Analysis
- max time kernel
44s - max time network
120s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
- submitted
09/05/2024, 13:04
General
- Target utorrent_installer(2).exe
- Size 1.7MB
- Sample240509-qa8e3sdg84
- SHA256 bf4ee47d0df1870104f4fada8a68c2fb29e94fea9284c7bb6a6b385a718d8a18
Score
10/10
Malware Config
Signatures
- Detect ZGRat V1 2 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks for any installed AV software in registry 1 TTPs 11 IoCs
- Downloads MZ/PE file
- Sets file execution options in registry 2 TTPs 2 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 23 IoCs
- Loads dropped DLL 36 IoCs
- Registers COM server for autorun 1 TTPs 23 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 14 IoCs
- Modifies data under HKEY_USERS 10 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 8 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\utorrent_installer(2).exe"C:\Users\Admin\AppData\Local\Temp\utorrent_installer(2).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-60NVE.tmp\utorrent_installer(2).tmp"C:\Users\Admin\AppData\Local\Temp\is-60NVE.tmp\utorrent_installer(2).tmp" /SL5="$5022A,875149,815616,C:\Users\Admin\AppData\Local\Temp\utorrent_installer(2).exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7T83J.tmp\uTorrent.exe"C:\Users\Admin\AppData\Local\Temp\is-7T83J.tmp\uTorrent.exe" /S /FORCEINSTALL 11100101011111103⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nskDF93.tmp\utorrent.exe"C:\Users\Admin\AppData\Local\Temp\nskDF93.tmp\utorrent.exe" /S /FORCEINSTALL 11100101011111104⤵
- Identifies Wine through registry keys
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-7T83J.tmp\component0.exe"C:\Users\Admin\AppData\Local\Temp\is-7T83J.tmp\component0.exe" -ip:"dui=2ebf137a-1b71-487a-a697-945baa2a07f9&dit=20240509130453&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=707e&a=100&b=&se=true" -vp:"dui=2ebf137a-1b71-487a-a697-945baa2a07f9&dit=20240509130453&oc=ZB_RAV_Cross_Tri_NCB&p=707e&a=100&oip=26&ptl=7&dta=true" -dp:"dui=2ebf137a-1b71-487a-a697-945baa2a07f9&dit=20240509130453&oc=ZB_RAV_Cross_Tri_NCB&p=707e&a=100" -i -v -d -se=true3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\favj1g2q.exe"C:\Users\Admin\AppData\Local\Temp\favj1g2q.exe" /silent4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nstF455.tmp\RAVEndPointProtection-installer.exe"C:\Users\Admin\AppData\Local\Temp\nstF455.tmp\RAVEndPointProtection-installer.exe" "C:\Users\Admin\AppData\Local\Temp\favj1g2q.exe" /silent5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:106⤵
- Executes dropped EXE
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf6⤵
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r7⤵
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o8⤵
-
-
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngineEvents.xml6⤵
-
-
C:\Windows\SYSTEM32\fltmc.exe"fltmc.exe" load rsKernelEngine6⤵
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\elam\evntdrv.xml6⤵
-
-
C:\Program Files\ReasonLabs\EPP\rsWSC.exe"C:\Program Files\ReasonLabs\EPP\rsWSC.exe" -i -i6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-7T83J.tmp\component1_extract\saBSI.exe"C:\Users\Admin\AppData\Local\Temp\is-7T83J.tmp\component1_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7T83J.tmp\component1_extract\installer.exe"C:\Users\Admin\AppData\Local\Temp\is-7T83J.tmp\component1_extract\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\McAfee\Temp3605307478\installer.exe"C:\Program Files\McAfee\Temp3605307478\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade5⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"7⤵
- Loads dropped DLL
-
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"6⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"6⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"7⤵
-
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-7T83J.tmp\component2_extract\avg_secure_browser_setup.exe"C:\Users\Admin\AppData\Local\Temp\is-7T83J.tmp\component2_extract\avg_secure_browser_setup.exe" /s /run_source=avg_ads_is_control /is_pixel_psh=BjYV6dEDZfwoKKvgyeUHYiS7purx2D6wUKinAaBOPc1ZYmfsRzI1Zyi32lj7C8iLdRBp8TBxFU23T6x /make-default3⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsiF3C8.tmp\AVGBrowserUpdateSetup.exeAVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9230&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Diexplore --import-cookies --auto-launch-chrome"4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\GUMFEC3.tmp\AVGBrowserUpdate.exe"C:\Program Files (x86)\GUMFEC3.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9230&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Diexplore --import-cookies --auto-launch-chrome"5⤵
- Sets file execution options in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezYxNDAyMjA4LTY5MDYtNEMzMi04MDMxLUU3NkUyQTMzQjQ0QX0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9Ins2RkVGMUNEMC02QjZCLTRBQjQtQUFBNi03QjU2RjBBOUIwOER9IiB1c2VyaWRfZGF0ZT0iMjAyNDA1MDkiIG1hY2hpbmVpZD0iezAwMDA5QkIwLTk4NjYtMzU5Mi1BM0E2LTA4NkJDQzI5MDlFN30iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDUwOSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9Ins4ODc4NjY0Ny05REQ1LTQzNzUtODE4Ni1EMTVFMUE1NDc0NDR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7MUM4OUVGMkYtQTg4RS00REUwLTk3RkUtQ0I0MEM4RTRGRUVBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS44LjE2OTMuNiIgbGFuZz0iZW4tVVMiIGJyYW5kPSI5MjMwIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMTI1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9230&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Diexplore --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{61402208-6906-4C32-8031-E76E2A33B44A}" /silent6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --heartbeat --install --create-profile4⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=123.0.24828.123 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7fff3e3edc60,0x7fff3e3edc6c,0x7fff3e3edc785⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,13299019196970088412,14203688999202643991,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1900,i,13299019196970088412,14203688999202643991,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:35⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,13299019196970088412,14203688999202643991,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3376,i,13299019196970088412,14203688999202643991,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:15⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3384,i,13299019196970088412,14203688999202643991,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3716,i,13299019196970088412,14203688999202643991,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3772,i,13299019196970088412,14203688999202643991,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:85⤵
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --silent-launch4⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=123.0.24828.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3e3edc60,0x7fff3e3edc6c,0x7fff3e3edc785⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2068,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1864,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:35⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2300,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3432,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3716,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3584,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3728,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3732,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3720,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3748,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3428,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4080,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4348,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4360,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3956,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3580,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4352,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4772,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4928,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5068,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4776,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5080,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4780,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5688,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=5904,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:15⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=5908,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6084,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5692,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6236,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5540,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5700,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7044,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6812,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7036,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=6816,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=3576,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3492,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --enable-protect5⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=123.0.24828.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3e3edc60,0x7fff3e3edc6c,0x7fff3e3edc786⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe"C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe" --registration reg-task --taskintr PT10M --runonce6⤵
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7288,i,2176808511188720406,6444106532750017049,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:85⤵
-
-
-
C:\Program Files\AVG\Browser\Application\123.0.24828.123\Installer\setup.exesetup.exe /silent --create-shortcuts=0 --install-level=1 --system-level4⤵
-
C:\Program Files\AVG\Browser\Application\123.0.24828.123\Installer\setup.exe"C:\Program Files\AVG\Browser\Application\123.0.24828.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=123.0.24828.123 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff6c98623d0,0x7ff6c98623dc,0x7ff6c98623e85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 taskbarpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"5⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"5⤵
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --check-run=src=installer4⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=123.0.24828.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3e3edc60,0x7fff3e3edc6c,0x7fff3e3edc785⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2060,i,3012964676600295,5963742872322880694,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1864,i,3012964676600295,5963742872322880694,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:35⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,3012964676600295,5963742872322880694,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3260,i,3012964676600295,5963742872322880694,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:15⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3280,i,3012964676600295,5963742872322880694,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3716,i,3012964676600295,5963742872322880694,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3732,i,3012964676600295,5963742872322880694,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4124,i,3012964676600295,5963742872322880694,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4692,i,3012964676600295,5963742872322880694,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:25⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"5⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4116,i,3012964676600295,5963742872322880694,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:15⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"5⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5640,i,3012964676600295,5963742872322880694,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:85⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --enable-protect5⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=123.0.24828.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3e3edc60,0x7fff3e3edc6c,0x7fff3e3edc786⤵
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5760,i,3012964676600295,5963742872322880694,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:85⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe"C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe"3⤵
- Identifies Wine through registry keys
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47082\utorrentie.exe"C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47082\utorrentie.exe" uTorrent_3268_00BDAA80_499065726 µTorrent4823DF041B09 uTorrent ce unp4⤵
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --disable-features=msEnhancedTrackingPreventionEnabled --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=1588.396.27524850309518855935⤵
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x1b4,0x7fff57e53cb8,0x7fff57e53cc8,0x7fff57e53cd86⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1824,12482849167351691496,15427608815092421652,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1832 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,12482849167351691496,15427608815092421652,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2164 /prefetch:36⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47082\utorrentie.exe"C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47082\utorrentie.exe" uTorrent_3268_00BB1BB0_158462730 µTorrent4823DF041B09 uTorrent ce unp4⤵
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --disable-features=msEnhancedTrackingPreventionEnabled --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=4044.1876.63672651226702853665⤵
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x1b4,0x7fff57e53cb8,0x7fff57e53cc8,0x7fff57e53cd86⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1888,12670337325800306242,7309235279367419716,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,12670337325800306242,7309235279367419716,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2212 /prefetch:36⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47082\utorrentie.exe"C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47082\utorrentie.exe" uTorrent_3268_00BDAA80_1699441746 µTorrent4823DF041B09 uTorrent ce unp4⤵
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --disable-features=msEnhancedTrackingPreventionEnabled --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=5168.1508.13042938431773936605⤵
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x1b4,0x7fff57e53cb8,0x7fff57e53cc8,0x7fff57e53cd86⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1856,10409445880945843253,9323391600299886231,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,10409445880945843253,9323391600299886231,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=1936 /prefetch:36⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,10409445880945843253,9323391600299886231,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2432 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1856,10409445880945843253,9323391600299886231,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1856,10409445880945843253,9323391600299886231,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1856,10409445880945843253,9323391600299886231,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,10409445880945843253,9323391600299886231,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=5520 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=1856,10409445880945843253,9323391600299886231,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=entity_extraction --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=4764 /prefetch:86⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47082\utorrentie.exe"C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47082\utorrentie.exe" uTorrent_3268_03CA0DB8_281326016 µTorrent4823DF041B09 uTorrent ce unp4⤵
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=utorrentie.exe --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --disable-features=msEnhancedTrackingPreventionEnabled --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=3016.1580.56179911423840357215⤵
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x178,0x7fff57e53cb8,0x7fff57e53cc8,0x7fff57e53cd86⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1844,525123777445610229,11663647705990226711,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1856 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,525123777445610229,11663647705990226711,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\LocalLow\uTorrent.WebView2\EBWebView" --webview-exe-name=utorrentie.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=1904 /prefetch:36⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://utorrent.com/prodnews?v=3%2e6%2e0%2e1%2e47082&pv=0.0.0.0.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff57e53cb8,0x7fff57e53cc8,0x7fff57e53cd85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,11456094472427973091,16739984370060557116,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2044 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,11456094472427973091,16739984370060557116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,11456094472427973091,16739984370060557116,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2432 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11456094472427973091,16739984370060557116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11456094472427973091,16739984370060557116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11456094472427973091,16739984370060557116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,11456094472427973091,16739984370060557116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3436 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2032,11456094472427973091,16739984370060557116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11456094472427973091,16739984370060557116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11456094472427973091,16739984370060557116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11456094472427973091,16739984370060557116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11456094472427973091,16739984370060557116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:15⤵
-
-
-
C:\Users\Admin\AppData\Roaming\uTorrent\helper\helper.exe"C:\Users\Admin\AppData\Roaming\uTorrent\helper\helper.exe" 51234 --hval m_yy2jNPE2BluqXS -- -pid 3268 -version 470824⤵
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}1⤵
-
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:101⤵
- Executes dropped EXE
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{D906160F-C04A-4A50-9DCD-B69455BEA4A4}\AVGBrowserInstaller.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{D906160F-C04A-4A50-9DCD-B69455BEA4A4}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=iexplore --import-cookies --auto-launch-chrome --system-level2⤵
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{D906160F-C04A-4A50-9DCD-B69455BEA4A4}\CR_6ADD5.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{D906160F-C04A-4A50-9DCD-B69455BEA4A4}\CR_6ADD5.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{D906160F-C04A-4A50-9DCD-B69455BEA4A4}\CR_6ADD5.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=iexplore --import-cookies --auto-launch-chrome --system-level3⤵
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{D906160F-C04A-4A50-9DCD-B69455BEA4A4}\CR_6ADD5.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{D906160F-C04A-4A50-9DCD-B69455BEA4A4}\CR_6ADD5.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=123.0.24828.123 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff6607423d0,0x7ff6607423dc,0x7ff6607423e84⤵
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"2⤵
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"2⤵
-
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
-
C:\Program Files\McAfee\WebAdvisor\UIHost.exe"C:\Program Files\McAfee\WebAdvisor\UIHost.exe"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Program Files (x86)\McAfee Security Scan" 2>nul2⤵
-
-
C:\Program Files\McAfee\WebAdvisor\updater.exe"C:\Program Files\McAfee\WebAdvisor\updater.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c IF EXIST "C:\Program Files\McAfee\WebAdvisor\Download" ( DEL "C:\Program Files\McAfee\WebAdvisor\Download\*.bak" )3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c DEL "C:\Program Files\McAfee\WebAdvisor\*.tmp"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Program Files (x86)\McAfee Security Scan" 2>nul2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Program Files (x86)\McAfee Security Scan" 2>nul2⤵
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\ReasonLabs\EPP\rsWSC.exe"C:\Program Files\ReasonLabs\EPP\rsWSC.exe"1⤵
-
C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe"C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe"C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe"C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe"C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe"C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe"C:\Program Files\AVG\Browser\Application\123.0.24828.123\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Defense Evasion
Modify Registry
4Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
@PaxHeader
@PaxHeader
@PaxHeader
AVGBrowserCrashHandler.exe
AVGBrowserCrashHandler64.exe
AVGBrowserUpdate.exe
AVGBrowserUpdateComRegisterShell64.exe
AVGBrowserUpdateCore.exe
goopdate.dll
goopdateres_am.dll
goopdateres_ar.dll
goopdateres_bg.dll
goopdateres_bn.dll
goopdateres_ca.dll
goopdateres_cs.dll
goopdateres_da.dll
goopdateres_de.dll
goopdateres_el.dll
goopdateres_en-GB.dll
goopdateres_en.dll
goopdateres_es.dll
setup.exe
dataConfig.cab
InstallerLib.dll
rsElam.sys
mc.dll
rsEngine.Core.dll
rsEngine.config
rsWSC.InstallLog
rsWSC.InstallLog
EPP.exe
AnalyticsManager000.log
AnalyticsManager000.log
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
log_00200057003F001D0006.txt
994bcf80-5be0-4ac8-b0c4-e6275bac830b.tmp
settings.dat
settings.dat
913f4ef0-b423-45c3-ad3b-9fa9d3f7cd40.tmp
f_00000b
the-real-index
the-real-index
the-real-index
MANIFEST-000001
Preferences
Preferences
Preferences~RFe58a023.TMP
CURRENT
TransportSecurity
TransportSecurity
TransportSecurity~RFe588671.TMP
data_0
data_1
data_2
data_3
Local State
Local State
Local State
a341f029-07dd-4172-86c6-2cf6c3acbc93.tmp
settings.dat
32015524-18ef-4143-a90a-31b040d73b0d.tmp
Bookmarks
the-real-index
the-real-index
the-real-index
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
app.html
background.html
app.css
options.css
KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2
KFOmCnqEu92Fr1Mu4WxKOzY.woff2
KFOmCnqEu92Fr1Mu4mxK.woff2
KFOmCnqEu92Fr1Mu5mxKOzY.woff2
KFOmCnqEu92Fr1Mu72xKOzY.woff2
KFOmCnqEu92Fr1Mu7GxKOzY.woff2
KFOmCnqEu92Fr1Mu7WxKOzY.woff2
KFOmCnqEu92Fr1Mu7mxKOzY.woff2
icon_128.png
icon_16.png
icon_32.png
icon_48.png
icon_64.png
icon_128.png
icon_128_off.png
icon_128_paused.png
icon_16.png
icon_16_off.png
icon_16_paused.png
icon_32.png
icon_32_off.png
icon_32_paused.png
icon_48.png
icon_48_off.png
icon_48_paused.png
icon_64.png
arrow.png
balanced_mode.png
balanced_mode_active.png
essential_mode.png
essential_mode_active.png
expanded_icon.png
gear.png
header_background.png
header_logo.png
header_logo_off.png
header_logo_paused.png
info_icon.png
open.png
options_logo.png
options_logo_off.png
pro_strict.png
settings_icon.png
strict_close.png
strict_mode.png
strict_mode_active.png
support.png
whitelist_action.png
arrow.png
balanced_mode.png
balanced_mode_active.png
essential_mode.png
essential_mode_active.png
expanded_icon.png
gear.png
header_background.png
header_logo.png
header_logo_off.png
header_logo_paused.png
info_icon.png
open.png
options_logo.png
options_logo_off.png
pro_strict.png
settings_icon.png
strict_close.png
strict_mode.png
strict_mode_active.png
support.png
whitelist_action.png
background.bundle.js
logger.bundle.js
options.bundle.js
popup.bundle.js
logger.html
manifest.json
options.html
icon_24.png
icon_64.png
messages.json
verified_contents.json
background.js
background.js.LICENSE.txt
content.js
contentAPIs.js
icon128.png
icon16-active.png
icon.png
icon.svg
icon.png
icon.svg
icon.png
icon.svg
manifest.json
overlay.js
popup.html
popup.js
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
MierB03-SubsetCyr-Bold.woff2
MierB03-SubsetCyr-ExtraBold.woff2
MierB03-SubsetCyr-Regular.woff2
MierB03-SubsetLatinA-Bold.woff2
MierB03-SubsetLatinA-ExtraBold.woff2
MierB03-SubsetLatinA-Regular.woff2
roboto-cyrillic-ext-400.woff2
roboto-cyrillic-ext-500.woff2
roboto-cyrillic-ext-700.woff2
roboto-latin-ext-400.woff2
roboto-latin-ext-500.woff2
roboto-latin-ext-700.woff2
popup.css
popup.html
popup.js
vue.js
a1.svg
arrowLeft.svg
arrowRight.svg
checkmark.svg
checkmark9.svg
checkmarkSmall.svg
chevron.svg
close.svg
cross.svg
eye.svg
fingerprint.svg
ad.svg
ae.svg
af.svg
ag.svg
ai.svg
al.svg
am.svg
ao.svg
ar.svg
as.svg
at.svg
au.svg
aw.svg
ax.svg
az.svg
ba.svg
bb.svg
bd.svg
be.svg
bf.svg
bg.svg
bh.svg
bi.svg
bj.svg
bm.svg
bn.svg
bo.svg
bq.svg
br.svg
bs.svg
bt.svg
bw.svg
by.svg
bz.svg
ca.svg
cc.svg
cd.svg
cf.svg
cg.svg
ch.svg
ci.svg
ck.svg
cl-vl.svg
cl.svg
cm.svg
cn.svg
co.svg
cr.svg
cu.svg
cv.svg
cw.svg
cx.svg
cy.svg
cz.svg
de.svg
dj.svg
dk.svg
dm.svg
do.svg
dz.svg
ec.svg
ee.svg
eg.svg
er.svg
es-ce.svg
es-cn.svg
es-ml.svg
es.svg
et.svg
eu.svg
fi.svg
fj.svg
fk.svg
fm-ksa.svg
fm-pni.svg
fm-trk.svg
fm-yap.svg
fm.svg
fo.svg
fr.svg
ga.svg
gb-eng.svg
gb-nir.svg
gb-sct.svg
gb-wls.svg
gd.svg
ge-ab.svg
ge-aj.svg
ge.svg
gf.svg
gg.svg
gh.svg
gi.svg
gl.svg
gm.svg
gn.svg
gq.svg
gr.svg
gs.svg
gt.svg
gu.svg
gy.svg
hk.svg
hn.svg
hr.svg
ht.svg
hu.svg
id.svg
ie.svg
il.svg
im.svg
in.svg
io.svg
iq.svg
ir.svg
is.svg
it.svg
je.svg
jm.svg
jo.svg
jp.svg
ke.svg
kg.svg
kh.svg
ki.svg
km.svg
kn.svg
kp.svg
kr.svg
kw.svg
ky.svg
kz.svg
la.svg
lb.svg
lc.svg
li.svg
lk.svg
lr.svg
ls.svg
lt.svg
lu.svg
lv.svg
ly.svg
ma.svg
mc.svg
md.svg
me.svg
mg.svg
mh.svg
mk.svg
ml.svg
mm.svg
mn.svg
mo.svg
mp.svg
mr.svg
ms.svg
mt.svg
mu.svg
mv.svg
mw.svg
mx.svg
my.svg
mz.svg
na.svg
nc.svg
ne.svg
nf.svg
ng.svg
ni.svg
nl-bq2.svg
nl-bq3.svg
nl.svg
no.svg
np.svg
nr.svg
nu.svg
nz.svg
om.svg
pa.svg
pe.svg
pf.svg
pg.svg
ph.svg
pk.svg
pl.svg
pn.svg
pr.svg
ps.svg
pt-30.svg
pt.svg
pw.svg
py.svg
qa.svg
re.svg
ro.svg
rs.svg
ru.svg
rw.svg
sa.svg
sb.svg
sc.svg
sd.svg
se.svg
sg.svg
sh-ta.svg
sh.svg
si.svg
sk.svg
sl.svg
sm.svg
sn.svg
so.svg
sr.svg
ss.svg
st.svg
sv.svg
sx.svg
sy.svg
sz.svg
tc.svg
td.svg
tg.svg
th.svg
tj.svg
tk.svg
tl.svg
tm.svg
tn.svg
to.svg
tr.svg
tt.svg
tv.svg
tw.svg
tz-eaz.svg
tz.svg
ua.svg
ug.svg
us.svg
uy.svg
uz.svg
va.svg
vc.svg
ve.svg
vg.svg
vn.svg
vu.svg
wf.svg
ws.svg
xk.svg
ye.svg
za.svg
zm.svg
zw.svg
icon128.png
icon16-active.png
icon16.png
icon19-active.png
icon19.png
icon24-active.png
icon24.png
icon256.png
icon32-active.png
icon32.png
icon38-active.png
icon38.png
icon48.png
icon64.png
info.svg
ipInfo.svg
lock.svg
markerGreen.svg
markerOrange.svg
markerRed.svg
offline.svg
processing.svg
sl.svg
upgrade.svg
warning.svg
background.js
manifest.json
messages.json
verified_contents.json
content.bundle.js
fpattr.bundle.js
messages.json
manifest.json
Network Persistent State
TransportSecurity
TransportSecurity
f37eb823-d673-473c-833d-538ad148bb01.tmp
Preferences
Preferences
Preferences
Preferences~RFe58dfad.TMP
Secure Preferences
Secure Preferences
the-real-index
the-real-index~RFe58faf5.TMP
index
ff89991c-9bda-474b-a662-b7e1f5d0edc2.tmp
Local State
Local State
Local State
Local State~RFe58dfad.TMP
settings.dat
the-real-index
Network Persistent State
Network Persistent State
Preferences
Preferences
CURRENT
Local State
Local State
Local State
1fb80402-df1c-47f0-98c1-6e2060bce2e6.tmp
b1f85c43-11e9-4eec-90ab-b2cefb301dc7.tmp
c73f9cf7-7bda-443a-8b0c-ef2c322d597c.tmp
cd703bfa-f9ca-48a2-a950-8a0c953e34ef.tmp
f5ac439f-e2d2-4ead-b358-6842f2e9a409.tmp
favj1g2q.exe
utorrent_installer(2).tmp
AVG_BRW.png
Logo.png
RAV_Cross.png
WebAdvisor.png
botva2.dll
component0.exe
component1.zip
installer.exe
saBSI.exe
component2.zip
avg_secure_browser_setup.exe
uTorrent.exe
AVGBrowserUpdateSetup.exe
CR.History.tmp
CR.History.tmp
FF.places.tmp
JsisPlugins.dll
Midex.dll
StdUtils.dll
jsis.dll
nsJSON.dll
thirdparty.dll
INetC.dll
System.dll
bt_datachannel.dll
nsisFirewall.dll
utorrent.exe
Microsoft.Win32.TaskScheduler.dll
RAVEndPointProtection-installer.exe
rsAtom.dll
rsJSON.dll
rsLogger.dll
rsStubLib.dll
rsSyncSvc.exe
rsServiceController.DLL
rsAtom.DLL
rsJSON.DLL
rsLogger.DLL
uninstall.ico
icon48.png
icon.png
icon.svg
webstore.js
ebd43220-2c39-4210-a2d8-09d83a0623bc.tmp
gb.svg
b2c6797b-7fef-4889-af11-4cc8a29457dd.tmp
icon_16.png
messages.json
messages.json
allowed.png
blocked.png
icon_close.png
logger_icon.png
logger_table_icon.jpg
pro.png
table_list_icon.png
table_regex_icon.png
warning.png
background.bundle.js.LICENSE.txt
options.bundle.js.LICENSE.txt
icon_128.png
icon_16.png
icon_32.png
icon_48.png
ai_chat.png
arrow.png
conversation_logo.gif
conversation_logo.png
genie.png
messages.png
ai_chat.bundle.js.LICENSE.txt
AVG Secure Browser.lnk
helper.exe
helper_web_ui.btinstall
settings.dat
memory/1380-146-0x000001C6221F0000-0x000001C6221F8000-memory.dmp
memory/1380-147-0x000001C63CC60000-0x000001C63D188000-memory.dmp
memory/1904-293-0x0000020FE2D80000-0x0000020FE2DB0000-memory.dmp
memory/1904-289-0x0000020FE2860000-0x0000020FE28E8000-memory.dmp
memory/1904-291-0x0000020FE45A0000-0x0000020FE45E0000-memory.dmp
memory/1904-4041-0x0000020FFD4C0000-0x0000020FFD4FA000-memory.dmp
memory/1904-4115-0x0000020FFD5A0000-0x0000020FFD5CE000-memory.dmp
memory/1904-4076-0x0000020FFD4C0000-0x0000020FFD4EA000-memory.dmp
memory/1904-315-0x0000020FFCF90000-0x0000020FFCFCA000-memory.dmp
memory/1904-350-0x0000020FFD000000-0x0000020FFD02A000-memory.dmp
memory/1904-366-0x0000020FFD090000-0x0000020FFD0E8000-memory.dmp
memory/1904-4057-0x0000020FFD4C0000-0x0000020FFD4F0000-memory.dmp
memory/1904-3544-0x0000020F80020000-0x0000020F80070000-memory.dmp
memory/2592-120-0x0000000000400000-0x00000000009C2000-memory.dmp
memory/2592-96-0x0000000000400000-0x00000000009C2000-memory.dmp
memory/3092-1542-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-1269-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-894-0x00007FF822A00000-0x00007FF822A10000-memory.dmp
memory/3092-1773-0x00007FF822A00000-0x00007FF822A10000-memory.dmp
memory/3092-1774-0x00007FF822A00000-0x00007FF822A10000-memory.dmp
memory/3092-902-0x00007FF822A00000-0x00007FF822A10000-memory.dmp
memory/3092-1775-0x00007FF822A00000-0x00007FF822A10000-memory.dmp
memory/3092-941-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1776-0x00007FF822A00000-0x00007FF822A10000-memory.dmp
memory/3092-909-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-998-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-922-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-940-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-910-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-911-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-1068-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-1080-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-1076-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-1054-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-1046-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-1091-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-1095-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-1035-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-1027-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-1026-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-1018-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-985-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-964-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-958-0x00007FF7BF870000-0x00007FF7BF880000-memory.dmp
memory/3092-933-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1086-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-1249-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1247-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1335-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1276-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-1117-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1244-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1241-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1736-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1237-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1227-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1216-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1185-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1772-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1171-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3092-1122-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1141-0x00007FF80C340000-0x00007FF80C350000-memory.dmp
memory/3092-1155-0x00007FF823E40000-0x00007FF823E50000-memory.dmp
memory/3268-4446-0x0000000000400000-0x00000000009C2000-memory.dmp
memory/3268-901-0x0000000000400000-0x00000000009C2000-memory.dmp
memory/3636-15-0x00000000049F0000-0x00000000049FF000-memory.dmp
memory/3636-6-0x0000000000400000-0x000000000070F000-memory.dmp
memory/3636-36-0x00000000049F0000-0x00000000049FF000-memory.dmp
memory/3636-892-0x0000000000400000-0x000000000070F000-memory.dmp
memory/3636-28-0x0000000000400000-0x000000000070F000-memory.dmp
memory/3636-29-0x00000000049F0000-0x00000000049FF000-memory.dmp
memory/3636-35-0x0000000000400000-0x000000000070F000-memory.dmp
memory/3636-2037-0x0000000000400000-0x000000000070F000-memory.dmp
memory/3636-69-0x00000000049F0000-0x00000000049FF000-memory.dmp
memory/3636-68-0x0000000000400000-0x000000000070F000-memory.dmp
memory/4864-27-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/4864-2-0x0000000000401000-0x00000000004B7000-memory.dmp
memory/4864-0-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/8160-4174-0x000001F2FD980000-0x000001F2FD9BC000-memory.dmp
memory/8160-4173-0x000001F2E5230000-0x000001F2E5242000-memory.dmp
memory/8160-4160-0x000001F2E34B0000-0x000001F2E34DE000-memory.dmp
memory/8160-4159-0x000001F2E34B0000-0x000001F2E34DE000-memory.dmp
memory/8676-4211-0x0000022D62FF0000-0x0000022D6300A000-memory.dmp
memory/8676-4209-0x0000022D7BC30000-0x0000022D7BF96000-memory.dmp
memory/8676-4212-0x0000022D63070000-0x0000022D63092000-memory.dmp
memory/8676-4210-0x0000022D7BFA0000-0x0000022D7C11C000-memory.dmp