png
linkedin.png
messenger.png
notion.png
onenote.png
outlook.png
selected.png
slack.png
spotify.png
teams.png
twitter.png
whatsapp.png
yahoo.png
youtube.png
youtube_music.png
background.bundle.js.LICENSE.txt
{E8C5F798-3DE3-4DC6-BE3D-3457068843C9}.bat
Microstub.exe
AVG Secure Browser.lnk
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
ccc0fa1b9f86f7b3.customDestinations-ms
ccc0fa1b9f86f7b3.customDestinations-ms
General.ini
General.ini
General.ini
catgut.gif
ethyne.mkv
libX11-6.dll
libXau-6.dll
libXdmcp-6.dll
libdl.dll
libgcc_s_dw2-1.dll
libwinpthread-1.dll
libxcb-1.dll
libxcb-image-0.dll
libxcb-shm-0.dll
libxcb-util-1.dll
zlib1.dll
@!Files_PAsw0rdZ_8861.zip
Unconfirmed 620966.crdownload
ccsetup621 (1).exe
MSI23B0.tmp
MSI34DA.tmp
MSI37FA.tmp
MSI5945.tmp
e582025.msi
e690298.msi
icarus_rvrt.exe
bug_report.exe
dump_process.exe
icarus.exe
icarus_ui.exe
product-def.xml
setupui.cont
icarus_mod.dll
metadata-2
{7502d31c-89d6-4026-a4cd-86da69fc6c84}_OnDiskSnapshotProp
memory/1956-10549-0x0000000000210000-0x00000000017F8000-memory.dmp
memory/1956-10550-0x0000000001D00000-0x0000000001D01000-memory.dmp
memory/3264-387-0x0000000002630000-0x00000000026AA000-memory.dmp
memory/3264-390-0x0000000002810000-0x0000000002811000-memory.dmp
memory/3264-397-0x0000000002850000-0x0000000002851000-memory.dmp
memory/4248-10727-0x0000000001D00000-0x0000000001D32000-memory.dmp
memory/4248-10731-0x0000000001D00000-0x0000000001D32000-memory.dmp
memory/4248-10726-0x0000000000210000-0x00000000017F8000-memory.dmp
memory/4248-10728-0x0000000001D00000-0x0000000001D32000-memory.dmp
memory/4248-10729-0x0000000001D00000-0x0000000001D32000-memory.dmp
memory/4248-10730-0x0000000001D00000-0x0000000001D32000-memory.dmp
memory/4268-1113-0x0000000000D70000-0x0000000000E96000-memory.dmp
memory/4268-597-0x0000000000D70000-0x0000000000E96000-memory.dmp
memory/4268-887-0x0000000000D70000-0x0000000000E96000-memory.dmp
memory/4268-777-0x0000000000D70000-0x0000000000E96000-memory.dmp
memory/4268-790-0x0000000000D70000-0x0000000000E96000-memory.dmp
memory/4268-928-0x0000000000D70000-0x0000000000E96000-memory.dmp
memory/4572-10695-0x0000000000210000-0x00000000017F8000-memory.dmp
memory/4572-10700-0x0000000003870000-0x00000000038A2000-memory.dmp
memory/4572-10698-0x0000000003870000-0x00000000038A2000-memory.dmp
memory/4572-10699-0x0000000003870000-0x00000000038A2000-memory.dmp
memory/4572-10697-0x0000000003870000-0x00000000038A2000-memory.dmp
memory/4572-10696-0x0000000003870000-0x00000000038A2000-memory.dmp
memory/5156-1239-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-787-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-846-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-888-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-907-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-918-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-835-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-936-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-948-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-834-0x0000000004240000-0x0000000004241000-memory.dmp
memory/5156-789-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-967-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-972-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-981-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-986-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-1007-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-1078-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-1097-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-1098-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-1111-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-1112-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-608-0x0000000077B14000-0x0000000077B16000-memory.dmp
memory/5156-1114-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-1147-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-786-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-753-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-1191-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-1203-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-1206-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-866-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-624-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-639-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-607-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-625-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-628-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-626-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-642-0x0000000000400000-0x0000000002516000-memory.dmp
memory/5156-643-0x0000000004240000-0x0000000004241000-memory.dmp
memory/5708-18162-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/5708-18399-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/5708-18941-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/5720-257-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/5972-10544-0x0000000071FE0000-0x000000007215B000-memory.dmp
memory/5972-10486-0x0000000071FE0000-0x000000007215B000-memory.dmp
memory/6288-8833-0x00007FFFE0440000-0x00007FFFE0450000-memory.dmp
memory/6552-11065-0x0000000071FE0000-0x000000007215B000-memory.dmp
memory/6552-10889-0x0000000071FE0000-0x000000007215B000-memory.dmp
memory/6828-13886-0x0000000000210000-0x00000000017F8000-memory.dmp
memory/7408-9833-0x0000000071FE0000-0x000000007215B000-memory.dmp
memory/7408-9851-0x0000000071FE0000-0x000000007215B000-memory.dmp
memory/7456-10262-0x0000000071FE0000-0x000000007215B000-memory.dmp
memory/7456-9852-0x0000000071FE0000-0x000000007215B000-memory.dmp
memory/7456-10034-0x0000000071FE0000-0x000000007215B000-memory.dmp
memory/7456-10035-0x0000000071FE0000-0x000000007215B000-memory.dmp
memory/7508-10328-0x0000000071FE0000-0x000000007215B000-memory.dmp
memory/7508-10501-0x0000000071FE0000-0x000000007215B000-memory.dmp
memory/7796-8826-0x00007FFFE04F0000-0x00007FFFE07B9000-memory.dmp
memory/7796-8765-0x00007FFFE0440000-0x00007FFFE0450000-memory.dmp
memory/7796-8764-0x00007FFFE04F0000-0x00007FFFE07B9000-memory.dmp