Analysis
-
max time kernel
130s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 17:52
Static task
static1
General
-
Target
CheatEngine75.exe
-
Size
28.5MB
-
MD5
0fa34a970c3defa54dbc6b725e03b83d
-
SHA1
44fa4a2d4d3fc9259fb03324eb390def62ff786a
-
SHA256
93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a
-
SHA512
2ec36599bae79365cfb02edc475ca416b4cd85c9cf349b0cc548e145a10fb22b2fae5ce504e76725e6832028cda3fd6b2bec4adfb7dbf49738e952651a5b7e90
-
SSDEEP
786432:yTCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFH:y2EXFhV0KAcNjxAItj
Malware Config
Signatures
-
Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
Processes:
cheatengine-x86_64-SSE4-AVX2.exedescription ioc process File opened for modification C:\Windows\System32\WINTRUST.dll cheatengine-x86_64-SSE4-AVX2.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
icacls.exeicacls.exepid process 2904 icacls.exe 4848 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AVGBrowser.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVGBrowserAutoLaunch_2539D9FFF1F40C0A976762D6C815D3E3 = "\"C:\\Program Files\\AVG\\Browser\\Application\\AVGBrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"Default\"" AVGBrowser.exe -
Checks for any installed AV software in registry 1 TTPs 14 IoCs
Processes:
CheatEngine75.tmpavg_secure_browser_setup.exeAVGBrowser.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir CheatEngine75.tmp Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast AVGBrowser.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus AVGBrowser.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir CheatEngine75.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Browser\Installed CheatEngine75.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\Browser\Installed CheatEngine75.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast AVGBrowser.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast CheatEngine75.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast CheatEngine75.tmp Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\AVG\AV\Dir CheatEngine75.tmp Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\AVAST Software\Avast CheatEngine75.tmp Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Avira\Browser\Installed CheatEngine75.tmp -
Downloads MZ/PE file
-
Modifies Installed Components in the registry 2 TTPs 7 IoCs
Processes:
setup.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\ = "AVG Secure Browser" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\StubPath = "\"C:\\Program Files\\AVG\\Browser\\Application\\124.0.25069.209\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Localized Name = "AVG Secure Browser" setup.exe -
Sets file execution options in registry 2 TTPs 2 IoCs
Processes:
AVGBrowserUpdate.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe AVGBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe\DisableExceptionChainValidation = "0" AVGBrowserUpdate.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
avg_secure_browser_setup.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowser.exedescription ioc process File opened for modification \??\PhysicalDrive0 avg_secure_browser_setup.exe File opened for modification \??\PhysicalDrive0 AVGBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 AVGBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 AVGBrowser.exe -
Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
avg_secure_browser_setup.exeAVGBrowserUpdate.exeCheat Engine.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeCheatEngine75.tmpprod0.exeAVGBrowser.exeAVGBrowser.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation avg_secure_browser_setup.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation AVGBrowserUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation Cheat Engine.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation CheatEngine75.tmp Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation prod0.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation AVGBrowser.exe -
Drops file in System32 directory 64 IoCs
Processes:
cheatengine-x86_64-SSE4-AVX2.exedescription ioc process File opened for modification C:\Windows\SYSTEM32\Wldp.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\ADVAPI32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\NSI.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\wsock32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\clbcatq.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\system32\explorerframe.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\windows.storage.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\USER32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\CRYPT32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\rasadhlp.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\GLU32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\bcryptPrimitives.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\IPHLPAPI.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\USERENV.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\SAMCLI.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\advapi32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\Windows.Security.Authentication.OnlineId.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\fwpuclnt.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\GDI32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\msvcp_win.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\Cabinet.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\SSPICLI.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\WINSTA.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\UMPDC.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\system32\wbem\fastprox.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\DPAPI.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\version.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\msimg32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\msxml6.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\urlmon.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\system32\schannel.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\KERNELBASE.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\shell32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\system32\wbem\wbemprox.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\wbemcomn.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\system32\ncryptsslp.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\msdelta.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\Windows.Networking.Connectivity.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\Normaliz.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\ole32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\comdlg32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\ws2_32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\psapi.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\OLEAUT32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\Secur32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\dhcpcsvc.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\winhttp.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\cryptnet.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\sxs.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\uxtheme.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\PROPSYS.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\DNSAPI.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\gdi32full.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\winmm.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\SETUPAPI.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\msi.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\system32\rsaenh.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\system32\mswsock.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\wininet.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\profapi.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\PSAPI.DLL cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\OneCoreUAPCommonProxyStub.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\SYSTEM32\mskeyprotect.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\System32\combase.dll cheatengine-x86_64-SSE4-AVX2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
Processes:
AVGBrowser.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName AVGBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer AVGBrowser.exe -
Drops file in Program Files directory 64 IoCs
Processes:
AVGBrowserUpdate.execheatengine-x86_64-SSE4-AVX2.exeinstaller.exeCheatEngine75.tmpinstaller.exeAVGBrowserUpdateSetup.exesetup.exedescription ioc process File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_id.dll AVGBrowserUpdate.exe File opened for modification C:\Program Files\Cheat Engine 7.5\symbols\DLL\iphlpapi.pdb cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ClickToRun\sechost.pdb cheatengine-x86_64-SSE4-AVX2.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-da-DK.js installer.exe File created C:\Program Files\Cheat Engine 7.5\languages\is-D19B1.tmp CheatEngine75.tmp File created C:\Program Files\McAfee\Temp2974819079\jslang\wa-res-shared-sk-SK.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-ja-JP.js installer.exe File opened for modification C:\Program Files\Cheat Engine 7.5\symbols\dll\wintrust.pdb cheatengine-x86_64-SSE4-AVX2.exe File created C:\Program Files\Cheat Engine 7.5\include\sys\is-KUFH8.tmp CheatEngine75.tmp File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-nb-NO.js installer.exe File opened for modification C:\Program Files\Cheat Engine 7.5\dll\devobj.pdb cheatengine-x86_64-SSE4-AVX2.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-nb-NO.js installer.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ClickToRun\DLL\netutils.pdb cheatengine-x86_64-SSE4-AVX2.exe File created C:\Program Files (x86)\GUME57E.tmp\acuapi_64.dll AVGBrowserUpdateSetup.exe File created C:\Program Files\McAfee\Temp2974819079\jslang\wa-res-install-sk-SK.js installer.exe File created C:\Program Files\McAfee\Temp2974819079\jslang\wa-res-shared-zh-TW.js installer.exe File opened for modification C:\Program Files\AVG\Browser\Application\AVGBrowser.exe setup.exe File created C:\Program Files\McAfee\Temp2974819079\jslang\wa-res-shared-nl-NL.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_utils_wss.luc installer.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-sstoast.css installer.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\installer_background.png installer.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\amazon_upsell_handler.luc installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-nb-NO.js installer.exe File opened for modification C:\Program Files\Cheat Engine 7.5\DLL\dhcpcsvc6.pdb cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ClickToRun\dll\oleaut32.pdb cheatengine-x86_64-SSE4-AVX2.exe File created C:\Program Files\Cheat Engine 7.5\include\sys\is-R4KDL.tmp CheatEngine75.tmp File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-sv-SE.js installer.exe File opened for modification C:\Program Files\Cheat Engine 7.5\schannel.pdb cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Program Files\Cheat Engine 7.5\rasadhlp.pdb cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ClickToRun\shcore.pdb cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ClickToRun\symbols\dll\userenv.pdb cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ClickToRun\symbols\DLL\psapi.pdb cheatengine-x86_64-SSE4-AVX2.exe File created C:\Program Files\McAfee\WebAdvisor\logic\aj_logic.luc installer.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\ext_install_handler.luc installer.exe File opened for modification C:\Program Files\Cheat Engine 7.5\glu32.pdb cheatengine-x86_64-SSE4-AVX2.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-zh-CN.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-de-DE.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-zh-CN.js installer.exe File created C:\Program Files (x86)\GUME57E.tmp\goopdateres_zh-CN.dll AVGBrowserUpdateSetup.exe File created C:\Program Files\McAfee\Temp2974819079\jslang\wa-res-install-sr-Latn-CS.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-sr-Latn-CS.js installer.exe File created C:\Program Files\AVG\Browser\Application\initial_preferences setup.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\core\win32helper.luc installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-it-IT.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-es-MX.js installer.exe File opened for modification C:\Program Files\Cheat Engine 7.5\dll\rasadhlp.pdb cheatengine-x86_64-SSE4-AVX2.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ui-dialog.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-zh-TW.js installer.exe File opened for modification C:\Program Files\Cheat Engine 7.5\symbols\dll\propsys.pdb cheatengine-x86_64-SSE4-AVX2.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.css installer.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-checklist.html installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-sv-SE.js installer.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ClickToRun\dll\gdi32.pdb cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Program Files\Cheat Engine 7.5\d3dhook64.dll CheatEngine75.tmp File created C:\Program Files\Cheat Engine 7.5\is-MT6PK.tmp CheatEngine75.tmp File created C:\Program Files\McAfee\WebAdvisor\MFW\core\priorityqueue.luc installer.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\mwb\wa-mwb-checklist.html installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-cs-CZ.js installer.exe File created C:\Program Files\AVG\Browser\Temp\source6080_1058542882\Safer-bin\124.0.25069.209\Locales\kn.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source6080_1058542882\Safer-bin\124.0.25069.209\mimic.dll setup.exe File opened for modification C:\Program Files\Cheat Engine 7.5\wbemprox.pdb cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Program Files\Cheat Engine 7.5\ced3d10hook.dll CheatEngine75.tmp File created C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-sr-Latn-CS.js installer.exe -
Drops file in Windows directory 3 IoCs
Processes:
LogonUI.execheatengine-x86_64-SSE4-AVX2.exedescription ioc process File created C:\Windows\rescache\_merged\2229298842\2808861105.pri LogonUI.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\comctl32.dll cheatengine-x86_64-SSE4-AVX2.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\Comctl32.dll cheatengine-x86_64-SSE4-AVX2.exe -
Executes dropped EXE 64 IoCs
Processes:
CheatEngine75.tmpprod0.exesaBSI.exeavg_secure_browser_setup.exeCheatEngine75.exeCheatEngine75.tmpampsbxga.exeRAVEndPointProtection-installer.exe_setup64.tmpAVGBrowserUpdateSetup.exersSyncSvc.exeAVGBrowserUpdate.exersSyncSvc.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdate.exeKernelmoduleunloader.exeAVGBrowserUpdate.exeinstaller.exeAVGBrowserUpdate.exewindowsrepair.exeinstaller.exeCheat Engine.execheatengine-x86_64-SSE4-AVX2.exeAVGBrowserInstaller.exesetup.exesetup.exeAVGBrowserCrashHandler.exeAVGBrowserCrashHandler64.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeelevation_service.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeelevation_service.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exepid process 1452 CheatEngine75.tmp 2080 prod0.exe 2488 saBSI.exe 764 avg_secure_browser_setup.exe 4580 CheatEngine75.exe 3748 CheatEngine75.tmp 740 ampsbxga.exe 4948 RAVEndPointProtection-installer.exe 1856 _setup64.tmp 3128 AVGBrowserUpdateSetup.exe 1064 rsSyncSvc.exe 2180 AVGBrowserUpdate.exe 3656 rsSyncSvc.exe 3712 AVGBrowserUpdate.exe 1912 AVGBrowserUpdate.exe 2680 AVGBrowserUpdateComRegisterShell64.exe 4548 AVGBrowserUpdateComRegisterShell64.exe 4992 AVGBrowserUpdateComRegisterShell64.exe 1440 AVGBrowserUpdate.exe 4576 Kernelmoduleunloader.exe 3772 AVGBrowserUpdate.exe 4920 installer.exe 676 AVGBrowserUpdate.exe 400 windowsrepair.exe 372 installer.exe 5892 Cheat Engine.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 6032 AVGBrowserInstaller.exe 6080 setup.exe 6100 setup.exe 1904 AVGBrowserCrashHandler.exe 3396 AVGBrowserCrashHandler64.exe 3028 AVGBrowser.exe 5984 AVGBrowser.exe 4864 AVGBrowser.exe 2436 AVGBrowser.exe 3952 AVGBrowser.exe 2108 elevation_service.exe 6112 AVGBrowser.exe 1436 AVGBrowser.exe 1652 AVGBrowser.exe 2364 AVGBrowser.exe 1472 AVGBrowser.exe 5108 AVGBrowser.exe 3528 elevation_service.exe 4052 AVGBrowser.exe 1900 AVGBrowser.exe 3144 AVGBrowser.exe 3200 AVGBrowser.exe 4700 AVGBrowser.exe 2152 AVGBrowser.exe 1660 AVGBrowser.exe 5136 AVGBrowser.exe 5316 AVGBrowser.exe 1684 AVGBrowser.exe 5304 AVGBrowser.exe 4308 AVGBrowser.exe 1740 AVGBrowser.exe 3208 AVGBrowser.exe 4524 AVGBrowser.exe 5072 AVGBrowser.exe 4428 AVGBrowser.exe 6092 AVGBrowser.exe 8072 AVGBrowser.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 2180 sc.exe 3252 sc.exe -
Loads dropped DLL 64 IoCs
Processes:
CheatEngine75.tmpavg_secure_browser_setup.exeampsbxga.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeinstaller.execheatengine-x86_64-SSE4-AVX2.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exepid process 1452 CheatEngine75.tmp 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 740 ampsbxga.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 2180 AVGBrowserUpdate.exe 3712 AVGBrowserUpdate.exe 1912 AVGBrowserUpdate.exe 2680 AVGBrowserUpdateComRegisterShell64.exe 1912 AVGBrowserUpdate.exe 4548 AVGBrowserUpdateComRegisterShell64.exe 1912 AVGBrowserUpdate.exe 4992 AVGBrowserUpdateComRegisterShell64.exe 1912 AVGBrowserUpdate.exe 2180 AVGBrowserUpdate.exe 2180 AVGBrowserUpdate.exe 1440 AVGBrowserUpdate.exe 3772 AVGBrowserUpdate.exe 676 AVGBrowserUpdate.exe 676 AVGBrowserUpdate.exe 3772 AVGBrowserUpdate.exe 372 installer.exe 676 AVGBrowserUpdate.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 3028 AVGBrowser.exe 5984 AVGBrowser.exe 3028 AVGBrowser.exe 3028 AVGBrowser.exe 4864 AVGBrowser.exe 2436 AVGBrowser.exe 4864 AVGBrowser.exe 2436 AVGBrowser.exe 4864 AVGBrowser.exe 2436 AVGBrowser.exe 3952 AVGBrowser.exe 4864 AVGBrowser.exe 4864 AVGBrowser.exe 4864 AVGBrowser.exe 3952 AVGBrowser.exe 3952 AVGBrowser.exe 4864 AVGBrowser.exe 4864 AVGBrowser.exe 4864 AVGBrowser.exe 3028 AVGBrowser.exe 6112 AVGBrowser.exe 1436 AVGBrowser.exe 6112 AVGBrowser.exe 1436 AVGBrowser.exe 1436 AVGBrowser.exe 6112 AVGBrowser.exe 1652 AVGBrowser.exe 1652 AVGBrowser.exe 1652 AVGBrowser.exe 2364 AVGBrowser.exe -
Registers COM server for autorun 1 TTPs 23 IoCs
Processes:
setup.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A725D612-7D72-48B8-857A-4777781F415C}\LocalServer32\ServerExecutable = "C:\\Program Files\\AVG\\Browser\\Application\\124.0.25069.209\\notification_helper.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll" AVGBrowserUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ThreadingModel = "Both" AVGBrowserUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{A725D612-7D72-48B8-857A-4777781F415C}\LocalServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ThreadingModel = "Both" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ThreadingModel = "Both" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ThreadingModel = "Both" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A725D612-7D72-48B8-857A-4777781F415C}\LocalServer32\ = "\"C:\\Program Files\\AVG\\Browser\\Application\\124.0.25069.209\\notification_helper.exe\"" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ThreadingModel = "Both" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ThreadingModel = "Both" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll" AVGBrowserUpdateComRegisterShell64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 5964 1452 WerFault.exe CheatEngine75.tmp 2700 1452 WerFault.exe CheatEngine75.tmp -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
AVGBrowser.exeavg_secure_browser_setup.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI avg_secure_browser_setup.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
CheatEngine75.tmpdescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CheatEngine75.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ CheatEngine75.tmp -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
AVGBrowser.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AVGBrowser.exe -
Processes:
AVGBrowserUpdate.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498} AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppName = "AVGBrowserUpdateWebPlugin.exe" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6" AVGBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\Policy = "3" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077} AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppName = "AVGBrowserUpdateBroker.exe" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6" AVGBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\Policy = "3" AVGBrowserUpdate.exe -
Modifies data under HKEY_USERS 27 IoCs
Processes:
LogonUI.exeAVGBrowserUpdate.exeAVGBrowser.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "237" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG\Browser AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\MachineId = "00009bb098663592a3a6086bcc2909e7" AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\endpoint = "update.avgbrowser.com" AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\hostprefix AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry AVGBrowser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\devmode = "0" AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\MachineIdDate = "20240525" AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133611333052608741" AVGBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\ AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe -
Modifies registry class 64 IoCs
Processes:
AVGBrowserUpdate.exeAVGBrowserUpdateComRegisterShell64.execheatengine-x86_64-SSE4-AVX2.exeAVGBrowserUpdate.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdate.exesetup.exeAVGBrowserUpdateComRegisterShell64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CoreClass.1\CLSID\ = "{384098DD-AB6D-412E-B819-2F10032D9767}" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A025DF-6171-460F-B9A1-29ECE33E754E}\NumMethods\ = "10" AVGBrowserUpdateComRegisterShell64.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96" cheatengine-x86_64-SSE4-AVX2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.ProcessLauncher\CLSID\ = "{E37D9308-A3C0-4EC3-87C5-222235C974E3}" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAAD654E-4B50-4C9F-A261-CF29CF884478}\Elevation AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{40C1C1D3-AAEA-46EE-AA2B-79A2CC62F257}\ = "goopdate CredentialDialog" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{40C1C1D3-AAEA-46EE-AA2B-79A2CC62F257}\LocalServer32 AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.OnDemandCOMClassSvc\CurVer AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.Update3WebSvc\CurVer\ = "AVGUpdate.Update3WebSvc.1.0" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7B73E65-20BA-407F-8A89-DF649EF82559}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28E08968-59C8-4A77-BEBA-12C9394AE077}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}\ = "CATID_AppContainerCompatible" AVGBrowserUpdate.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 02000000030000000000000001000000ffffffff cheatengine-x86_64-SSE4-AVX2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C7E81D6-0463-485E-8DF5-2ADAD81FAF40}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E37D9308-A3C0-4EC3-87C5-222235C974E3}\VersionIndependentProgID\ = "AVGUpdate.ProcessLauncher" AVGBrowserUpdate.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\MRUListEx = ffffffff cheatengine-x86_64-SSE4-AVX2.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3 = 14002e8005398e082303024b98265d99428e115f0000 cheatengine-x86_64-SSE4-AVX2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270}\ProxyStubClsid32 AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FBDC15B-BBCD-402B-A45F-1853B01A9E3C}\Elevation AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E21E991-301D-47FD-AB7A-99FBE864EF65}\NumMethods\ = "41" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 cheatengine-x86_64-SSE4-AVX2.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D} AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\NumMethods\ = "9" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C7E81D6-0463-485E-8DF5-2ADAD81FAF40}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270} AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{925547A3-663F-4673-A7B7-3FCACCDC4879}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C50E3A4-12A8-41FB-9941-E8EEB222E07E}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FBDC15B-BBCD-402B-A45F-1853B01A9E3C}\Elevation\Enabled = "1" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E22D0ED-B403-44D2-BABF-4DDD0DFCA692}\VersionIndependentProgID\ = "AVGUpdate.MiscUtils" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CoCreateAsync.1.0\CLSID AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{358EC846-617A-4763-8656-50BF6E0E8AA2}\1.0\ = "TypeLib for Interface {358EC846-617A-4763-8656-50BF6E0E8AA2}" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.shtml\OpenWithProgids\AvgHTML setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" cheatengine-x86_64-SSE4-AVX2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FBDC15B-BBCD-402B-A45F-1853B01A9E3C}\ProgID AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8159E37-5EDF-4E6D-8E6D-E558E8DDC2A0}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.OnDemandCOMClassMachineFallback\ = "Google Update Legacy On Demand" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191}\NumMethods\ = "8" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C32E10AE-6600-4A1E-8BEA-EF89A3072F93} AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BA03866-1403-40EA-81A9-23FCD97810E2}\ = "ICoCreateAsyncStatus" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6972DB5C-E9D6-4A81-B352-B415A3A61CA6} AVGBrowserUpdateComRegisterShell64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 cheatengine-x86_64-SSE4-AVX2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.Update3COMClassService.1.0\ = "Update3COMClass" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CoreClass\CLSID\ = "{384098DD-AB6D-412E-B819-2F10032D9767}" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A708F91-06A3-409E-83BC-4A5CF10C8025} AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC}\ = "IProcessLauncher" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C32E10AE-6600-4A1E-8BEA-EF89A3072F93}\NumMethods\ = "17" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C50E3A4-12A8-41FB-9941-E8EEB222E07E}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28E08968-59C8-4A77-BEBA-12C9394AE077}\InprocServer32 AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28E08968-59C8-4A77-BEBA-12C9394AE077}\InprocServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\npAvgBrowserUpdate3.dll" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7B73E65-20BA-407F-8A89-DF649EF82559}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\NumMethods\ = "9" AVGBrowserUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59577BB5-F97B-4880-B785-510238C5C5CE}\ = "IApp2" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A42B2494-93AE-44E1-B76D-BA8509A5167D}\ = "GoogleUpdate Update3Web" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A42B2494-93AE-44E1-B76D-BA8509A5167D}\Elevation AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\AvgQH\Capabilities setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82C85EAA-7C94-4702-AA75-DF39403AE358}\ = "Update3COMClass" AVGBrowserUpdate.exe -
Processes:
saBSI.exeinstaller.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 saBSI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 saBSI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 saBSI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 saBSI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 saBSI.exe -
Runs net.exe
-
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 78 Cheat Engine 7.5 : luascript-CEVersionCheck HTTP User-Agent header 18 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 78 Cheat Engine 7.5 : luascript-ceshare -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
CheatEngine75.tmpsaBSI.exeCheatEngine75.tmpavg_secure_browser_setup.exeAVGBrowserUpdate.exepid process 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 1452 CheatEngine75.tmp 2488 saBSI.exe 2488 saBSI.exe 2488 saBSI.exe 2488 saBSI.exe 2488 saBSI.exe 2488 saBSI.exe 2488 saBSI.exe 2488 saBSI.exe 2488 saBSI.exe 2488 saBSI.exe 3748 CheatEngine75.tmp 3748 CheatEngine75.tmp 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 764 avg_secure_browser_setup.exe 2180 AVGBrowserUpdate.exe 2180 AVGBrowserUpdate.exe 2180 AVGBrowserUpdate.exe 2180 AVGBrowserUpdate.exe 2180 AVGBrowserUpdate.exe 2180 AVGBrowserUpdate.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
cheatengine-x86_64-SSE4-AVX2.exepid process 5924 cheatengine-x86_64-SSE4-AVX2.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
AVGBrowser.exepid process 3028 AVGBrowser.exe 3028 AVGBrowser.exe 3028 AVGBrowser.exe 3028 AVGBrowser.exe 3028 AVGBrowser.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
prod0.exeRAVEndPointProtection-installer.exeAVGBrowserUpdate.exeCheatEngine75.execheatengine-x86_64-SSE4-AVX2.exeAVGBrowserInstaller.exeAVGBrowser.exedescription pid process Token: SeDebugPrivilege 2080 prod0.exe Token: SeDebugPrivilege 4948 RAVEndPointProtection-installer.exe Token: SeDebugPrivilege 2180 AVGBrowserUpdate.exe Token: SeDebugPrivilege 2180 AVGBrowserUpdate.exe Token: SeDebugPrivilege 2180 AVGBrowserUpdate.exe Token: SeShutdownPrivilege 4948 RAVEndPointProtection-installer.exe Token: SeCreatePagefilePrivilege 4948 RAVEndPointProtection-installer.exe Token: SeShutdownPrivilege 4580 CheatEngine75.exe Token: SeDebugPrivilege 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: SeTcbPrivilege 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: SeTcbPrivilege 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: SeLoadDriverPrivilege 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: SeCreateGlobalPrivilege 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: SeLockMemoryPrivilege 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: 33 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: SeSecurityPrivilege 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: SeTakeOwnershipPrivilege 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: SeManageVolumePrivilege 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: SeBackupPrivilege 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: SeCreatePagefilePrivilege 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: SeShutdownPrivilege 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: SeRestorePrivilege 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: 33 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: SeIncBasePriorityPrivilege 5924 cheatengine-x86_64-SSE4-AVX2.exe Token: 33 6032 AVGBrowserInstaller.exe Token: SeIncBasePriorityPrivilege 6032 AVGBrowserInstaller.exe Token: SeShutdownPrivilege 3028 AVGBrowser.exe Token: SeCreatePagefilePrivilege 3028 AVGBrowser.exe Token: SeShutdownPrivilege 3028 AVGBrowser.exe Token: SeCreatePagefilePrivilege 3028 AVGBrowser.exe Token: SeShutdownPrivilege 3028 AVGBrowser.exe Token: SeCreatePagefilePrivilege 3028 AVGBrowser.exe Token: SeShutdownPrivilege 3028 AVGBrowser.exe Token: SeCreatePagefilePrivilege 3028 AVGBrowser.exe Token: SeShutdownPrivilege 3028 AVGBrowser.exe Token: SeCreatePagefilePrivilege 3028 AVGBrowser.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
CheatEngine75.tmpCheatEngine75.tmpcheatengine-x86_64-SSE4-AVX2.exepid process 1452 CheatEngine75.tmp 3748 CheatEngine75.tmp 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
LogonUI.execheatengine-x86_64-SSE4-AVX2.exeKernelmoduleunloader.exepid process 1468 LogonUI.exe 1468 LogonUI.exe 5924 cheatengine-x86_64-SSE4-AVX2.exe 8924 Kernelmoduleunloader.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
CheatEngine75.exeCheatEngine75.tmpCheatEngine75.exeCheatEngine75.tmpprod0.exenet.exeampsbxga.exenet.exeavg_secure_browser_setup.exeRAVEndPointProtection-installer.exeAVGBrowserUpdateSetup.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exedescription pid process target process PID 2408 wrote to memory of 1452 2408 CheatEngine75.exe CheatEngine75.tmp PID 2408 wrote to memory of 1452 2408 CheatEngine75.exe CheatEngine75.tmp PID 2408 wrote to memory of 1452 2408 CheatEngine75.exe CheatEngine75.tmp PID 1452 wrote to memory of 2080 1452 CheatEngine75.tmp prod0.exe PID 1452 wrote to memory of 2080 1452 CheatEngine75.tmp prod0.exe PID 1452 wrote to memory of 2488 1452 CheatEngine75.tmp saBSI.exe PID 1452 wrote to memory of 2488 1452 CheatEngine75.tmp saBSI.exe PID 1452 wrote to memory of 2488 1452 CheatEngine75.tmp saBSI.exe PID 1452 wrote to memory of 764 1452 CheatEngine75.tmp avg_secure_browser_setup.exe PID 1452 wrote to memory of 764 1452 CheatEngine75.tmp avg_secure_browser_setup.exe PID 1452 wrote to memory of 764 1452 CheatEngine75.tmp avg_secure_browser_setup.exe PID 1452 wrote to memory of 4580 1452 CheatEngine75.tmp CheatEngine75.exe PID 1452 wrote to memory of 4580 1452 CheatEngine75.tmp CheatEngine75.exe PID 1452 wrote to memory of 4580 1452 CheatEngine75.tmp CheatEngine75.exe PID 4580 wrote to memory of 3748 4580 CheatEngine75.exe CheatEngine75.tmp PID 4580 wrote to memory of 3748 4580 CheatEngine75.exe CheatEngine75.tmp PID 4580 wrote to memory of 3748 4580 CheatEngine75.exe CheatEngine75.tmp PID 3748 wrote to memory of 4504 3748 CheatEngine75.tmp net.exe PID 3748 wrote to memory of 4504 3748 CheatEngine75.tmp net.exe PID 2080 wrote to memory of 740 2080 prod0.exe ampsbxga.exe PID 2080 wrote to memory of 740 2080 prod0.exe ampsbxga.exe PID 2080 wrote to memory of 740 2080 prod0.exe ampsbxga.exe PID 4504 wrote to memory of 3400 4504 net.exe net1.exe PID 4504 wrote to memory of 3400 4504 net.exe net1.exe PID 3748 wrote to memory of 3416 3748 CheatEngine75.tmp net.exe PID 3748 wrote to memory of 3416 3748 CheatEngine75.tmp net.exe PID 740 wrote to memory of 4948 740 ampsbxga.exe RAVEndPointProtection-installer.exe PID 740 wrote to memory of 4948 740 ampsbxga.exe RAVEndPointProtection-installer.exe PID 3416 wrote to memory of 5116 3416 net.exe net1.exe PID 3416 wrote to memory of 5116 3416 net.exe net1.exe PID 3748 wrote to memory of 2180 3748 CheatEngine75.tmp AVGBrowserUpdate.exe PID 3748 wrote to memory of 2180 3748 CheatEngine75.tmp AVGBrowserUpdate.exe PID 3748 wrote to memory of 3252 3748 CheatEngine75.tmp sc.exe PID 3748 wrote to memory of 3252 3748 CheatEngine75.tmp sc.exe PID 3748 wrote to memory of 1856 3748 CheatEngine75.tmp _setup64.tmp PID 3748 wrote to memory of 1856 3748 CheatEngine75.tmp _setup64.tmp PID 3748 wrote to memory of 2904 3748 CheatEngine75.tmp icacls.exe PID 3748 wrote to memory of 2904 3748 CheatEngine75.tmp icacls.exe PID 764 wrote to memory of 3128 764 avg_secure_browser_setup.exe AVGBrowserUpdateSetup.exe PID 764 wrote to memory of 3128 764 avg_secure_browser_setup.exe AVGBrowserUpdateSetup.exe PID 764 wrote to memory of 3128 764 avg_secure_browser_setup.exe AVGBrowserUpdateSetup.exe PID 4948 wrote to memory of 1064 4948 RAVEndPointProtection-installer.exe rsSyncSvc.exe PID 4948 wrote to memory of 1064 4948 RAVEndPointProtection-installer.exe rsSyncSvc.exe PID 3128 wrote to memory of 2180 3128 AVGBrowserUpdateSetup.exe AVGBrowserUpdate.exe PID 3128 wrote to memory of 2180 3128 AVGBrowserUpdateSetup.exe AVGBrowserUpdate.exe PID 3128 wrote to memory of 2180 3128 AVGBrowserUpdateSetup.exe AVGBrowserUpdate.exe PID 2180 wrote to memory of 3712 2180 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 2180 wrote to memory of 3712 2180 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 2180 wrote to memory of 3712 2180 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 2180 wrote to memory of 1912 2180 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 2180 wrote to memory of 1912 2180 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 2180 wrote to memory of 1912 2180 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1912 wrote to memory of 2680 1912 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 1912 wrote to memory of 2680 1912 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 1912 wrote to memory of 4548 1912 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 1912 wrote to memory of 4548 1912 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 1912 wrote to memory of 4992 1912 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 1912 wrote to memory of 4992 1912 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 2180 wrote to memory of 1440 2180 AVGBrowserUpdate.exe DllHost.exe PID 2180 wrote to memory of 1440 2180 AVGBrowserUpdate.exe DllHost.exe PID 2180 wrote to memory of 1440 2180 AVGBrowserUpdate.exe DllHost.exe PID 3748 wrote to memory of 4576 3748 CheatEngine75.tmp Kernelmoduleunloader.exe PID 3748 wrote to memory of 4576 3748 CheatEngine75.tmp Kernelmoduleunloader.exe PID 3748 wrote to memory of 4576 3748 CheatEngine75.tmp Kernelmoduleunloader.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-QCFNC.tmp\CheatEngine75.tmp"C:\Users\Admin\AppData\Local\Temp\is-QCFNC.tmp\CheatEngine75.tmp" /SL5="$90060,29019897,780800,C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"2⤵
- Checks for any installed AV software in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\prod0.exe"C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\prod0.exe" -ip:"dui=468f6343-c0e6-4931-9703-30c6539573cb&dit=20240525175311&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&b=&se=true" -vp:"dui=468f6343-c0e6-4931-9703-30c6539573cb&dit=20240525175311&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=468f6343-c0e6-4931-9703-30c6539573cb&dit=20240525175311&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100" -i -v -d -se=true3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ampsbxga.exe"C:\Users\Admin\AppData\Local\Temp\ampsbxga.exe" /silent4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nssDA06.tmp\RAVEndPointProtection-installer.exe"C:\Users\Admin\AppData\Local\Temp\nssDA06.tmp\RAVEndPointProtection-installer.exe" "C:\Users\Admin\AppData\Local\Temp\ampsbxga.exe" /silent5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:106⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\prod1_extract\saBSI.exe"C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\prod1_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\prod1_extract\installer.exe"C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\prod1_extract\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade4⤵
- Drops file in Program Files directory
- Executes dropped EXE
-
C:\Program Files\McAfee\Temp2974819079\installer.exe"C:\Program Files\McAfee\Temp2974819079\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade5⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\prod2_extract\avg_secure_browser_setup.exe"C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\prod2_extract\avg_secure_browser_setup.exe" /s /run_source=avg_ads_is_control /is_pixel_psh=BjYV6dEE0ouxORtIQJjzjmZQUDZZC2UVYdBnNdSPr4cP5mpcdKyAbCZuvHNCzLhF4nPyXeyZXyjhCts /make-default3⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsiCD16.tmp\AVGBrowserUpdateSetup.exeAVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9230&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Diexplore --import-cookies --auto-launch-chrome"4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\GUME57E.tmp\AVGBrowserUpdate.exe"C:\Program Files (x86)\GUME57E.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9230&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Diexplore --import-cookies --auto-launch-chrome"5⤵
- Sets file execution options in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezcwQ0E4RUU1LUFFNDAtNEU5RS04OUJDLUEyQTlERTBCMUE2Mn0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9Ins3MENFRjNCMS1DMDI5LTQ2RDktODA2Mi03MjZBMzNBNEFDRkV9IiB1c2VyaWRfZGF0ZT0iMjAyNDA1MjUiIG1hY2hpbmVpZD0iezAwMDA5QkIwLTk4NjYtMzU5Mi1BM0E2LTA4NkJDQzI5MDlFN30iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDUyNSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9Ins0MTk3MDNERS03MTRDLTQzMjgtOEQ5RC1GQUYwNjVDNTlGQUF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLVVTIiBicmFuZD0iOTIzMCIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMjM1OSIvPjwvYXBwPjwvcmVxdWVzdD46⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9230&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Diexplore --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{70CA8EE5-AE40-4E9E-89BC-A2A9DE0B1A62}" /silent6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\CheatEngine75.exe"C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-L2DP2.tmp\CheatEngine75.tmp"C:\Users\Admin\AppData\Local\Temp\is-L2DP2.tmp\CheatEngine75.tmp" /SL5="$201FE,26511452,832512,C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\net.exe"net" stop BadlionAntic5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BadlionAntic6⤵
-
C:\Windows\SYSTEM32\net.exe"net" stop BadlionAnticheat5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BadlionAnticheat6⤵
-
C:\Windows\SYSTEM32\sc.exe"sc" delete BadlionAntic5⤵
- Launches sc.exe
-
C:\Windows\SYSTEM32\sc.exe"sc" delete BadlionAnticheat5⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\is-9DSIP.tmp\_isetup\_setup64.tmphelper 105 0x4645⤵
- Executes dropped EXE
-
C:\Windows\system32\icacls.exe"icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)5⤵
- Modifies file permissions
-
C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe"C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe" /SETUP5⤵
- Executes dropped EXE
-
C:\Program Files\Cheat Engine 7.5\windowsrepair.exe"C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /s5⤵
- Executes dropped EXE
-
C:\Windows\system32\icacls.exe"icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)5⤵
- Modifies file permissions
-
C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe"C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe"C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe"4⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 9803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 9803⤵
- Program crash
-
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:101⤵
- Executes dropped EXE
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{D6D407EA-C573-42ED-9069-9E3736A51B1F}\AVGBrowserInstaller.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{D6D407EA-C573-42ED-9069-9E3736A51B1F}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=iexplore --import-cookies --auto-launch-chrome --system-level2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{D6D407EA-C573-42ED-9069-9E3736A51B1F}\CR_38CCD.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{D6D407EA-C573-42ED-9069-9E3736A51B1F}\CR_38CCD.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{D6D407EA-C573-42ED-9069-9E3736A51B1F}\CR_38CCD.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=iexplore --import-cookies --auto-launch-chrome --system-level3⤵
- Modifies Installed Components in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{D6D407EA-C573-42ED-9069-9E3736A51B1F}\CR_38CCD.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{D6D407EA-C573-42ED-9069-9E3736A51B1F}\CR_38CCD.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ff7fee3a3f0,0x7ff7fee3a3fc,0x7ff7fee3a4084⤵
- Executes dropped EXE
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39f2855 /state1:0x41c64e6d1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1452 -ip 14521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1452 -ip 14521⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --single-argument C:\Users\Admin\Desktop\ShowWrite.htm1⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ffd160cdc40,0x7ffd160cdc4c,0x7ffd160cdc582⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2156,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2032,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:32⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2312,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3320,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3408,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:22⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3632,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3644,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:22⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4716,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4932,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:12⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5424,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5428,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5676,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5832,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5356,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5828,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6308,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5864,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5348,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5532,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6928,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7140,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6632,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7440,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6636,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7740,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7884,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8044,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:82⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=5268,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=8216 /prefetch:22⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7436,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:82⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7072,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:82⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8640,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=8628 /prefetch:82⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8820,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:82⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8920,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:82⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8036,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=9080 /prefetch:82⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6628,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:82⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7880,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:82⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8212,i,14522400082307105247,10602606833115435631,262144 --variations-seed-version --mojo-platform-channel-handle=8824 /prefetch:82⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --disable-protect2⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd160cdc40,0x7ffd160cdc4c,0x7ffd160cdc583⤵
-
C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level2⤵
-
C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff6305aa3f0,0x7ff6305aa3fc,0x7ff6305aa4083⤵
-
C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\AVG\Browser\Application\initial_preferences" --create-shortcuts=2 --install-level=03⤵
-
C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff6305aa3f0,0x7ff6305aa3fc,0x7ff6305aa4084⤵
-
C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exe"C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exe"C:\Program Files\AVG\Browser\Application\124.0.25069.209\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe"C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Pre-OS Boot
1Bootkit
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Defense Evasion
Impair Defenses
1File and Directory Permissions Modification
1Modify Registry
5Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exeFilesize
204KB
MD5cbcdf56c8a2788ed761ad3178e2d6e9c
SHA1bdee21667760bc0df3046d6073a05d779fdc82cb
SHA256e9265a40e5ee5302e8e225ea39a67d452eaac20370f8b2828340ba079abbbfd3
SHA5125f68e7dffdd3424e0eb2e5cd3d05f8b6ba497aab9408702505341b2c89f265ebb4f9177611d51b9a56629a564431421f3ecb8b25eb08fb2c54dfeddecb9e9f2e
-
C:\Program Files (x86)\GUME57E.tmp\@PaxHeaderFilesize
27B
MD5fc8ee03b2a65f381e4245432d5fef60e
SHA1d2b7d9be66c75ccf24fcb45a6d0dacedd8b6dd6f
SHA256751a04263c2ebb889fdcd11045d6f3602690318ebaaa54f66e1332d76dde9ef4
SHA5120837f2b22c9629990165c5e070e710a69ad4951b7fcfe28bd52354c4b8a7246672497b8aaf521a8773c7ec2a4249fc4318330948ab0d8db8c6c74da57b32f1c4
-
C:\Program Files (x86)\GUME57E.tmp\AVGBrowserCrashHandler.exeFilesize
149KB
MD5f73e60370efe16a6d985e564275612da
SHA12f829a0a611ac7add51a6bc50569e75181cdfd58
SHA2569cf076866935a0c64366efaeff2ec76d45ac816030ebd616fd5defb1870bc30e
SHA5122e44e87c285bb7b72d45c8119d08ea6f2d13cea77cf0005a3cf530790bb86c7f2df7c5edac9d86c9d7214abb224738c3bf6b31f6bf104051512bb1de133042dc
-
C:\Program Files (x86)\GUME57E.tmp\AVGBrowserCrashHandler64.exeFilesize
170KB
MD5deef1e7382d212cd403431727be417a5
SHA1fac0e754a5734dd5e9602a0327a66e313f7473bb
SHA2567d410e9eabd086827b16c89ee953a643c3e2f7929616c0af579253fd8ca60088
SHA5126b472a57fb89b128aad9ab6313a9ce8b171f7d73264c67f669adc5cf1f0421d81f654dad1419b620476abb59dd54e1aa03a74a26c5c93813f6fb8575fbd97d4d
-
C:\Program Files (x86)\GUME57E.tmp\AVGBrowserUpdateComRegisterShell64.exeFilesize
428KB
MD52a3ad7362e6c8808fbb4d4ccaba4ed4a
SHA13f896f7df7fe202f4a717713c503665bb4dcaed6
SHA2564dcd341907880c8dea840819628b19c5ea42ca2b5c61ad57147d0ac7da9b6759
SHA512892042ac713e4d5b488262a584355dafa18d967035788799c1773eb39a4616461beb9d79a230d9f85cdefd1b4076b8a5e1d4bde17254bff1f08c3eba56469679
-
C:\Program Files (x86)\GUME57E.tmp\AVGBrowserUpdateCore.exeFilesize
512KB
MD5dd5dc945cd848bf503862d0a68c3ea5d
SHA19b277a0c733ed5698b0656da8c3b99d2f90c7ef8
SHA2568cc98345e367b083f545ace66d93bf69e03a4fa08b84805a9925fa4c94ef3f8f
SHA512f6eab8422bde24d89a7723c6175b4197a50e18aa0bb5b8f419e5a23b265d85dcaacaf136b8f6ef6bbf2bd6c0eaecd8f86093f594fb98e596f4b39e9c6ff227e1
-
C:\Program Files (x86)\GUME57E.tmp\goopdate.dllFilesize
1.4MB
MD504a6438c50564146e880c5eb9d57905e
SHA1edf5d454de99159d832cc9bd0d8dbe132d749804
SHA25626109d47bf9960e531888e6c545ca8cfc24fee2202b549df29fb8bf9c58e0812
SHA5128705d0ab2f8a6c1ef567ad00b33ff2cca01391b105eb0ade201d981f091e4ba87e709860ab9849bf9781698fb42ab8efe53ea731af310781766bace1eb1dc19d
-
C:\Program Files (x86)\GUME57E.tmp\goopdateres_am.dllFilesize
42KB
MD5ba03b29d5d44341084eb06bea8f1e702
SHA17d8dd7556ea5e299b55ddc7477ca758fe2c64f48
SHA2566a6aad33e2910c29a6d919aad074d89359c5e6723ced7ba4e215a62e9513749b
SHA51229f902587b7078deb12bee6bf9993748109749ec12e6490d5f84bc9c532a5a1f414149d5760641ef052611bf2d441423d115dfb5a4c4c6f5e6d6a1f386924cf2
-
C:\Program Files (x86)\GUME57E.tmp\goopdateres_ar.dllFilesize
41KB
MD59c77be0843f0fe4864a04f8d5f24a593
SHA1be03adb4d3c33520e652c7a6ee45f09d5ff54a54
SHA25639547fa5d7b93856235288b1021699b4f36f0bea10b10d6b89ea184a3ad77bb1
SHA512f504c98b03a5d72c078b38a2cc4fdd94dbed159f5a2ed47c2c4a53fc6ec8a3b1fd969d5ad85fc7503e64427a36adee7a14f15f1275a9194103e43c8a8ee45d28
-
C:\Program Files (x86)\GUME57E.tmp\goopdateres_bg.dllFilesize
44KB
MD5c0b41217fc33a6a53ec69ae7399460f2
SHA1d7dd8d543b7297f1a1e138efa1806972c9489c3f
SHA256d75a1a41ad7e5277576e3bdf35a858be3a6f540d21c8ab4156c842d8f1b3295b
SHA51237abb726b78421aaccdbc94b358cda6b581e89ac519258eb39c6a7f0706cfc64c3a96f5c29539ba67c6e2d2afd6f10b6b0c063b54366c03376ce234d132a8253
-
C:\Program Files (x86)\GUME57E.tmp\goopdateres_bn.dllFilesize
44KB
MD5aedf6d96ccb64f488379bb1fe65f697a
SHA1901bbb7873d8f698f49c4b6be74fb50b353d7b5e
SHA256941d22186ef1bfe27052e78d21944d6088cea152d1ede51452f04fb032c92f90
SHA512d1d889a1fe75924f3569e07d9ee3f552afc02165210f5c439d4697be898b72db397bb89e7d0706259f92c1cb5759009f9e1ba5c52f764e63514b3da41dada1cc
-
C:\Program Files (x86)\GUME57E.tmp\goopdateres_ca.dllFilesize
44KB
MD5f951cf3ca93e5ae5fc1ce2da93121d98
SHA115bc869406857437babe41cd3f500c356913499b
SHA256eb00cad19ed1d16f52928962f2cc6231d65eb74b2314976ebeb1ec860103e746
SHA512b77086ad2b39723d697d7839d9243c1c0769a2cb0f6287cd3f2d64eabd6a48d8fc2d253e9089c6586637ed5dc5970c2608615fe77cef5003f0c4d53401ef73bc
-
C:\Program Files (x86)\GUME57E.tmp\goopdateres_cs.dllFilesize
43KB
MD57f3dcd851645d3d75f636c8440fb057f
SHA185debe41ddcb46555a0d00795e41e460a35583c2
SHA2560b31785d1931580cad5ef16d4ff5723802d12c38b56746e70fcf91d71162e043
SHA512d0d21c397899aaa6a718b77195a6af1556309615616fd6583ecb84b04aa7087e76eb5fdd6cae0a4ff1c0f85bf72e1f51ae002042078095f640eb95da363889e4
-
C:\Program Files (x86)\GUME57E.tmp\goopdateres_da.dllFilesize
43KB
MD59a421423686559027e4301d36bcf58b2
SHA19669424f4e7c765ddb917a515d5a8b1486f87daf
SHA2569d8ff148793d99974fab93f38027e1999323a48620b303f82170751be5dd6b69
SHA512f5d62fe17a820323c4b1832cd3bd9c8fa291d44dceb88a8a1a8f94c6166e550ab9baf9357c5ec3388230bc75f0ccd3aa2d5247fa5d242013d22c61001128a951
-
C:\Program Files (x86)\GUME57E.tmp\goopdateres_de.dllFilesize
45KB
MD51c15851d9dd22e4ae3f3bf249da79035
SHA160fc5652b5e1c55056c961d4d3b961492cb3432b
SHA256a9dd72a08c0c58a71b2289d76efae681a5c8eb5faf73e49b873f15ba4050baa6
SHA5126da386c35b317f39613da73340631f927606bccd0a8c626537eda896eb32c9a2ed1d71c7cf838f1a4b90553f3f788eeb5e02fe84774fb0ad2f574bf4e4d7e248
-
C:\Program Files (x86)\GUME57E.tmp\goopdateres_el.dllFilesize
45KB
MD50d15748f01df49dae986f1e27dc098ef
SHA135a435bdaaf47795977b28cdae2e4ea1fdae73a3
SHA256df13c38061cb0b02dd8a9023a17da0bbe1cda6fdedad5203129fc702c7fdd9b1
SHA512290e9936f50e3bd11c1b9d28decf3b43f5e23bbff16801e7b0491690773d057b6bcdcf48c48a7ee16fa2400723b3e974e2b74e3899590a8e660c2e9c78b9d141
-
C:\Program Files (x86)\GUME57E.tmp\goopdateres_en-GB.dllFilesize
43KB
MD502465169cd873c4492196e03457f2771
SHA1837ca5e54a8c12577d0d05a32996dfc04067c5ea
SHA2564eb9edf550bf1f66382e5d8bd4958438891cd2ca46557d14f4b945dc176ec025
SHA512e73b5f3951050f2903b80b89d2b9fd9ebf69adb922eb8238ef4c01f413ae67727d7598d4ac15f7ac8b9257aef0139e0924c70c5898357142a303d7e2b15394c3
-
C:\Program Files (x86)\GUME57E.tmp\goopdateres_en.dllFilesize
42KB
MD5418853fe486d8c021d0cca2e85a63d63
SHA19504500a7b5076579d74c23294df4bdb1b7c517d
SHA2564cbb2591c1eeda32bcf295685c993ce4d16acc968697fa12e2a00a1b7c4b37a3
SHA512dc2ab4e2056e6d73a274d700bc16f75c7c687b35874029c1908b183428dec010373045d4a52eb3f5745f8b91d624cf5d40cd7f37e353f3a41348e2a054a266a3
-
C:\Program Files (x86)\GUME57E.tmp\goopdateres_es-419.dllFilesize
44KB
MD53e5971e8559c77e8901ce30d14034730
SHA104cc21ac4a84abd29f7d7585282345881fd81721
SHA256613418b8779f7440b88f1734d6c514706df9dc9a58a623966cc1c9ba4e29c28f
SHA512b4592b25cf676db6d6de1be811c39bdeecc24bbfd4dc72fa4b3f97de866f9b0fec7c85f7d56f048f61829c1d8b4109e4a0c7e14a9e410e30a6a8da702941e00e
-
C:\Program Files (x86)\GUME57E.tmp\goopdateres_es.dllFilesize
45KB
MD55f8ea18786d5ef1927cd95537abc3ae0
SHA15530650ecc719d83b7aa89e0b326b5698e8adda2
SHA256fa416294b078226a8919dbb8f75533a6ef96d63d5bd17aac854eae68791433cf
SHA512577dc7d19e4443e8aede759a781826c091c17d12fb06e89b1306133f21e01dab919045183a916e1b5647ddf485134a8459745a9199df5c7e36abe192645d8e25
-
C:\Program Files (x86)\GUME57E.tmp\goopdateres_et.dllFilesize
43KB
MD55029406d9202d6f2f279fdd3a06f55a1
SHA1dcca8bf9392faa0038c6cb5d25929726b16804af
SHA256cac545e04d701c39f4a730aec4c3dad177d8ea4baca10651f150925644874864
SHA512519538e05f8e21966e4878291692cf25057bba3c993c0034a33b1da7c9eb0a8fb881565717ceb6c1139fd601b73b1f1e2aa46e20aeb6b93f897cd2ef93172934
-
C:\Program Files (x86)\GUME57E.tmp\goopdateres_fa.dllFilesize
42KB
MD58564514501256ff045cf7aa6c1b5a797
SHA140b9aa8d04c48fe2ecf193c2089418ccc938676d
SHA256f3f46a6da6c8ccb3ce7fdd0cb5882f45523decca95852b8c775bb90f8e92c1b3
SHA512701077c8a1c70c1bd0c35f54aa838dba7b7b6f832e0ef2776673092fca546276166c3638676451c9655086b740b9e193cd54f952fd5fca481b964083b881bcc2
-
C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\setup.exeFilesize
3.3MB
MD50dfa65976da7822db99118abf2a50cc9
SHA1a06feeffd56b3ef7a227e64099fc0213514d7879
SHA256f9f61393559bb1d76ab630b11953ec20c7a0d5979e48f27279e7bb0a92abda26
SHA51241cb3ccc7a2aedb2b17517de1dac905adaf9db797e1fd487e7853438c2936096212582b20bfefe03e267e0e1650af503b802a13c43f0a55a6b803beb1f93ee56
-
C:\Program Files\AVG\Browser\Application\SetupMetrics\9fc8ead4-db6b-4a96-bd12-e0c85d094642.tmpFilesize
520B
MD5d7bdecbddac6262e516e22a4d6f24f0b
SHA11a633ee43641fa78fbe959d13fa18654fd4a90be
SHA256db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9
SHA5121e72db18de776fe264db3052ce9a842c9766a720a9119fc6605f795c36d4c7bf8f77680c5564f36e591368ccd354104a7412f267c4157f04c4926bce51aeeaa1
-
C:\Program Files\Cheat Engine 7.5\Cheat Engine.exeFilesize
389KB
MD5f921416197c2ae407d53ba5712c3930a
SHA16a7daa7372e93c48758b9752c8a5a673b525632b
SHA256e31b233ddf070798cc0381cc6285f6f79ea0c17b99737f7547618dcfd36cdc0e
SHA5120139efb76c2107d0497be9910836d7c19329e4399aa8d46bbe17ae63d56ab73004c51b650ce38d79681c22c2d1b77078a7d7185431882baf3e7bef473ac95dce
-
C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exeFilesize
236KB
MD59af96706762298cf72df2a74213494c9
SHA14b5fd2f168380919524ecce77aa1be330fdef57a
SHA25665fa2ccb3ac5400dd92dda5f640445a6e195da7c827107260f67624d3eb95e7d
SHA51229a0619093c4c0ecf602c861ec819ef16550c0607df93067eaef4259a84fd7d40eb88cd5548c0b3b265f3ce5237b585f508fdd543fa281737be17c0551163bd4
-
C:\Program Files\Cheat Engine 7.5\badassets\scoreboard.pngFilesize
5KB
MD55cff22e5655d267b559261c37a423871
SHA1b60ae22dfd7843dd1522663a3f46b3e505744b0f
SHA256a8d8227b8e97a713e0f1f5db5286b3db786b7148c1c8eb3d4bbfe683dc940db9
SHA512e00f5b4a7fa1989382df800d168871530917fcd99efcfe4418ef1b7e8473caea015f0b252cac6a982be93b5d873f4e9acdb460c8e03ae1c6eea9c37f84105e50
-
C:\Program Files\Cheat Engine 7.5\is-5L14R.tmpFilesize
12.2MB
MD55be6a65f186cf219fa25bdd261616300
SHA1b5d5ae2477653abd03b56d1c536c9a2a5c5f7487
SHA256274e91a91a7a520f76c8e854dc42f96484af2d69277312d861071bde5a91991c
SHA51269634d85f66127999ea4914a93b3b7c90bc8c8fab1b458cfa6f21ab0216d1dacc50976354f7f010bb31c5873cc2d2c30b4a715397fb0e9e01a5233c2521e7716
-
C:\Program Files\Cheat Engine 7.5\windowsrepair.exeFilesize
262KB
MD59a4d1b5154194ea0c42efebeb73f318f
SHA1220f8af8b91d3c7b64140cbb5d9337d7ed277edb
SHA2562f3214f799b0f0a2f3955dbdc64c7e7c0e216f1a09d2c1ad5d0a99921782e363
SHA5126eef3254fc24079751fc8c38dda9a8e44840e5a4df1ff5adf076e4be87127075a7fea59ba7ef9b901aaf10eb64f881fc8fb306c2625140169665dd3991e5c25b
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
48B
MD594db74811d12da3f6aa9b0ceaa37488e
SHA12a95b88eb2449318088490f8a08948e641ebd206
SHA2567c6f6aaaa9c357072bd67bedbb1eda8092f0a8ebfba327f3fcb3cf3bb84dea43
SHA5120a4004b00bc8336612461b1726d0d6a2ce1bd904e6ff37741f9623ef27a70ffcaf1d485437452270f2096ea88a6b16bbf0c1a5a67256a94b78a2a7521f1c0a30
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
120B
MD5e139a159436ab124f7154e50c981b2e2
SHA1628c387765b0763861860ccfa3ff14bd1075b4d0
SHA2567dd466b2dfdf6ede49d3e9464eab53f1c03a9aa8877cb43f6773bc997c07245e
SHA5129c454b331e85139132cafbd7d2f3abe5acc64020a5fab8c363e20320482164a82342cfb0f0e248a0327e92c37bbd509d63bb2455b4b36a70f1514a5020ea25c8
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\DawnWebGPUCache\data_1Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\ar\messages.jsonFilesize
1KB
MD5a5d85d08654dacfc837f7b6f72e6dbce
SHA12cc8f59d687cf8b686a7349f9235a80328b2e354
SHA256b8598beb9b2fc91a17f86ef9609f0d49cf016ea48f7d5d0535b163df9bfdb673
SHA512376cefdff2af3e597eca7bebfcf2dc579058a92220df2fcd9786d4514bfe8c9f9436939d9c432693665f9262cee375b68e96d1dc9027f73f7a5a330af3b81171
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\be\messages.jsonFilesize
1KB
MD5ab74027d0eaa6447c64c50c29168ac28
SHA1a6e65c6362c4e80ad2b5f28f8a6eb377af2938b8
SHA25600ea40f1306a99eaa642e3b613ce277411d53d88920d5deca5b1d0798b51d30e
SHA512055c2bdef9f06a90ea2d2b10cf79318ec9c185fc334a70d8cf4551cde947958f5881c3a50c4b5715cb3a4585722b92bbb4a5f59156762bf819c0e6aadc5bdaff
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\bg\messages.jsonFilesize
1KB
MD5d945e162c3b5842b29e7a11f22479f97
SHA1f0c697a96f230babb3198b445ddba14a33c6c846
SHA256a18a2d8484517ed9584229d5cf58f6ad7618926210249261c29af14c6326a025
SHA51248a1f5e071892b7ea6c54293595948d9858d0a725f7ee4f3ae6bec16cdce9116402f2272cdf06eb9ae3f8a53a45f3c490428fc5591f59331ebd082cc56e15b56
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\bn\messages.jsonFilesize
1KB
MD5b5af23ced9a7a5b995c9fcb1119dc2b2
SHA1be85158410ab3c36673d5b8fa14d5da07d9530ee
SHA2564cb40cb8eb1f2c1fc2a6691ac0d2b7138299d6dcb0c1836beeee8a43af12f7d0
SHA512b3ffc042c7d4246e87a1c26f0fd31a6130347f8097a07fb64be57dad22d7b5deee9ed922be647edd049dedfe00c8f4c066fcda8481ad65b3b7f32ddbd1bac547
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\ca\messages.jsonFilesize
1KB
MD5b1d37ded9d6e3569f955ddd213101059
SHA16cc5fa9f49c6bca83fe862a50b2f8e9eaf838e42
SHA2561b20cc3de4bc55aa1af9a31618f5d07e630605774c7c92fca0862427b5a5de94
SHA512095461240b28552b730ad24dead2b7b5191ba8c77703a1758e60c6097dde41834a3f6147cda5880bec52a363b2772025a55245f7138b515e87f9a64553b09d0b
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\cs\messages.jsonFilesize
1KB
MD53b971c847376f49c17fddd94d99ee14a
SHA106f57556597827c5f11fd80c335c055d83c0c63d
SHA256162a9f2cb434afc1093581733aa643a1b0263f21c01deb24f26d4a3fed0274c0
SHA512b2e1cde93cfeb327cf6e78d8b1a4bda800881e5f345d7e50fe7ec0359a422b2ec80be61f3b248b4230c72a07d55db8264ead7c0757c1c16b38b3d3ca94bd408c
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\da\messages.jsonFilesize
1KB
MD5db729316339e408f888da652d099e6af
SHA1747689da330277dbabbd2dc219febe22df744375
SHA256b715724bba10ff50273fb7ac3685c5472ab01fc7c3024e7b457841881b7c8707
SHA5125c52b71bf8f1a832d8e04f7f8be3e88ff8798632a3aaf89ce3550adc3aa41d3ba10f020e0fa9d95aa96b490827d900f8e2d4228ab79c737d2157268b31e09700
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\de\messages.jsonFilesize
1KB
MD53c651f7432afe9d495c57abc69c30b62
SHA1f0d6d0084a2b54b8ea2fa9f21c047341e42c762f
SHA2560cf5f828601348cdd46fb6c260099d1846edf1b6f4a009e5c719a55e50ed3bc7
SHA5122193461a027d5ab8df2defef283a36362e845068faafa7ef040c308532a4894c40dd6b47a121739ca7b6fd683df9443053bec46e3073ef573da2dbfb270b4fd5
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\el\messages.jsonFilesize
1KB
MD59288729963e1230a74efbbf071de1fff
SHA117a438183e94c336a9a50e631074fd43b7d852b8
SHA256c647435b41dccaa5f77620a0f4d423e1f777f5f0738ad706de86571f7ad76482
SHA512d4d2dc015cb0a4cecd456799044c31958e4d281adf6216db6f73c24eef4e06e7f6aa3320c1abee96a63f978f5c09897f8e0b78237efe472d50ca087db38bccc6
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\es\messages.jsonFilesize
1KB
MD5b87f24a632f1394f2b4d953eb851d522
SHA106b230390c38da48e958e38927c4f27bf4877c4a
SHA256bb68ef6c46d390012368e42a08314c4653697cf0e4e6c4c8f76b788056d4dc87
SHA5126126293d7917220d8b28ad13df87d1cc0757444c139058d144282bb4763527e0a1abbc86225448dd7f315807c3808e513670d81092afe6cc801f2f83379e9424
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\et\messages.jsonFilesize
1KB
MD5ef87cb0ac7a3b415d75cdd36be6f4828
SHA1f68f606d8d6ea71240ea1bc88d04f5b0ddd9b170
SHA2560e56ef46d2c21ac8e1870f178b91f45a4726baa3424b2e89bf1d35ee01e25da8
SHA51260f98c8feb52eb35a995edc1c840847f27fbbe666b894551ae41dd4121a8679e5b84002a1e8e932ea7d73f3826c46b10b31dff4c06b38d158a690c045bd220b0
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\fa\messages.jsonFilesize
1KB
MD5b37406066b6b248a9ae6be6d6b94c838
SHA1d488c6e65357596a9178cb86db67183e9a7dbfd1
SHA25684dc48a25f3697a1455743d80430def6027553ac41579e621e232ae3e153f46b
SHA512259f9bd6619e44413a9110cef481f64b043dd820ccb8fa73893f32e71b3f33c357c6ab2dc981eef9a9f444051d8caa1fcb6128aaffd1fcd285a2724b28f6ed32
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\fi\messages.jsonFilesize
1KB
MD599bd1faef0a8d04fc945c3e11d31b151
SHA1f5ea3cb156598052b99efce4eab2e9b64ac37518
SHA256106d6f20de82ab642b825be080855448835e59fca46f6d6546c484502f8e6637
SHA5123e652b08ce58f6f6f212fe62329cd441ca0fa362be464ddecbbf9a98c090082c69347820c7c8dde213061afbe5f12b98f7d76ca7bee135a757d10fa44d320601
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\fr\messages.jsonFilesize
1KB
MD5f53ac5863deb7bde23e127995c086f25
SHA199a4f59892d06747b51b363de267f466a72e8008
SHA256c7f83f037f2a9561a79b66c7c5ba6ec230ec038b01ed0442832471d2c4a4ac08
SHA512c93e65ec1a08d792997cb13676ad40539dfb2bc1fde18b8759534f47b6908f7f4d84a2108b579fddfb8edbb4de00b1eb50adbcbb209296a91ba38b0f19bd9d13
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\he\messages.jsonFilesize
1KB
MD5e3333278d6a92406f8aa1da627b7ec25
SHA102b0d6f2e9547795e4240e6819948dbb9b4481e1
SHA25610921f5fcc54a5bd0ca546b2ebdf2c65a4c062d96fdfd8b6b6adff4228b9e758
SHA5126d02737934a77fac4fcfb1e489f9c1164a8aa3111a324acb4754cdb9512a0111a004ade9c0cb9f858efac9543d9263fa393bb1d751f4a61c8e3bc741ff826149
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\hi\messages.jsonFilesize
1KB
MD5c3954827ca16d49de136110caf6f4129
SHA1a1ed0910d1b12f2a2e5bd88645ac214b02f2c953
SHA2567a1039337aadca607c99a392ad2558d16e3f39c048c82e2216c094ab26770d37
SHA5126f8567ffac22f1fecd101a96bcfa5bbfec79cdb1ba0e305c1366fdab519df096b826d6c54c07ce4fb1c8520f2baabf008357d9fd7e18a92f35987131cdc49147
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\hr\messages.jsonFilesize
1KB
MD5b0aaaef3224face221502b9be35433af
SHA1352016e75d370e371ed85806e0e524b1189b0901
SHA2563fb11705f9aaba63084e8159172b07af10c30ef08fcf1c26cb9a7af6c501ddab
SHA5122282da110bf4937e848e03c22832a6a68e5022cca5b98b176d6f1b9abc924299d58c5eb6a3b6c441c30d36d0346934f763c1f16183e3bd0e931d332e5519d04f
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\hu\messages.jsonFilesize
1KB
MD5830f778ed7e5c02342d67feff9abd3c0
SHA1793d0aefa539d3fd0f7dc4ef57d9daceb4713911
SHA2560f2c4646e051b466bbbe8e28f4366d0cedeee9ce9d7646ef6155494ff7c1aa70
SHA51244ae829af29acc1200fe4c8ba151b19d1e816450f45a7614ce40f72e544812f5730b4abd09de1ecf6310d918818535fa4e1360335263f4d2eaa428f96eb02457
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\id\messages.jsonFilesize
1KB
MD5b664a816e55958ad35e9fc0bba1a72c6
SHA138c3c869bbee7f6e013dcb79a6b78e658079083c
SHA25680242d7f7b07846e4dc49ee6b25c8f1cc71c7d161038e2a939f4bc8d09b22bb1
SHA5126ef9ccdb7411cce478b82ed40d8d7d87b2ee185f368e49ed5ea8f3ca6e77e83e3198a27ebd8e05c2c9147d8ac57bada682b094b0490ea162869959e61c5859f4
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\it\messages.jsonFilesize
1KB
MD53a40212d09511cf73a9abff33ff23553
SHA1c0c592b1875794e1f086b116799d91fe03552a67
SHA2564bc03d2796dda350fb148d6dccfec14e818202e79775a1711ff538dc3cef312f
SHA512ca0492bfe61585c8c0c50d41a35573fc26657bfd7acde16d15326bf327bf04973c730e96ffc18ca83e05b365f0730c5d41faae1feb0717046e919332e1d781b5
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\ja\messages.jsonFilesize
1KB
MD5ed7a51a91db6521ea2eb3fcd488b5f40
SHA12f981947fc94d1c310a58a182aaa251bfe86e882
SHA2568a0aaf8ed4d59ade98354e5f596b6b2c4a03b5065bc3b09d6c13e9c983a527a6
SHA512ee065a401a6d65312c12afe604dad9137a9247b96bb6d6dc01d14fcc9fa2c6c299eb5d0e8f1d30abe4b46f8b9af85e6cc935566c6b3ac2225666cb2628de53c3
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\ko\messages.jsonFilesize
1KB
MD5f19d786e8a7bdb0f3bbc0f9e6d8455fe
SHA15473f500aa1b5d0cf6ec618cab463010e8386a70
SHA256b45b7a2b28bbe59db53e26486cdedfe5aa5ee19dbd01ab94fae8d124cc3de826
SHA51231d5fa959f6551cfc822c0b7d8e4d68baa9f7a3e2866f383bc1cc4e3cbb6e485da1491d811fc27d57e17bcb3774bf384c9b84da1cb3c5bd705a56551669a801c
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\lt\messages.jsonFilesize
1KB
MD5416f2b8ffe43a7f035f41007d50fc2d1
SHA1b9628abd0b6bef289b7d9539611577c4460005e7
SHA256c960852e7e43057f6ceb4acb07d0a9f2a8601d44c5bfb67d69211bb2354b988d
SHA51267f0dbea7f8616b1bbe30d1ae30e2bc8d4f4334aa33904728f093afe1672feea55abb15ae375787a2e9dbb6e246b33ac1ed74fe4de79f68c75e93f81cb3251ba
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\lv\messages.jsonFilesize
1KB
MD5e6a8020d78b58be2ac40858986057522
SHA11b63a5f1c26ae7d01da0a2eb28eec39d28819e0d
SHA256ec31919a5adea04160d6f722b434d6ab3e3ec72244f330fb3e671b3d4816ab1a
SHA5123ba8933e42fefdf9a07aa666528c6e380bf025bb0a4d5fe7c18a404192d45493d68224dc51af9904c604775547b814ce00b49a8b132250fd2b7bcef9907d055f
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\ms\messages.jsonFilesize
1KB
MD529d96f05a391ef594b04b9da43133261
SHA186fc11af431d61dc229810ff04815caa90d5250b
SHA256a0395e1dfa50f0ba8bbd6118424fd1303ce19a3ca32972f5eee012ad850d6901
SHA5121672fb73c5a0f73c7bf776fd9189e1e47ad8f2af17bfb49a6d299e01098e0de5761900ec909da31770fe86636ac8e667236490f0f612d5e59d9bedf182b90935
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\nb\messages.jsonFilesize
1KB
MD5d7e7129b526af85ee114ea293636ef3e
SHA18726f0da967ba7c66aa49ac8133528bc12948a7e
SHA2568c2f8c2e708da78b2039f7ce7a6c825852b22f8f865f1ef7ff8250ea475b0361
SHA5129a46dedb87fed4ddb699c289f3f1b67c7cf1ad3ca4f66b65c326aba6b74afb155fcb11a7688219c427ea6d93a9a09b3a1f2c9747d7c2fb0b5317fcc990047d93
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\nl\messages.jsonFilesize
1KB
MD5c33749fd231abd98f45fa1bd4d18275d
SHA12c30b01fc6f2a71f86d58832acffba4eb7646e99
SHA256d0b6b9c8bd7c7805ea6dd883dc29ebb8d42f499ae40ce9dd7d9b1082d105b375
SHA512f085bc98930b28117d33c85b34973317d24d6784601efde34db0f877251e506e9c345b0e4fcd9d8aca7b8d754f8692b5ef920f6c75f5d476917b32e8e4d1f2e4
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\pl\messages.jsonFilesize
1KB
MD5e6e130f30085ad6b55886fcaad73741a
SHA1d30e6de45bae3ff58cd05ae6e75b45dc66fa7b3d
SHA2568691f6363c4aa7fb4bd1fdfa0a2413dbf992eb942d719692f42b68ac26b3430b
SHA5129c144743939659318894389dfb97184ab29f05a9b2b0cb823f2414c61c2129ec8f8cca0208db534024b7b96332a3e7c8452afa66043c03b1c2d27522d72c32f9
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\pt_BR\messages.jsonFilesize
1KB
MD58dc02b40c5afd3142d3701e850dcb50b
SHA19af12b26f0ade1657e3d10063f44445de356b6a9
SHA2569d407d8979bb58d330157be475c619f27ec2bf15c3530805b4b7518c714c4c0b
SHA5128d9dea428da9a6bbe9b3f8b631541aeb97e4ec890cace542ca09a04474f9ecd20f31ba6ae7d421a54582eee8da1715a077f77cc855796ddfb3aea30457ff39f8
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\pt_PT\messages.jsonFilesize
1KB
MD57ba365deba378a383155a74a11ebcfed
SHA12c5e66dcc18e9178a0e6a25f79ff545af08abb1a
SHA256381877c8038b80afe11865a00b82dd78e9676da2511bd08087257d8ffe8f27df
SHA51219f2f5fd60334bbdec5a8a1facb15521c4ee90d60458fa42a8331a1f7dae9b0ba1d5c0d2a5386f160b157af0dd7cc33488e93fb6407623ba5fb93ad689eb4973
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\ro\messages.jsonFilesize
1KB
MD5fc0c0aac29d05eddba3b1aa1c974f426
SHA1aa176688c93ccebc58ed53c344bed5c25e33900f
SHA256f4a86eb6a5a67178bfa24255874090e9c80a5acaa458f14dbed91c8e9c3da1f7
SHA512640e4b745e08d23a4bb0146054e99ab5a66552509f20d9afecbea42c2b0c67f402f5bb9bd3ca73a5ce788dc75b2af36cdaad36322f297017383f07fa0ba31937
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\ru\messages.jsonFilesize
1KB
MD512a9ea240df3a579c96e6aefeaea0ca8
SHA1749ad7498f904f3ae4b7fd91db3b674df72855db
SHA2564efe5990080b6388306f12b74b31c493701d45794e8a300a41f6a90ffb0591af
SHA512cff032611e8ad4e66a404d8eae5951775c0c730fd9a0e668c56615cda7bb5c25359c2987820294b28999dbebb39905526299ce656c0887c9009c88caecdb5dbb
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\sk\messages.jsonFilesize
1KB
MD55cf9cd122e26346effd48db0c8fc75df
SHA121dca1f8f552ab09c765d80da60ff87e937af76c
SHA256f43aa954098a6d72d3d5a9dc74c131b10f59eb111b5217913db0c0d68b7a4019
SHA512f5819a66bc5a7f9dc9a80a0d3391ae68c9d6f923f90f8f8713ce96155ef95b726ed36fa71e6afd0d03a2466c9154cc9085332fb61263a4ed610761851c8d69ff
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\sl\messages.jsonFilesize
1KB
MD5bb93e260e7e2c75d4591c678ee93f81d
SHA1942289144564a5db6d9eea6aa2c37cb0d83af037
SHA25603371b65cd719a56ae34e00c3d05d20739eca452c0895c214847724cfd401c99
SHA5125acd8afc440961ae342a3235ad94244f11f26f486d69086cc55d4e991c205dbc9b19fc82ae918a3fa64326ccad844596d70adf8abab81b212c11903d24308fab
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\sr\messages.jsonFilesize
1KB
MD5e29a2d569b43e93a63de075bba9b51c9
SHA1619fe39b5197f8a17090db232efe565338ad823b
SHA25632c9be85fe0871d2acd30aaef4434f3369eaa1b3b12a39141754f98d9d7d181c
SHA512421a01e0a27e39e56427eeffea01777cc2ac2368dcfd42df6adc368bcc6a1dcc5e07a26209e88c57f106dfb64f255e218cc1bb95e77e5b9cf85dbf11a1d68180
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\sv\messages.jsonFilesize
1KB
MD5de263878f8f7c10d670221567d9ecb24
SHA1af91e39c90f1c06de18791893eaf1af1f34e04fa
SHA256d0ff3826cae2bff8238c84f3a6f6870874e8fa93c65e73d896db9cc3c3f14922
SHA51259d1a6f5c7e487cbf9d23cfd207bacf7aa20ff1f8616a3431370b6e1db2752d2b23fc5d3cc4b260804d3d98f1e61c2f5b5fed39440358f2dfa458e4df4db1fde
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\tr\messages.jsonFilesize
1KB
MD5c6ac0d250d4483dea83ff01fb1dfada7
SHA115c863f7380fa277ae42da5514d73cf5af0fe503
SHA256945b2841f8b7db64cfa9738e1d4e9ce652d0e54a2bd174cbabc94e494f44ab7a
SHA51233a43f0c98b46af15021d09facc4d29f6413ec9276b2e70733573dc96c2f28877a7bb5e2ed52f57e2b22f975037482b84fd76fa793674cd82768b43636f92754
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\uk\messages.jsonFilesize
1KB
MD55e024d5910e23c1c2052b560a8ae62aa
SHA1edf5ba60588876ac2fbc1787ec519dfbce9308cb
SHA256bb3582dbdafca749ea74eaae270b5c61d61cc1961c2f33fe3a4e45e1b2306e26
SHA512e465fdd296ae049def59e7856bb44cb087c1585de36db98505e8a15f909a92523098c4eaadd750a8aeb5d90065cb60521bfac4721042c80ba7ac4a76b0689dae
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\ur\messages.jsonFilesize
1KB
MD5abe5427813da3a1efdd72859f8ff9f68
SHA1a6366cb5d6d0d08b43cc2dc54e6c66c48cac195c
SHA25682ad8bc296bfa1ecbca8866d1f6c078aa987346e3a37c609b22f202b53a5cce2
SHA512a4dd9ff6eda79604826b6c03b983dba837e99fbf085e832b93d47fe225df07406ab9cf6296ae3093e7b37b6137b3122a2468447cad7d1703f8f5d33987840149
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\vi\messages.jsonFilesize
1KB
MD5b5f18b94d6479fa84715a4245f6f25f6
SHA154800434c74ac6a2e0fd8a1672dd8242b6f39f69
SHA256a41883d12892ffb1d888ce4cb7057db2b6d00ffa8f037ea6e962927c3f095739
SHA512e3ca50a862cc890157346600201c92bdc0fc67eb412cd0eccb4d3b90ef467788a32b84413ad3ba567313554076c5acf677a5f438e6a2147423dffaf23a4a2acc
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\zh_CN\messages.jsonFilesize
1022B
MD579dd279b4fa24a31c0267fa5b58962a2
SHA1d32bce6872dba9065a3f22ae5e7ae5d4fde38855
SHA256944b3c946452b0f12c39a13c3d44d5836b22e6939be6d90b21fa07d91a87e4d5
SHA51279d6dc7cb201019b78ca52ac04a0f3080322003e858725a730f5ae6e8cbeb938c06a26078519c0ac5b6f4057955d919de2f37050bf7bc74ecd4f325d3cb2aab9
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_locales\zh_TW\messages.jsonFilesize
1KB
MD546b65c0271c694dd6fb28eb690a007e9
SHA17480cb94f90ac788792b3d4c077986a4a784fb04
SHA256e86135fc21e9a5090399003977062b1ef42ef50ab134081c178642c1f9cb1386
SHA512cfcde69635feb1cc78446bacbc6ef4fd4ac4eafcee22a2fa29f81040d6204cf58a15b82dbce40098a25ebff6ba1e66541aeedb734ec8469963887fb8c13a18e6
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\_metadata\verified_contents.jsonFilesize
11KB
MD52bdf4d8c93eed2de85525f1d49b9f427
SHA17b2e62fceca17a6f3167b0bc6b13a9284ce7dc33
SHA256d6b8ce4560018a0ea71c49e2fd9e539e2ea2fac775762d14277d55e47f503658
SHA5124715bfc6e9ca088eead36c2420476a5f0c5cf22f69d3895cd13a4cf25dd1208fa329ee3149563f2b4c4e9210d3feb05b51380ea946772ea9fca4ccc999b8cfcf
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-300.eotFilesize
20KB
MD52d728b382ba4d5774b5cd3c985af6e63
SHA1f9f17bb74029bfe8a12c82f1a528da926e78142d
SHA256790fa6f6cdfda35b03950836a557d186a65f7c50cfbcafbd15c2fb8004bc11cb
SHA5126845c0ba03c194b63aa3908ddfcef66259575c346ed1ba0b5662a3a08e8e3a0304a6f49ea9ecda12e4c2e0cee899c1c72ab9cfa15426b8506a8749e98bdd1137
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-300.svgFilesize
53KB
MD527ef0b062b2e221df16f3bbd97c2dca8
SHA11183c2939f6cad1ac69dc16d4a0b943d546e4b2e
SHA25674df0c40c70eaef5c8fa9f3323b60940931240a3ac6b1623fdcafb1c4bed5185
SHA5120eaf53651f23745292e64b346ff097bb6fb0294e351a4701dc304541de65926b8b8d7bb5de8b8be5ae8279a178f4f977a39190ae29443acdbb7819881f1fff64
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-300.ttfFilesize
39KB
MD58c3dd994987820cc2b171e629be201ee
SHA139d6e91a35dbc4b4d588e400b0d20923ddfcfcaf
SHA256b5f97120805971ceb303f56728f4b940e88a0b0ca8a6185b9561613faa510acb
SHA512fefdd89cf660e389a573d7c576a788811eaea735e23153784ff718cabda78cf4624d0c273e43dbfebbc2325b5c0e5e6f3e7cae09eae55d8b1d6eacb2ff4f722a
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-300.woffFilesize
23KB
MD53afbb2a57bf45e649851c02e8b8903de
SHA187af1ba8c716ef612137987d750b2a27ea17c439
SHA25619eb6a474121fafad38c135802d788ebe347a0e1f9438e7e24477e52c458df87
SHA51206fdcd6c03a06d270fdbfaef3cab801b9fa8429478c4e99e11b02969bea293e78181a64facc6e853cd98c5656fdf1b739466a02fef545836e82b506d05bf332b
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-300.woff2Filesize
18KB
MD583c3deca5df9e979b477c60c55772d98
SHA186332ac5f59a4f86a4c736b1b923a4a904743750
SHA256a6c5ec600dfa7ca47ad224a89eb4b5ae06797927da4a03e54bd105cb1cc482ae
SHA5126de271d508d7a7a96a21092676965aa1a3c7fd5615e70f36debb8662e4f92b03997e87a5c636f9f63a2afad0dfb4d2f3e3f54b926908fdb2d4ade616de9977b3
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-600.eotFilesize
20KB
MD51d509ef7e31a881f30ea87aae524fb10
SHA19682d47dc55e2f2722c939524855168ac2ff1d8b
SHA25641cbd2cce0e80cc929588af21c12ebcfb92d98ef90d681899c4a2d275818d7f4
SHA51203b7992b965977602a2a301e46d27fc6cf41fd2b8c95afc733212697f5ae155e15dcfdf3100274a7085b551e6ad465762e77e40f228038b0af4c42cf67f0dc04
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-600.svgFilesize
54KB
MD5e16f375be3c2a73b58255a02f6d3a9ce
SHA1acc429c1bb8c8748b9fa1d00722401c8d8a8c007
SHA2564a464102b4370f93e3f5d492dfdabc3a8d7f8052cb817d4fec0542cac04c30b8
SHA512fdfa163b25cc25042cb34159cc357e3337b32630643c39bdf1b37a13c486ea3c02293dbcd2be790b25438e6f116566adeeaf7b437e85ae4cf410e117100b767b
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-600.ttfFilesize
38KB
MD55613b984da07ee40456c6bc790ca2f21
SHA1acec6c48759b9a14a56371ae0027c1577f05dec9
SHA2568d0e99cf50d6d7ac44bbceaa8062697392b9f71532d8e9716ff9cd2bf5a78103
SHA5127f65f9f5574b2a8b1f35f3e5636f8d6e20f57137b878e143e092739dc585518cf2bc4f151a171e952d48d038b1fd0b44f703acd7f20e33c88e45e0a02efe9674
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-600.woffFilesize
23KB
MD5d90dc5001b28fd92491e2240ba90fd91
SHA1c50363443e57440d39d47e1c126e38785e24ff7c
SHA256d44d59ec2328d3dce4046b23380c9f9506db2e31a99cfa1caa207d41485a5cd5
SHA51263279222a2d6d7a58958ebb9932ccda537d1e0ca008915d3a1fd5dadd35e8102cfc5fd9343d9386ac71c0f5418bda2d022d52b8a909f60d410039fad4dcaf46c
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-600.woff2Filesize
19KB
MD50dd0a359a053b2b5bb856a9580da9780
SHA14f8481415cbf3e5900f926e0f1b2822ce991c36e
SHA256784a7423298c587ce89819cd81d6e225877b32605b4b40eb3ccafb3f3f3e5750
SHA512b7e09a097632e2c1a06eb08c7610b715bd2aba83e35468ced16256de4b96acb113f1946de74998ed1f246ce8e8e8f2a7a780b18aca2e0b56130c5c087e127c54
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-700.eotFilesize
20KB
MD5e5abc8bf8bd5635024706adffbed5846
SHA1cde58bdbef093f6a589a69188bbeffa23708291a
SHA256602e36025f912400eb552f0f522bb8a75e9e9db6a825695c89dcb49a5828aef9
SHA512fda634368a61e4c22a0d8cda09e0c94feccf1579a9c3d20d2faa8567422c4a44ef9ae139a5efdb05619adfc78d2f6f4e5ebcfed40e7a0beb9ce0117eaf183a9e
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-700.svgFilesize
54KB
MD52e00b2635b51ba336b4b67a5d0bc03c7
SHA18338e3159cc9c5ff55cac72674afb7e90118ff19
SHA2567e40ecf3b9b2ded5a267a3fe330eda6d71c10a1fc716d12237812322057411cb
SHA51260979ca59776caddff6cad8d391d8191aa37f838f50c2c1343749060e88aaf40db8216e30e6bf00ac164be967a12c0221d72b6b60416cf455a15b5501ec4d969
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-700.ttfFilesize
39KB
MD581ca5af45045261f536c71baafd77298
SHA14f613dced987f67dd32883fa0cd9298a20c102f2
SHA256d123a1a00d692830f1f5276c64edfbc7abc9d0640bbb02596f83e10b14f89c0d
SHA5122156c44e95f51c8a56ca2aca1d5b6127a9e76ce709506ddda2df37cac554fd04303f14a11232a18ac6098c8502ed515d2ccbd1f8671a180490acf8a573457284
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-700.woffFilesize
23KB
MD5efe9ead0aecdedc597ec9d4e745e0a58
SHA1df6a1ea1917ea01c1f53f73cd9412afcfd254875
SHA256c173db3aba8f65231290d9c956253e0f8bbfb12750e1c4c56b26cf64fdefa735
SHA512ec781dce0b93d82d4096f8fcf1b3397b686d2415abadf543dd00ddb55a5aa49a87d063ed4fde670eca3ffb0c97c72df506265daf73c4b03f4d6d9a98996e9109
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-700.woff2Filesize
19KB
MD515df1fb3e82321d94a0ca758c62e25d2
SHA19fce105a87ee8b8bef404942cf48c42ba5ea1ac2
SHA256b41570405890d4f995da7b265ceb5cfb50246a940f9489525a8f526cfd160356
SHA5126e18ebebd7d7101cd04394595e4243abaebac2894ec303978b8fcb892a2922539c945ee5c549470ce79e44dddb25ccedc03fff272fcda17883c29b504e5de2d0
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-regular.eotFilesize
20KB
MD5916fcc0b03b40457b311609ac7226183
SHA1193e96a3b8ed9720bdd05d56f81dfd9dea43b5c2
SHA2566ffc257b02167f060ce8c84cf4137f896b812a814ecbdbf9e85bf3af99428dcd
SHA512974b5ade776b0915c3cca3dc4f0b5dd6b635f0053f10658fe63145e16de623023ede0ba3571caffb1aa6e4adcb9d3b3ee3dfd3d58d00028311621372bcb78b48
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-regular.svgFilesize
54KB
MD57aab4c13671282c90669eb6a10357e41
SHA14ca4e88a77a4d81138206a10793507cde43e31a8
SHA256f8396d832e2b270319c4e17df620c06f77293f5c4e7ffdce337c9b90fa75d133
SHA51208a74874f74c1b75f7a93e94faa632d1bf21c2d42c85fb66c9b11138e60aeafea8874b7bf33facf7503d19dc7965142d78e5015a0dbc340da2b4550d232d7116
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-regular.ttfFilesize
37KB
MD5abd464fd52dec0108904f062f30b31d4
SHA1f51881b3732bcb7aac9592f50184720e7d726ccf
SHA2560c4595868d57ebb5f2793e22e8493bfe2606cd8c628a039d2d1a4fa79f642b05
SHA5127ed6d565101bdd3e15596c7cc9ba8cb4c4a7be57333fec06bb01492360b409194f0ae6a8db1c368a1b1880ae260c122d1f0f551b74a6ea18e932d07687ccaea5
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-regular.woffFilesize
23KB
MD52b6f63fce9104d1223d83dd12cd6038e
SHA11ac49ab02668c5deb14a497faefcb7bfa6c15731
SHA25632ad89cba217fa7f180d331f6e43d87a75e8eb1b97ed102d178c534fd6e51038
SHA5121ad5b9865a50dce57ff6571352ecb4467ab7c6821fb343f4afbfc85c7cf35a4c84a8ea4357fa7878919947ad913aa2d8b8318277373fabf2297e78ef20117aca
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\fonts\open-sans\open-sans-v15-latin_latin-ext-regular.woff2Filesize
18KB
MD581d0487ba73afd292730e6f89e83c2ea
SHA120f0b5b7cac1d9a707d3cce56b7a4c16a5a11d46
SHA256557116ee5706daa3b6cb2f52e7490e22db9c30ebfc447a5c85458a5fa0f6f84b
SHA512f069c794442a237d55a31a4f17fbfbf5d8c4d82c12508ad45371641dfa177f03b7ef59360d2e91237d5d3c38cd11b0f3a145317b58af8d0cfc0e19c65eb313c7
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\img\icon-128.pngFilesize
9KB
MD5bb04d9216907d7ce3552f5269ed56943
SHA18f38bc15605438f28f10f3a7b19405ac264a00a3
SHA2565255543e412b35d417acbf1a36d40d593d30cb2d00e8aa54806edc2876b018d2
SHA5124daf0e01d69da1f92b66d8093f30284f27fb4e0c18a9e86dd3aa281df2adce038d7878de3fe024d5627ea5980eb79a814b4f800370f4e4312100f3ef330155a2
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\img\icon-16.pngFilesize
733B
MD5964b18181490248e5d4b6ec1d37f8d56
SHA1d7f7d12fa39bd48220f4d8158f05f39706a1cce9
SHA25622f8515513e91b308c24b0f3acd2dfe1c1ca62fbf795d4dc1f688099d96f3cbd
SHA512444b56391f4c87a569fe5a8b7928826462e15e2c5308e8b7fbe95260a1781f313e7e4b2c0a3295d1ea39c16debbb7eb08f32feaf478d27706de5729de143d983
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\img\icon-48.pngFilesize
2KB
MD5455726b96e7b10bc519d8f68ca0ff700
SHA17c6cc22d7f5959a398a12c95071b031247f87b60
SHA256bc6f6111cc2973f49b0305f79d5c33debe50a2d2fedf3ee612faa207896a725f
SHA5121ca5db8466a4310d127b70eb8674851a814fa5aca8682f1f771a946e71e5bbd4ea4f2fba281ba6ad8921cdeb07e4947179144538c70b560dfe5d5f7791737245
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\img\icon-on.svgFilesize
1KB
MD57d6f6b27842ae1bcbfa45f04669ed7e5
SHA1b58d4e18d1de9e869a457520353e73384376b2c1
SHA256cb5031b92d05a40fbbeba5c22fcbee49542826602a8ebc5aa2de6084755bfd6f
SHA51269734737316105daa385a22944e31542f424e2f217d2f94ff8f6469c12f34577f7def6ac0c74fc4b0e13079791731afba23d273df95e5e0fbf7fb326f99c0163
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\js\background.bundle.jsFilesize
168KB
MD5f8a8d9dbf5fe7367770fa891e647e7aa
SHA1e7b208ceef2d60a34a24b5e680b740eeac0c272d
SHA256029d7a6b0044eee1b1f7a936e159dfecba10b318de7e05ecc3f6795525dbcbe4
SHA5128e62b23c1de1ebc0d34f59ed795021b4b4116fc7c49bf1da365ad4895616ba8403403d45bd2c14ce58f967b5e266e550971a0157833884a58a913774b82942bf
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\manifest.jsonFilesize
1KB
MD5253d12f545c3e24d1129e5f98c68f98a
SHA18a9d8c90400ec9b583504f5be98fb1d4e2e26000
SHA256a14d2edf37826c68af6f4be85da450820c168cd4cf4b64be70b1bee8989d342f
SHA512a7944a3527ce651dcb5aeb4861651649ec0e498a0ec616fd081f033ce7dd1235150b0fae046ef7b3006b2953d265ca8ce0ff324518ed732ae6dcfa0b58598261
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\views\options.htmlFilesize
478B
MD5268dbab3d2bef14c65aceb15ec0037e3
SHA1c40f859765f4e32e07b29c5cf675b571a49388fb
SHA256c10a217d93d9db7f3e50328b3f8a9314d8fd0376da88c00f5d5b9f2924326820
SHA512010ee0ccc0518d0f00d8f14a03080b4507eff1c80e15acac5407ed86d09d82ad9691ae4354dbb23988e6ef8226709ccf083a02d67b0142b97d9d5b997cbffc75
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\Temp\scoped_dir3028_310001199\CRX_INSTALL\views\popup.htmlFilesize
398B
MD5e3709558c6998c808e07553bdd7e60b0
SHA1ead5e2d02fdbb83b75f9a40c445184847d07c027
SHA2565b5d11aab7f8844b6bab4497f82caf4a736f565301c4866c9f9b3f259a604437
SHA512bc5df31470e49854d556fe8712d0393dcacd8c790804a6ffc0a41e95ab55bf5d964e3bad4156c37f06f4a2d68a3660be1a5683bc11b3b7fffe77a9735859dbb8
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\GPUCache\data_0Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\GPUCache\data_2Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\GPUCache\data_3Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Local Storage\leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Local Storage\leveldb\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\PreferencesFilesize
54KB
MD5b1488e397073ee9c75f52a399ebd20e3
SHA1ce8e21a985ab7957a25f5c3fc5721dc15301192d
SHA256d288a56d40ff7d06632f73f3061d55277fd1ad0acf4641a41b8587722cd2e929
SHA51273c9dc7cc7a5941ce88ecd09cadd73e6a4df5631859e4d2753f557be4c8080da97d9b8b499670e8667a09d3fe758f737764bb946b8b21c2a9d0f1ec0faa8f6b2
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Preferences~RFe59282f.TMPFilesize
3KB
MD56e6e5dc9cdfcf82f370b4808e0c8889c
SHA190130f78b7d9060355f4453db9dbf751ea166a62
SHA256b2dc58d572458c982e5e2867dbdddc1872bd746e49786c64a036aa089bda7143
SHA51254ce91060307bf1519c6e33fc7711f0145b37e45dcde8a41a180d8e63d2a5dba3a10ad3a4067b945cbd50c863f97bb442c9b0cec145ce43e6d2fe99b7f06e590
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\e92b5ed1-a761-440d-9a39-d482eddc0a8c.tmpFilesize
168KB
MD5fc07ecae96473eb238d9570ac145b9c6
SHA140e791064c6ab7fed561242fe76cef504e9d67f5
SHA2567f1d458d061048520ff23161194483cdec65a85a83176afdf570f2e8af441c42
SHA51214eb4c3fb47acb4684545a3ab7a4f3488c18b25d8342c34e32da4c9b25b8c62806b06baca5f6aee834284de45325680a5275f06077cbb6761a2386550fa5ac84
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Local StateFilesize
4KB
MD5b33f7ff3c81cc31ef6fd021a143e4256
SHA1c4ac6a9aad446070db12aacbd5410a811778adf0
SHA256e18ee4eb3b252d5a3a27996ca7e40161842b3a9230231dd9faa82eaba2d712b5
SHA5129e6b46cc048651789b1553525b847620df61a504a711e473b0439f21477a4f8dd93288d237f9d9372265e83fcbc680099cfb368bf014419a199ce5f341c77723
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Local State~RFe59282f.TMPFilesize
1KB
MD5fe240fe21b931a1c0d42007426789b83
SHA1dbef2b5a5b18c066385497434d195fc1575cee14
SHA2568063ce0eb0b016d3b1805d83bbf6c01ff217a00f208d8b536a219ee4084bc6de
SHA51244a5d39e524fc0c506cf336a57cc6631c677e64232a72467239a15f10a81e44ac0ae5e5433ec9a4a2add15fa53c7d0465faa539b7386db8d7b583d0523703abe
-
C:\Users\Admin\AppData\Local\Temp\123305e7-0c32-4223-a771-e8b1f019b173.tmpFilesize
1.9MB
MD521b06e448a0bee23eb6b80dfb39f1e82
SHA1d60b3a9021a704247af4ba58bd539d42f780661f
SHA2563cad9f24f2ec2bee7bef2410ef713924640bda964e865096db6dde37103481ba
SHA5129678b1302eb289f04c0fad0a60455da7d24da4bb72177561f8668f0995d695485eba915bb222d7231a8188ac6ff3b4b0ffbbfe3b725b9c0112ca6af9465f5709
-
C:\Users\Admin\AppData\Local\Temp\1e5ed935-dd3a-420f-a44f-acd6b930547d.tmpFilesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
C:\Users\Admin\AppData\Local\Temp\27a1af96-7c11-48b2-8171-5b1da79527e3.tmpFilesize
71KB
MD523905ea78979b66c6d307de1ba55cea8
SHA173c187582cf3a843367751b565180dbdd88498fd
SHA256d3e2dd4dc06d3f0feeeb44ca24cd60d076931ff6c0ac1692b509f40f58d8595a
SHA512a32f59e91c5be60eb032f33a5ff799e125143e9da4d93ae0b57abdd80b778ff0001ea28d553a947560b54b9d214ac96e5d0ce98d36d655b26f1b6d4ec64dbeae
-
C:\Users\Admin\AppData\Local\Temp\3efe19f1-60f0-4d9e-9049-b63e11e6a388.tmpFilesize
1.3MB
MD506d466a1cde4306356506b35153c5ebd
SHA1c43850528e8150e1f0e253653d2f0155d00585fd
SHA2566b1205e9b435c6241ab9c244b1dc3c309c1d82211268501e71e43c4425fbf590
SHA5125d79ae61fea7097ddf4b5f2c639ddd1ebdffb7d0e69b74aac47e166afbe94e88e3a4dbd1cf34d55c6c8b0fcba3c30b676c8460b120470c17278caf22896b0b33
-
C:\Users\Admin\AppData\Local\Temp\6940ebe6-4ab0-46c3-99e1-0a73c86916f1.tmpFilesize
90KB
MD565a028a0d2831eed0228ecda4ab9ef2f
SHA186d5eaec3e1c7ecde3f37ab36a017599ddcb2138
SHA2565cae2b06bc5525e26e08cfaa43be7a5f8df88053397676cf81a5402a1ea0059a
SHA512edad812dffcc0c8b399d3c5c216973bab2fe9e9dbc0d2c6efffc8cca5f1c58e126b83046c4c90febf003f3afd3d3c12c9ba46ad9d18975f2a6c5094643ca4f87
-
C:\Users\Admin\AppData\Local\Temp\888cab9c-9aa6-44d4-a1f9-437a1f361796.tmpFilesize
936KB
MD579e1a051e0bb64259538622f94be9988
SHA19b53e95bdb4a0923ed84a69972dc7168bc2fc942
SHA2565bbcdbe935746ee78233c06331293ccf7a62f359cfd2d88a910cfcb8d9ec65f4
SHA5126beb6aaf5afb4b5f36cee371a149ce5dab8a4553446553a1341996affe10f888f6ec2de19cf3ef355552d71287844fa8cf988d90bf050008f4a7591cfaa31511
-
C:\Users\Admin\AppData\Local\Temp\ampsbxga.exeFilesize
1.9MB
MD5301495b3665209e7c378e452602f7c7c
SHA1c50f972540ea1decc268abedf1dbaf3fc023b0d5
SHA256099588b281785a0130f2aac72cca02f61d13c5a12f6bfd222783cf081c6bda7f
SHA512c8ceafc2d7c590e06f4bab33ff5070f87e9ce3bdcb66f9b11a4ba3f1e6859954f6de94dff0f8fe64bc405d8aa19daa3dba694b76e134fc5699211797f1d65d84
-
C:\Users\Admin\AppData\Local\Temp\c2107d02-254f-4506-a600-233a82cc29e9.tmpFilesize
2.2MB
MD5ffcff8e2ba102530ce54f9ea1529ce48
SHA10d3ebcf3ca535032d825b6a0c5a4c5e45733033a
SHA256bfaebcbdaf420eac93d20ad94680fd13fa391bb8d4f7a29603b5172628fc093f
SHA512e5c8aeccc919a8b07442bb291b1da38a0f82f5a1352b8ac1edbbf9b471675b92cfae53d118c819ed32dc8992ef8efb943e8ecea73d28706a7c88b8d83fd025ec
-
C:\Users\Admin\AppData\Local\Temp\c25b8961-a481-460a-9932-c0674c192f13.tmpFilesize
2.8MB
MD5f75cbfbb5eaa5f46574955ed6651da78
SHA14ce276c03898e57667b401761fe1df5f11304a68
SHA256643962e7cc16bb8e9edbea5f05473764199c7179d06a65bd88a0d101d1d5a9bd
SHA512287847c5caae39fc80e90ae105a5fb0c9349f402872721c599eb9c9ccaf171437879f0ef8bdeae923bf4520befa316b60acd3e975caf8496f05dad24e1b34e40
-
C:\Users\Admin\AppData\Local\Temp\is-9DSIP.tmp\_isetup\_setup64.tmpFilesize
6KB
MD5e4211d6d009757c078a9fac7ff4f03d4
SHA1019cd56ba687d39d12d4b13991c9a42ea6ba03da
SHA256388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
SHA51217257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e
-
C:\Users\Admin\AppData\Local\Temp\is-L2DP2.tmp\CheatEngine75.tmpFilesize
3.1MB
MD59aa2acd4c96f8ba03bb6c3ea806d806f
SHA19752f38cc51314bfd6d9acb9fb773e90f8ea0e15
SHA2561b81562fdaeaa1bc22cbaa15c92bab90a12080519916cfa30c843796021153bb
SHA512b0a00082c1e37efbfc2058887db60dabf6e9606713045f53db450f16ebae0296abfd73a025ffa6a8f2dcb730c69dd407f7889037182ce46c68367f54f4b1dc8d
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\AVG_BRW.pngFilesize
29KB
MD50b4fa89d69051df475b75ca654752ef6
SHA181bf857a2af9e3c3e4632cbb88cd71e40a831a73
SHA25660a9085cea2e072d4b65748cc71f616d3137c1f0b7eed4f77e1b6c9e3aa78b7e
SHA5128106a4974f3453a1e894fec8939038a9692fd87096f716e5aa5895aa14ee1c187a9a9760c0d4aec7c1e0cc7614b4a2dbf9b6c297cc0f7a38ba47837bede3b296
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\CheatEngine75.exeFilesize
26.1MB
MD5e0f666fe4ff537fb8587ccd215e41e5f
SHA1d283f9b56c1e36b70a74772f7ca927708d1be76f
SHA256f88b0e5a32a395ab9996452d461820679e55c19952effe991dee8fedea1968af
SHA5127f6cabd79ca7cdacc20be8f3324ba1fdaaff57cb9933693253e595bfc5af2cb7510aa00522a466666993da26ddc7df4096850a310d7cff44b2807de4e1179d1a
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\RAV_Cross.pngFilesize
74KB
MD5cd09f361286d1ad2622ba8a57b7613bd
SHA14cd3e5d4063b3517a950b9d030841f51f3c5f1b1
SHA256b92a31d4853d1b2c4e5b9d9624f40b439856d0c6a517e100978cbde8d3c47dc8
SHA512f73d60c92644e0478107e0402d1c7b4dfa1674f69b41856f74f937a7b57ceaa2b3be9242f2b59f1fcf71063aac6cbe16c594618d1a8cdd181510de3240f31dff
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\WebAdvisor.pngFilesize
47KB
MD54cfff8dc30d353cd3d215fd3a5dbac24
SHA10f4f73f0dddc75f3506e026ef53c45c6fafbc87e
SHA2560c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856
SHA5129d616f19c2496be6e89b855c41befc0235e3ce949d2b2ae7719c823f10be7fe0809bddfd93e28735b36271083dd802ae349b3ab7b60179b269d4a18c6cef4139
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\logo.pngFilesize
246KB
MD51df360d73bf8108041d31d9875888436
SHA1c866e8855d62f56a411641ece0552e54cbd0f2fb
SHA256c1b1d7b4806955fe39a8bc6ce5574ab6ac5b93ad640cecfebe0961360c496d43
SHA5123991b89927d89effca30cc584d5907998c217cf00ca441f2525ef8627ffff2032d104536f8b6ab79b83f4e32a7aab993f45d3930d5943cbfb5e449c5832abe14
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\prod0.exeFilesize
44KB
MD5c8ba81f4ffea28f42a6da37ce4be4747
SHA17368fdd482c82b8a1da24a4ec08a1a14006f3bed
SHA256b419d20cb1db663803bf4a03d4f4b7c13ec9a465136e8cd5a198dfa22f0d5bf9
SHA512ca43b037d2d43ae3200cc062ddfa410f3a57a0346d33c2896710e281e257565f36e555a0fa3f1d35d721598a639ab1ad4b2f56592e6abe03546d1acda06339c3
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\prod1.zipFilesize
515KB
MD5f68008b70822bd28c82d13a289deb418
SHA106abbe109ba6dfd4153d76cd65bfffae129c41d8
SHA256cc6f4faf4e8a9f4d2269d1d69a69ea326f789620fb98078cc98597f3cb998589
SHA512fa482942e32e14011ae3c6762c638ccb0a0e8ec0055d2327c3acc381dddf1400de79e4e9321a39a418800d072e59c36b94b13b7eb62751d3aec990fb38ce9253
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\prod1_extract\installer.exeFilesize
28.0MB
MD558b8915d4281db10762af30eaf315c9e
SHA11e8b10818226fa29bfa5cdd8c2595ba080b72a71
SHA256c19df49f177f0fecf2d406ef7801a8d0e5641cb8a38b7b859cbf118cb5d0684e
SHA51249247941a77f26ab599f948c66df21b6439e86d08652caa9b52ffbcefd80a8c685d75c8088361c98dde44936e44746c961f1828a5b9909fecd6ce9e7e6d2f794
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\prod1_extract\saBSI.exeFilesize
1.1MB
MD5143255618462a577de27286a272584e1
SHA1efc032a6822bc57bcd0c9662a6a062be45f11acb
SHA256f5aa950381fbcea7d730aa794974ca9e3310384a95d6cf4d015fbdbd9797b3e4
SHA512c0a084d5c0b645e6a6479b234fa73c405f56310119dd7c8b061334544c47622fdd5139db9781b339bb3d3e17ac59fddb7d7860834ecfe8aad6d2ae8c869e1cb9
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\prod2.zipFilesize
5.7MB
MD56406abc4ee622f73e9e6cb618190af02
SHA12aa23362907ba1c48eca7f1a372c2933edbb7fa1
SHA256fd83d239b00a44698959145449ebfcb8c52687327deac04455e77a710a3dfe1b
SHA512dd8e43f8a8f6c6e491179240bdfefdf30002f3f2900b1a319b4251dfa9ca7b7f87ddf170ba868ab520f94de9cc7d1854e3bcfd439cad1e8b4223c7ee06d649f1
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\prod2_extract\avg_secure_browser_setup.exeFilesize
5.8MB
MD5591059d6711881a4b12ad5f74d5781bf
SHA133362f43eaf8ad42fd6041d9b08091877fd2efba
SHA25699e8de20a35a362c2a61c0b9e48fe8eb8fc1df452134e7b6390211ab19121a65
SHA5126280064a79ca36df725483e3269bc1e729e67716255f18af542531d7824a5d76b38a7dcefca048022c861ffcbd0563028d39310f987076f6a5da6c7898c1984c
-
C:\Users\Admin\AppData\Local\Temp\is-NEIDT.tmp\zbShieldUtils.dllFilesize
2.0MB
MD5b83f5833e96c2eb13f14dcca805d51a1
SHA19976b0a6ef3dabeab064b188d77d870dcdaf086d
SHA25600e667b838a4125c8cf847936168bb77bb54580bc05669330cb32c0377c4a401
SHA5128641b351e28b3c61ed6762adbca165f4a5f2ee26a023fd74dd2102a6258c0f22e91b78f4a3e9fba6094b68096001de21f10d6495f497580847103c428d30f7bb
-
C:\Users\Admin\AppData\Local\Temp\is-QCFNC.tmp\CheatEngine75.tmpFilesize
2.9MB
MD514e34c5e0e3c320b904b9500e8fa96cf
SHA147cf88e6ddc1683135194b9d8b1cc32c78277f5e
SHA2567398bd01e78df0d69169402f7fecf781c23f61127ba68290d146582ebadbf2ef
SHA5126d99202dafd3209622e6fa217407bccd0b4157550d873bff36f06a279c499c9e98cb01d235c337d76d86c9e3c369d89712450fe1353eb18b2b7c108abd67ad59
-
C:\Users\Admin\AppData\Local\Temp\nsdD9F6.tmp\System.dllFilesize
12KB
MD5192639861e3dc2dc5c08bb8f8c7260d5
SHA158d30e460609e22fa0098bc27d928b689ef9af78
SHA25623d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
SHA5126e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
-
C:\Users\Admin\AppData\Local\Temp\nsiCD16.tmp\AVGBrowserUpdateSetup.exeFilesize
1.6MB
MD59750ea6c750629d2ca971ab1c074dc9d
SHA17df3d1615bec8f5da86a548f45f139739bde286b
SHA256cd1c5c7635d7e4e56287f87588dea791cf52b8d49ae599b60efb1b4c3567bc9c
SHA5122ecbe819085bb9903a1a1fb6c796ad3b51617dd1fd03234c86e7d830b32a11fbcbff6cdc0191180d368497de2102319b0f56bfd5d8ac06d4f96585164801a04b
-
C:\Users\Admin\AppData\Local\Temp\nsiCD16.tmp\CR.History.tmpFilesize
152KB
MD573bd1e15afb04648c24593e8ba13e983
SHA14dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91
SHA256aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b
SHA5126eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7
-
C:\Users\Admin\AppData\Local\Temp\nsiCD16.tmp\CR.History.tmpFilesize
124KB
MD59618e15b04a4ddb39ed6c496575f6f95
SHA11c28f8750e5555776b3c80b187c5d15a443a7412
SHA256a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
-
C:\Users\Admin\AppData\Local\Temp\nsiCD16.tmp\FF.places.tmpFilesize
5.0MB
MD545fd33d32709909fa4037810fe722a37
SHA147f0e7c4c908f826718ccad23a2c8e3659069a69
SHA256e07b61a213d562677938e647e4631daf89affdf25f9114df8286866bc39777f0
SHA512dad4ac7ec1466c3fc75a76b78bf45f6fcd488b67270128b6eb7885b118acec6fcebc49318b53b65fc457ef4994f67abff13b65a150e9235c5ff5f2e302b06ed7
-
C:\Users\Admin\AppData\Local\Temp\nsiCD16.tmp\JsisPlugins.dllFilesize
2.1MB
MD5bd94620c8a3496f0922d7a443c750047
SHA123c4cb2b4d5f5256e76e54969e7e352263abf057
SHA256c0af9e25c35650f43de4e8a57bb89d43099beead4ca6af6be846319ff84d7644
SHA512954006d27ed365fdf54327d64f05b950c2f0881e395257b87ba8e4cc608ec4771deb490d57dc988571a2e66f730e04e8fe16f356a06070abda1de9f3b0c3da68
-
C:\Users\Admin\AppData\Local\Temp\nsiCD16.tmp\Midex.dllFilesize
126KB
MD5581c4a0b8de60868b89074fe94eb27b9
SHA170b8bdfddb08164f9d52033305d535b7db2599f6
SHA256b13c23af49da0a21959e564cbca8e6b94c181c5eeb95150b29c94ff6afb8f9dd
SHA51294290e72871c622fc32e9661719066bafb9b393e10ed397cae8a6f0c8be6ed0df88e5414f39bc528bf9a81980bdcb621745b6c712f4878f0447595cec59ee33d
-
C:\Users\Admin\AppData\Local\Temp\nsiCD16.tmp\StdUtils.dllFilesize
195KB
MD57602b88d488e54b717a7086605cd6d8d
SHA1c01200d911e744bdffa7f31b3c23068971494485
SHA2562640e4f09aa4c117036bfddd12dc02834e66400392761386bd1fe172a6ddfa11
SHA512a11b68bdaecc1fe3d04246cfd62dd1bb4ef5f360125b40dadf8d475e603e14f24cf35335e01e985f0e7adcf785fdf6c57c7856722bc8dcb4dd2a1f817b1dde3a
-
C:\Users\Admin\AppData\Local\Temp\nsiCD16.tmp\jsis.dllFilesize
127KB
MD54b27df9758c01833e92c51c24ce9e1d5
SHA1c3e227564de6808e542d2a91bbc70653cf88d040
SHA256d37408f77b7a4e7c60800b6d60c47305b487e8e21c82a416784864bd9f26e7bb
SHA512666f1b99d65169ec5b8bc41cdbbc5fe06bcb9872b7d628cb5ece051630a38678291ddc84862101c727f386c75b750c067177e6e67c1f69ab9f5c2e24367659f4
-
C:\Users\Admin\AppData\Local\Temp\nsiCD16.tmp\nsJSON.dllFilesize
36KB
MD5ddb56a646aea54615b29ce7df8cd31b8
SHA10ea1a1528faafd930ddceb226d9deaf4fa53c8b2
SHA25607e602c54086a8fa111f83a38c2f3ee239f49328990212c2b3a295fade2b5069
SHA5125d5d6ee7ac7454a72059be736ec8da82572f56e86454c5cbfe26e7956752b6df845a6b0fada76d92473033ca68cd9f87c8e60ac664320b015bb352915abe33c8
-
C:\Users\Admin\AppData\Local\Temp\nsiCD16.tmp\thirdparty.dllFilesize
93KB
MD5070335e8e52a288bdb45db1c840d446b
SHA19db1be3d0ab572c5e969fea8d38a217b4d23cab2
SHA256c8cf0cf1c2b8b14cbedfe621d81a79c80d70f587d698ad6dfb54bbe8e346fbbc
SHA5126f49b82c5dbb84070794bae21b86e39d47f1a133b25e09f6a237689fd58b7338ae95440ae52c83fda92466d723385a1ceaf335284d4506757a508abff9d4b44c
-
C:\Users\Admin\AppData\Local\Temp\nssDA06.tmp\Microsoft.Win32.TaskScheduler.dllFilesize
340KB
MD5192d235d98d88bab41eed2a90a2e1942
SHA12c92c1c607ba0ca5ad4b2636ea0deb276dcc2266
SHA256c9e3f36781204ed13c0adad839146878b190feb07df41f57693b99ca0a3924e3
SHA512d469b0862af8c92f16e8e96c6454398800f22aac37951252f942f044e2efbfd799a375f13278167b48f6f792d6a3034afeace4a94e0b522f45ea5d6ff286a270
-
C:\Users\Admin\AppData\Local\Temp\nssDA06.tmp\RAVEndPointProtection-installer.exeFilesize
538KB
MD531cb221abd09084bf10c8d6acf976a21
SHA11214ac59242841b65eaa5fd78c6bed0c2a909a9b
SHA2561bbba4dba3eb631909ba4b222d903293f70f7d6e1f2c9f52ae0cfca4e168bd0b
SHA512502b3acf5306a83cb6c6a917e194ffdce8d3c8985c4488569e59bce02f9562b71e454da53fd4605946d35c344aa4e67667c500ebcd6d1a166f16edbc482ba671
-
C:\Users\Admin\AppData\Local\Temp\nssDA06.tmp\rsAtom.dllFilesize
156KB
MD516d9a46099809ac76ef74a007cf5e720
SHA1e4870bf8cef67a09103385b03072f41145baf458
SHA25658fec0c60d25f836d17e346b07d14038617ae55a5a13adfca13e2937065958f6
SHA51210247771c77057fa82c1c2dc4d6dfb0f2ab7680cd006dbfa0f9fb93986d2bb37a7f981676cea35aca5068c183c16334f482555f22c9d5a5223d032d5c84b04f2
-
C:\Users\Admin\AppData\Local\Temp\nssDA06.tmp\rsJSON.dllFilesize
217KB
MD5afd0aa2d81db53a742083b0295ae6c63
SHA1840809a937851e5199f28a6e2d433bca08f18a4f
SHA2561b55a9dd09b1cd51a6b1d971d1551233fa2d932bdea793d0743616a4f3edb257
SHA512405e0cbcfff6203ea1224a81fb40bbefa65db59a08baa1b4f3f771240c33416c906a87566a996707ae32e75512abe470aec25820682f0bcf58ccc087a14699ec
-
C:\Users\Admin\AppData\Local\Temp\nssDA06.tmp\rsLogger.dllFilesize
176KB
MD54ece9fa3258b1227842c32f8b82299c0
SHA14fdd1a397497e1bff6306f68105c9cecb8041599
SHA25661e85b501cf8c0f725c5b03c323320e6ee187e84f166d8f9deaf93b2ea6ca0ef
SHA512a923bce293f8af2f2a34e789d6a2f1419dc4b3d760b46df49561948aa917bb244eda6da933290cd36b22121aad126a23d70de99bb663d4c4055280646ec6c9dd
-
C:\Users\Admin\AppData\Local\Temp\nssDA06.tmp\rsStubLib.dllFilesize
248KB
MD598f73ae19c98b734bdbe9dba30e31351
SHA19c656eb736d9fd68d3af64f6074f8bf41c7a727e
SHA256944259d12065d301955931c79a8ae434c3ebccdcbfad5e545bab71765edc9239
SHA5128ad15ef9897e2ffe83b6d0caf2fac09b4eb36d21768d5350b7e003c63cd19f623024cd73ac651d555e1c48019b94fa7746a6c252cc6b78fdffdab6cb11574a70
-
C:\Users\Admin\AppData\Local\Temp\nssDA06.tmp\rsSyncSvc.exeFilesize
795KB
MD53068531529196a5f3c9cb369b8a6a37f
SHA12c2b725964ca47f4d627cf323613538ca1da94d2
SHA256688533610facdd062f37ff95b0fd7d75235c76901c543c4f708cfaa1850d6fac
SHA5127f2d29a46832a9a9634a7f58e2263c9ec74c42cba60ee12b5bb3654ea9cc5ec8ca28b930ba68f238891cb02cf44f3d7ad600bca04b5f6389387233601f7276ef
-
C:\Users\Admin\AppData\Local\Temp\nssDA06.tmp\uninstall.icoFilesize
170KB
MD5af1c23b1e641e56b3de26f5f643eb7d9
SHA16c23deb9b7b0c930533fdbeea0863173d99cf323
SHA2560d3a05e1b06403f2130a6e827b1982d2af0495cdd42deb180ca0ce4f20db5058
SHA5120c503ec7e83a5bfd59ec8ccc80f6c54412263afd24835b8b4272a79c440a0c106875b5c3b9a521a937f0615eb4f112d1d6826948ad5fb6fd173c5c51cb7168f4
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir3028_1302661339\CRX_INSTALL\js\options.bundle.js.LICENSE.txtFilesize
2KB
MD54e994bc011dc4913520bd9f4cefd135a
SHA1de9aa409a953bce76c488dd9b7297a23f63eb909
SHA256923090b15eca2d9a8c7f02431cbc23961b45e34a33c6ca0df8c162abc6f91688
SHA5122d64ebcf3b135c6249d4883c54de3f9bc0cef36c9c071b1295816ee416481659ee1f62d06c92c1b4a92e48c88cb29312398d8cf4e54d3dd5112d801ef3b080db
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir3028_410444590\1fea3a7f-0d1b-49eb-a3d0-b05bb814dc84.tmpFilesize
839KB
MD5f50e00df362d5a597b9e7f549df2587c
SHA1cf6aafdc3f25bcffdcabd3a5db2e40d1cf42dbc9
SHA2561518106d36a5770684ce0cd86279e19ee601225d9222f7f555421990a130eebf
SHA5124691ef983c58d2f027bb0a283ed0a3b11da972588c4c4ab3462fd2e4546f0df85ed1c1f56a481cd86470e3ed02ee8859f22bd04c75a47ce1fe5cb5c983e64577
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir3028_410444590\CRX_INSTALL\_locales\en_GB\messages.jsonFilesize
1KB
MD570c7984777731215a65a737b98c49dfe
SHA160da2b4e5a80334aff5cab61d67fa0facc62f2f8
SHA256fbc68d0c4ed3346ae2a84580168d43b8ce12bc97564e04131ce47a0c3328f1b3
SHA5122609a01feb2f4aac8edb180d854dbb5c93e9b053791d2bfe9c1bc3d7baacb8fcc75c0953d7e150b2203ee1a2f4e65fffdd281bcbfc2fa29326576d7b887052b6
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir3028_410444590\CRX_INSTALL\js\content.bundle.jsFilesize
57KB
MD597adfec6bd687e9709445afc0c573c39
SHA11186a12a096465da449f1b0df7270dbc5283f4b6
SHA256c103fc2d0a2484f40fa091e188ead5757b737bd86d2a926488062436df8cdf50
SHA512e242f0673a8cd0f565a4dc79937bf8280421e2d90a0d7ac6cc18ffbc0b54a692edb714d9edf49d096c88cddc6465df086c98203d1abf960ac66e1186730bd009
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir3028_410444590\CRX_INSTALL\js\fpattr.bundle.jsFilesize
17KB
MD57580759316acf0e6d7a16da84559e6ab
SHA1f17ead86d623eb3527243ea6c6f5512a66fe7186
SHA256f11caa7844dac279cb19b87a7704e4982804a131b5893ec436aa092df587b2c0
SHA512181c4f78dd497539f010eb75e529f9fb48539d559eed5376860e4292cce86ac69b698d7791d64262cfc43454a98552a8a9bcfbf0c777e7e92f7cc67d035e59c6
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir3028_410444590\CRX_INSTALL\js\options.bundle.jsFilesize
524KB
MD5fcf662e70f2981ea9fce846985a3db9c
SHA1fb458741fd44ef6394418f2c83fab11955dd14f6
SHA256e0b4c21430222c675ca600d1aeab56d0546549c760e44052cd7277dc3700e9e4
SHA51228f564d0c6f3fb3dd08dada6b93cd20872e77f87ceffa3ba3c41ae8ffec89330b4397557408cca03737b7426255a23293bd20f6e2a6a72bb84eaaf8ea3830496
-
memory/372-1453-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1448-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1573-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1602-0x00007FF783480000-0x00007FF783490000-memory.dmpFilesize
64KB
-
memory/372-1604-0x00007FF783480000-0x00007FF783490000-memory.dmpFilesize
64KB
-
memory/372-1571-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1606-0x00007FF783480000-0x00007FF783490000-memory.dmpFilesize
64KB
-
memory/372-1627-0x00007FF783480000-0x00007FF783490000-memory.dmpFilesize
64KB
-
memory/372-1655-0x00007FF783480000-0x00007FF783490000-memory.dmpFilesize
64KB
-
memory/372-1658-0x00007FF783480000-0x00007FF783490000-memory.dmpFilesize
64KB
-
memory/372-1579-0x00007FF761AE0000-0x00007FF761AF0000-memory.dmpFilesize
64KB
-
memory/372-1561-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1590-0x00007FF766140000-0x00007FF766150000-memory.dmpFilesize
64KB
-
memory/372-1628-0x00007FF783480000-0x00007FF783490000-memory.dmpFilesize
64KB
-
memory/372-1638-0x00007FF783480000-0x00007FF783490000-memory.dmpFilesize
64KB
-
memory/372-1652-0x00007FF783480000-0x00007FF783490000-memory.dmpFilesize
64KB
-
memory/372-1663-0x00007FF767650000-0x00007FF767660000-memory.dmpFilesize
64KB
-
memory/372-1680-0x00007FF767650000-0x00007FF767660000-memory.dmpFilesize
64KB
-
memory/372-1575-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1574-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1566-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1559-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1558-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1452-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1455-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1457-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1459-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1460-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1462-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1458-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1456-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1560-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1563-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1451-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1449-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1564-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1446-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1445-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1447-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1572-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1570-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1562-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1569-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1565-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1567-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/372-1568-0x00007FF76BDF0000-0x00007FF76BE00000-memory.dmpFilesize
64KB
-
memory/1452-43-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/1452-25-0x0000000004C20000-0x0000000004D60000-memory.dmpFilesize
1.2MB
-
memory/1452-6-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/1452-48-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/1452-2565-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/1452-1588-0x0000000004C20000-0x0000000004D60000-memory.dmpFilesize
1.2MB
-
memory/1452-2578-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/1452-26-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/1452-187-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/1452-186-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/1452-30-0x0000000004C20000-0x0000000004D60000-memory.dmpFilesize
1.2MB
-
memory/1452-31-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/1452-66-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/1452-36-0x0000000004C20000-0x0000000004D60000-memory.dmpFilesize
1.2MB
-
memory/1452-37-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/1452-38-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/1452-42-0x0000000004C20000-0x0000000004D60000-memory.dmpFilesize
1.2MB
-
memory/2080-68-0x000002562B980000-0x000002562BEA8000-memory.dmpFilesize
5.2MB
-
memory/2080-65-0x0000025611000000-0x0000025611008000-memory.dmpFilesize
32KB
-
memory/2080-67-0x00007FFD05DC3000-0x00007FFD05DC5000-memory.dmpFilesize
8KB
-
memory/2408-2-0x0000000000401000-0x00000000004B7000-memory.dmpFilesize
728KB
-
memory/2408-0-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/2408-32-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/3748-1450-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/4580-1454-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/4580-141-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/4948-271-0x00000236CAFA0000-0x00000236CB028000-memory.dmpFilesize
544KB
-
memory/4948-294-0x00000236E64C0000-0x00000236E64FA000-memory.dmpFilesize
232KB
-
memory/4948-283-0x00000236E62B0000-0x00000236E62F0000-memory.dmpFilesize
256KB
-
memory/4948-327-0x00000236E6590000-0x00000236E65E8000-memory.dmpFilesize
352KB
-
memory/4948-289-0x00000236E6270000-0x00000236E62A0000-memory.dmpFilesize
192KB
-
memory/4948-309-0x00000236E6500000-0x00000236E652A000-memory.dmpFilesize
168KB