Overview
overview
10Static
static
1020a6c6e35c...d2.exe
windows7-x64
920a6c6e35c...d2.exe
windows10-2004-x64
9$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDIR/Midex.dll
windows7-x64
6$PLUGINSDIR/Midex.dll
windows10-2004-x64
6$PLUGINSDIR/jsis.dll
windows7-x64
3$PLUGINSDIR/jsis.dll
windows10-2004-x64
3$PLUGINSDI...ON.dll
windows7-x64
3$PLUGINSDI...ON.dll
windows10-2004-x64
3$_106_.dll
windows7-x64
1$_106_.dll
windows10-2004-x64
1Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 01:06
Static task
static1
Behavioral task
behavioral1
Sample
20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/JsisPlugins.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/JsisPlugins.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Midex.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Midex.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/jsis.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/jsis.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsJSON.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsJSON.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
$_106_.dll
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
$_106_.dll
Resource
win10v2004-20240508-en
General
-
Target
20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe
-
Size
5.8MB
-
MD5
60feb08011db31607cee2a5bc1f2206f
-
SHA1
f8f680a3a8ca7eb2058eebdf2f25a95904780988
-
SHA256
20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2
-
SHA512
71db5d12fd3717085b67fe93b671e0f5f7124e1cc3141197572666bc2f914c9b67ba661d49007ea05c7b0cf05345e376ec3894af6696d120957dbb6ce32d3a87
-
SSDEEP
98304:49Aqm4Riz+Hbw3PR/eqltg9yLcYGgtf2euoelboe2u+8zBfjjGMfLrmdxiW4KTmA:lqxRii7AoyLVG8XuoelbT2+bK2rmdADK
Malware Config
Signatures
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nsyAC48.tmp\jsis.dll INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL -
Detects executables referencing many IR and analysis tools 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nsyAC48.tmp\jsis.dll INDICATOR_SUSPICIOUS_References_SecTools -
Detects executables referencing sandbox artifacts 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nsyAC48.tmp\jsis.dll INDICATOR_SUSPICIOUS_References_Sandbox_Artifacts -
Downloads MZ/PE file
-
Modifies Installed Components in the registry 2 TTPs 7 IoCs
Processes:
setup.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\ = "AVG Secure Browser" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\StubPath = "\"C:\\Program Files (x86)\\AVG\\Browser\\Application\\109.0.24111.121\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Localized Name = "AVG Secure Browser" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Version = "43,0,0,0" setup.exe -
Sets file execution options in registry 2 TTPs 2 IoCs
Processes:
AVGBrowserUpdate.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe\DisableExceptionChainValidation = "0" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe AVGBrowserUpdate.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
AVGBrowser.exeajBFC9.exeAVGBrowser.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ajBFC9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ajBFC9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AVGBrowser.exe -
Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ajBFC9.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exe20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exeAVGBrowser.exeAVGBrowser.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation ajBFC9.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation AVGBrowser.exe -
Executes dropped EXE 64 IoCs
Processes:
ajBFC9.exeAVGBrowserUpdateSetup.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserInstaller.exesetup.exesetup.exeAVGBrowserCrashHandler.exeAVGBrowserCrashHandler64.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeelevation_service.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeelevation_service.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeelevation_service.exeelevation_service.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exeAVGBrowser.exepid process 2960 ajBFC9.exe 3068 AVGBrowserUpdateSetup.exe 1616 AVGBrowserUpdate.exe 588 AVGBrowserUpdate.exe 2724 AVGBrowserUpdate.exe 2084 AVGBrowserUpdateComRegisterShell64.exe 2092 AVGBrowserUpdateComRegisterShell64.exe 2216 AVGBrowserUpdateComRegisterShell64.exe 1136 AVGBrowserUpdate.exe 2232 AVGBrowserUpdate.exe 2064 AVGBrowserUpdate.exe 1808 AVGBrowserInstaller.exe 2488 setup.exe 2028 setup.exe 2208 AVGBrowserCrashHandler.exe 924 AVGBrowserCrashHandler64.exe 2756 AVGBrowser.exe 588 AVGBrowser.exe 632 AVGBrowser.exe 3000 AVGBrowser.exe 3048 AVGBrowser.exe 468 2872 elevation_service.exe 2640 AVGBrowser.exe 2392 AVGBrowser.exe 824 AVGBrowser.exe 1348 AVGBrowser.exe 1664 elevation_service.exe 2624 AVGBrowser.exe 1652 AVGBrowser.exe 1428 AVGBrowser.exe 2512 AVGBrowser.exe 1260 AVGBrowser.exe 2208 AVGBrowser.exe 1056 AVGBrowser.exe 1500 elevation_service.exe 476 elevation_service.exe 2212 AVGBrowser.exe 2968 AVGBrowser.exe 2708 AVGBrowser.exe 2828 AVGBrowser.exe 668 AVGBrowser.exe 1832 AVGBrowser.exe 2452 AVGBrowser.exe 1256 AVGBrowser.exe 2576 AVGBrowser.exe 2012 AVGBrowser.exe 1652 AVGBrowser.exe 2444 AVGBrowser.exe 2808 AVGBrowser.exe 2588 AVGBrowser.exe 1680 AVGBrowser.exe 1756 AVGBrowser.exe 2112 AVGBrowser.exe 2672 AVGBrowser.exe 1352 AVGBrowser.exe 2532 AVGBrowser.exe 2072 AVGBrowser.exe 1824 AVGBrowser.exe 2692 AVGBrowser.exe 2108 AVGBrowser.exe 2036 AVGBrowser.exe 2736 AVGBrowser.exe 832 AVGBrowser.exe -
Loads dropped DLL 64 IoCs
Processes:
20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exeajBFC9.exeAVGBrowserUpdateSetup.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserInstaller.exesetup.exepid process 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 2960 ajBFC9.exe 2960 ajBFC9.exe 2960 ajBFC9.exe 2960 ajBFC9.exe 2960 ajBFC9.exe 2960 ajBFC9.exe 2960 ajBFC9.exe 2960 ajBFC9.exe 2960 ajBFC9.exe 2960 ajBFC9.exe 3068 AVGBrowserUpdateSetup.exe 1616 AVGBrowserUpdate.exe 1616 AVGBrowserUpdate.exe 1616 AVGBrowserUpdate.exe 1616 AVGBrowserUpdate.exe 588 AVGBrowserUpdate.exe 588 AVGBrowserUpdate.exe 588 AVGBrowserUpdate.exe 1616 AVGBrowserUpdate.exe 2724 AVGBrowserUpdate.exe 2724 AVGBrowserUpdate.exe 2724 AVGBrowserUpdate.exe 2084 AVGBrowserUpdateComRegisterShell64.exe 2724 AVGBrowserUpdate.exe 2724 AVGBrowserUpdate.exe 2092 AVGBrowserUpdateComRegisterShell64.exe 2724 AVGBrowserUpdate.exe 2724 AVGBrowserUpdate.exe 2216 AVGBrowserUpdateComRegisterShell64.exe 2724 AVGBrowserUpdate.exe 1616 AVGBrowserUpdate.exe 1616 AVGBrowserUpdate.exe 1616 AVGBrowserUpdate.exe 1616 AVGBrowserUpdate.exe 1616 AVGBrowserUpdate.exe 1616 AVGBrowserUpdate.exe 1616 AVGBrowserUpdate.exe 1136 AVGBrowserUpdate.exe 2232 AVGBrowserUpdate.exe 2232 AVGBrowserUpdate.exe 2232 AVGBrowserUpdate.exe 2064 AVGBrowserUpdate.exe 2064 AVGBrowserUpdate.exe 2064 AVGBrowserUpdate.exe 2064 AVGBrowserUpdate.exe 2232 AVGBrowserUpdate.exe 2064 AVGBrowserUpdate.exe 2064 AVGBrowserUpdate.exe 1808 AVGBrowserInstaller.exe 2488 setup.exe 2488 setup.exe 2488 setup.exe 1200 2064 AVGBrowserUpdate.exe 2064 AVGBrowserUpdate.exe 2960 ajBFC9.exe 2960 ajBFC9.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 23 IoCs
Processes:
AVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exesetup.exeAVGBrowserUpdateComRegisterShell64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ThreadingModel = "Both" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ThreadingModel = "Both" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{A725D612-7D72-48B8-857A-4777781F415C}\LocalServer32 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ThreadingModel = "Both" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll" AVGBrowserUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll" AVGBrowserUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A725D612-7D72-48B8-857A-4777781F415C}\LocalServer32\ = "\"C:\\Program Files (x86)\\AVG\\Browser\\Application\\109.0.24111.121\\notification_helper.exe\"" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ThreadingModel = "Both" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ThreadingModel = "Both" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ThreadingModel = "Both" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A725D612-7D72-48B8-857A-4777781F415C}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\AVG\\Browser\\Application\\109.0.24111.121\\notification_helper.exe" setup.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AVGBrowser.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVGBrowserAutoLaunch_2539D9FFF1F40C0A976762D6C815D3E3 = "\"C:\\Program Files (x86)\\AVG\\Browser\\Application\\AVGBrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"Default\"" AVGBrowser.exe -
Checks for any installed AV software in registry 1 TTPs 6 IoCs
Processes:
AVGBrowser.exe20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exeajBFC9.exedescription ioc process Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast AVGBrowser.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\SOFTWARE\AVAST Software\Avast 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast ajBFC9.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\SOFTWARE\AVAST Software\Avast ajBFC9.exe Key opened \REGISTRY\MACHINE\Software\Wow6432Node\AVAST Software\Avast AVGBrowser.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
ajBFC9.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ajBFC9.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
AVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowser.exeAVGBrowser.exeajBFC9.exedescription ioc process File opened for modification \??\PhysicalDrive0 AVGBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 AVGBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 AVGBrowser.exe File opened for modification \??\PhysicalDrive0 AVGBrowser.exe File opened for modification \??\PhysicalDrive0 ajBFC9.exe -
Drops file in Program Files directory 64 IoCs
Processes:
AVGBrowserUpdateSetup.exeAVGBrowserUpdate.exesetup.exeAVGBrowserUpdate.exeajBFC9.exedescription ioc process File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_sr.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_th.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ro.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\browser_proxy.exe setup.exe File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_cs.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_lt.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_lv.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Locales\af.pak setup.exe File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_fa.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_lt.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_da.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_te.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Locales\fi.pak setup.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Locales\te.pak setup.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\AVGBrowserQHelper.exe setup.exe File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_tr.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_vi.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateBroker.exe AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\109.0.24111.121.manifest setup.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Locales\es.pak setup.exe File created C:\Program Files (x86)\GUMFA08.tmp\AVGBrowserUpdate.exe AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_no.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_pl.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_pt-BR.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sk.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Locales\ca.pak setup.exe File created C:\Program Files (x86)\GUMFA08.tmp\AVGBrowserCrashHandler64.exe AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_bg.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_kn.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\chrome.dll.sig setup.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\chrome_200_percent.pak setup.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Locales\bg.pak setup.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Locales\ro.pak setup.exe File opened for modification C:\Program Files (x86)\GUTFA19.tmp AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUMFA08.tmp\psmachine.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_gu.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\Install\{E456941F-F3BD-4E03-BDCF-4D6FFA9A7D11}\AVGBrowserInstaller.exe AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_es.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ja.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Locales\et.pak setup.exe File created C:\Program Files (x86)\AVG\Browser\AVGBrowserUninstall.exe ajBFC9.exe File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_hi.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Extensions\external_extensions.json setup.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\chrome_pwa_launcher.exe setup.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Locales\hu.pak setup.exe File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_sl.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pt-BR.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ru.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_is.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ur.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Locales\he.pak setup.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Locales\ja.pak setup.exe File created C:\Program Files (x86)\AVG\Browser\Application\109.0.24111.121\Installer\chrmstp.exe setup.exe File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_bn.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_lv.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_mr.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Locales\sv.pak setup.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Locales\ta.pak setup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_tr.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Locales\ms.pak setup.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\Locales\ru.pak setup.exe File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_kn.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUMFA08.tmp\goopdateres_ru.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Temp\source2488_171534374\Safer-bin\109.0.24111.121\browser_crash_reporter.exe setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 7 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ajBFC9.exeAVGBrowser.exeAVGBrowser.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ajBFC9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
AVGBrowser.exeAVGBrowser.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AVGBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AVGBrowser.exe -
Processes:
AVGBrowserUpdate.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498} AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppName = "AVGBrowserUpdateWebPlugin.exe" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6" AVGBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\Policy = "3" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077} AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppName = "AVGBrowserUpdateBroker.exe" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6" AVGBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\Policy = "3" AVGBrowserUpdate.exe -
Modifies data under HKEY_USERS 11 IoCs
Processes:
AVGBrowserUpdate.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\MachineId = "000058d4b27a012b9e3e4541471e6c69" AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\ AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\devmode = "0" AVGBrowserUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG\Browser AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\endpoint = "update.avgbrowser.com" AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\hostprefix AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\MachineIdDate = "20240604" AVGBrowserUpdate.exe -
Modifies registry class 64 IoCs
Processes:
AVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdate.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdate.exesetup.exeAVGBrowserUpdateComRegisterShell64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270}\NumMethods\ = "13" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{633D953B-278A-4DAC-8E4B-D15296A1C845}\VersionIndependentProgID\ = "AVGUpdate.Update3WebSvc" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB785069-B832-4423-B813-47F7422BA6E5}\ = "ICoCreateAsync" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2DAE1732-F855-42A3-9D28-B7F6E291ECCD}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BEBC1D02-EC16-479A-83F6-AA4247CA7F70}\Elevation\IconReference = "@C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\goopdate.dll,-1004" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CEBE594-0680-4815-86E1-615A6BE65E0E}\NumMethods\ = "4" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{41A025DF-6171-460F-B9A1-29ECE33E754E}\NumMethods\ = "10" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E37D9308-A3C0-4EC3-87C5-222235C974E3}\LocalServer32\ = "\"C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\AVGBrowserUpdateOnDemand.exe\"" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{40C1C1D3-AAEA-46EE-AA2B-79A2CC62F257}\VersionIndependentProgID\ = "AVGUpdate.CredentialDialogMachine" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B02B2F29-8637-4B78-892A-CFD7CCE793EC}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{358EC846-617A-4763-8656-50BF6E0E8AA2}\1.0\0\win64\ = "C:\\Program Files (x86)\\AVG\\Browser\\Application\\109.0.24111.121\\elevation_service.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A27F7BCA-118B-4330-9B07-9092E8F047E2}\InprocHandler32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}\ProxyStubClsid32 AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}\NumMethods\ = "10" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB785069-B832-4423-B813-47F7422BA6E5}\ = "ICoCreateAsync" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8159E37-5EDF-4E6D-8E6D-E558E8DDC2A0}\ = "IGoogleUpdate" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CA348B59-06AD-4482-AD87-966302908F0F}\LocalService = "AVGSecureBrowserElevationService" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgHTML\Application\AppUserModelId = "AVG_Secure_Browser" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{30612A81-C10F-498E-9163-C2B2A3F81A14}\ = "ServiceModule" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{925547A3-663F-4673-A7B7-3FCACCDC4879}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{079CAB07-5001-4E71-9D5A-B412842E5178}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A025DF-6171-460F-B9A1-29ECE33E754E}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.html\OpenWithProgIds\AvgHTML setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D37D106C-CDD2-4821-BC7A-F08990DDCA74}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{925547A3-663F-4673-A7B7-3FCACCDC4879}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.xhtml\ = "AvgHTML" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E3700FAF-2DC2-4322-99B1-D6A51203AF77} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A27F7BCA-118B-4330-9B07-9092E8F047E2} AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6DD8E03F-6BE1-41E2-B931-A37C7D1C0317} AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BA03866-1403-40EA-81A9-23FCD97810E2}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CoreClass\CurVer\ = "AVGUpdate.CoreClass.1" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D37D106C-CDD2-4821-BC7A-F08990DDCA74}\NumMethods AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{358EC846-617A-4763-8656-50BF6E0E8AA2}\1.0\0 setup.exe Key created \REGISTRY\MACHINE\Software\Classes\http\shell\open\ddeexec setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{925547A3-663F-4673-A7B7-3FCACCDC4879}\NumMethods\ = "11" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7E22D0ED-B403-44D2-BABF-4DDD0DFCA692}\ProgID AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgHTML\DefaultIcon\ = "C:\\Program Files (x86)\\AVG\\Browser\\Application\\AVGBrowser.exe,0" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AvgHTML\shell setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.MiscUtils\CurVer AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7E22D0ED-B403-44D2-BABF-4DDD0DFCA692} AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{358EC846-617A-4763-8656-50BF6E0E8AA2}\TypeLib setup.exe Key created \REGISTRY\MACHINE\Software\Classes\AvgHTML\shell\open setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CoreClass\CurVer AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{925547A3-663F-4673-A7B7-3FCACCDC4879}\ = "IAppCommand" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A725D612-7D72-48B8-857A-4777781F415C}\LocalServer32\ = "\"C:\\Program Files (x86)\\AVG\\Browser\\Application\\109.0.24111.121\\notification_helper.exe\"" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CoreClass\CLSID AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191}\ = "IRegistrationUpdateHook" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45F7CBA5-258D-4852-AD0A-B18F3FB214F4} AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8159E37-5EDF-4E6D-8E6D-E558E8DDC2A0}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23AE0B95-20F3-4632-A2AE-C3D706E1D5D9}\ProgID\ = "AVGUpdate.CoreMachineClass.1" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A42B2494-93AE-44E1-B76D-BA8509A5167D}\VersionIndependentProgID\ = "AVGUpdate.Update3WebMachineFallback" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgHTML\Application\ApplicationDescription = "Access the Internet" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82C85EAA-7C94-4702-AA75-DF39403AE358}\AppID = "{82C85EAA-7C94-4702-AA75-DF39403AE358}" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6972DB5C-E9D6-4A81-B352-B415A3A61CA6}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A708F91-06A3-409E-83BC-4A5CF10C8025}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8C50E3A4-12A8-41FB-9941-E8EEB222E07E}\ProxyStubClsid32 AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C50E3A4-12A8-41FB-9941-E8EEB222E07E}\ = "IProcessLauncher2" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BEBC1D02-EC16-479A-83F6-AA4247CA7F70} AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B80EC6B9-55FF-4E4F-B4E8-9BD098DBBAA5}\ProgID AVGBrowserUpdate.exe -
Processes:
AVGBrowserUpdate.exeajBFC9.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 AVGBrowserUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 ajBFC9.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ajBFC9.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ajBFC9.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 AVGBrowserUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 AVGBrowserUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 AVGBrowserUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde ajBFC9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 ajBFC9.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ajBFC9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 AVGBrowserUpdate.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exeajBFC9.exepid process 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 2960 ajBFC9.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 2960 ajBFC9.exe 2960 ajBFC9.exe 2960 ajBFC9.exe 2960 ajBFC9.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 2960 ajBFC9.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AVGBrowserUpdate.exeAVGBrowserInstaller.exeAVGBrowser.exeAVGBrowser.exedescription pid process Token: SeDebugPrivilege 1616 AVGBrowserUpdate.exe Token: SeDebugPrivilege 1616 AVGBrowserUpdate.exe Token: SeDebugPrivilege 1616 AVGBrowserUpdate.exe Token: 33 1808 AVGBrowserInstaller.exe Token: SeIncBasePriorityPrivilege 1808 AVGBrowserInstaller.exe Token: SeDebugPrivilege 1616 AVGBrowserUpdate.exe Token: SeShutdownPrivilege 2756 AVGBrowser.exe Token: SeShutdownPrivilege 2756 AVGBrowser.exe Token: SeShutdownPrivilege 2756 AVGBrowser.exe Token: SeShutdownPrivilege 2756 AVGBrowser.exe Token: SeShutdownPrivilege 2756 AVGBrowser.exe Token: SeShutdownPrivilege 2756 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe Token: SeShutdownPrivilege 1428 AVGBrowser.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exepid process 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exeajBFC9.exeAVGBrowserUpdateSetup.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exedescription pid process target process PID 1640 wrote to memory of 2960 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe ajBFC9.exe PID 1640 wrote to memory of 2960 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe ajBFC9.exe PID 1640 wrote to memory of 2960 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe ajBFC9.exe PID 1640 wrote to memory of 2960 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe ajBFC9.exe PID 1640 wrote to memory of 2960 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe ajBFC9.exe PID 1640 wrote to memory of 2960 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe ajBFC9.exe PID 1640 wrote to memory of 2960 1640 20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe ajBFC9.exe PID 2960 wrote to memory of 3068 2960 ajBFC9.exe AVGBrowserUpdateSetup.exe PID 2960 wrote to memory of 3068 2960 ajBFC9.exe AVGBrowserUpdateSetup.exe PID 2960 wrote to memory of 3068 2960 ajBFC9.exe AVGBrowserUpdateSetup.exe PID 2960 wrote to memory of 3068 2960 ajBFC9.exe AVGBrowserUpdateSetup.exe PID 2960 wrote to memory of 3068 2960 ajBFC9.exe AVGBrowserUpdateSetup.exe PID 2960 wrote to memory of 3068 2960 ajBFC9.exe AVGBrowserUpdateSetup.exe PID 2960 wrote to memory of 3068 2960 ajBFC9.exe AVGBrowserUpdateSetup.exe PID 3068 wrote to memory of 1616 3068 AVGBrowserUpdateSetup.exe AVGBrowserUpdate.exe PID 3068 wrote to memory of 1616 3068 AVGBrowserUpdateSetup.exe AVGBrowserUpdate.exe PID 3068 wrote to memory of 1616 3068 AVGBrowserUpdateSetup.exe AVGBrowserUpdate.exe PID 3068 wrote to memory of 1616 3068 AVGBrowserUpdateSetup.exe AVGBrowserUpdate.exe PID 3068 wrote to memory of 1616 3068 AVGBrowserUpdateSetup.exe AVGBrowserUpdate.exe PID 3068 wrote to memory of 1616 3068 AVGBrowserUpdateSetup.exe AVGBrowserUpdate.exe PID 3068 wrote to memory of 1616 3068 AVGBrowserUpdateSetup.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 588 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 588 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 588 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 588 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 588 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 588 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 588 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 2724 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 2724 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 2724 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 2724 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 2724 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 2724 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 2724 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 2724 wrote to memory of 2084 2724 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 2724 wrote to memory of 2084 2724 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 2724 wrote to memory of 2084 2724 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 2724 wrote to memory of 2084 2724 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 2724 wrote to memory of 2092 2724 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 2724 wrote to memory of 2092 2724 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 2724 wrote to memory of 2092 2724 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 2724 wrote to memory of 2092 2724 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 2724 wrote to memory of 2216 2724 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 2724 wrote to memory of 2216 2724 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 2724 wrote to memory of 2216 2724 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 2724 wrote to memory of 2216 2724 AVGBrowserUpdate.exe AVGBrowserUpdateComRegisterShell64.exe PID 1616 wrote to memory of 1136 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 1136 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 1136 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 1136 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 1136 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 1136 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 1136 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 2232 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 2232 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 2232 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 2232 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 2232 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 2232 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 1616 wrote to memory of 2232 1616 AVGBrowserUpdate.exe AVGBrowserUpdate.exe PID 2064 wrote to memory of 1808 2064 AVGBrowserUpdate.exe AVGBrowserInstaller.exe PID 2064 wrote to memory of 1808 2064 AVGBrowserUpdate.exe AVGBrowserInstaller.exe PID 2064 wrote to memory of 1808 2064 AVGBrowserUpdate.exe AVGBrowserInstaller.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe"C:\Users\Admin\AppData\Local\Temp\20a6c6e35c32583f23b8701d14233fccec6fc68d6fc78dcffbb4da1c53b6b9d2.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\ajBFC9.exe"C:\Users\Admin\AppData\Local\Temp\ajBFC9.exe" /relaunch=8 /was_elevated=1 /tagdata2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\nsyC370.tmp\AVGBrowserUpdateSetup.exeAVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Diexplore --import-cookies --auto-launch-chrome"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Program Files (x86)\GUMFA08.tmp\AVGBrowserUpdate.exe"C:\Program Files (x86)\GUMFA08.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Diexplore --import-cookies --auto-launch-chrome"4⤵
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:588 -
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2084 -
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2092 -
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2216 -
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezExRUU5QkZGLTE1MEMtNEE4MS05NDdELUQ2OEU2NkZGMjIwMX0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9Ins5MDRCOEEwMC03NDlBLTQzMDAtOEMyNy02MjQwQzMxNkRFMzV9IiB1c2VyaWRfZGF0ZT0iMjAyNDA2MDQiIG1hY2hpbmVpZD0iezAwMDA1OEQ0LUIyN0EtMDEyQi05RTNFLTQ1NDE0NzFFNkM2OX0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDYwNCIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9Ins5N0M2MUNBRS04RkM5LTQ5NjAtQUNBMS1CRDQ0NUE1NUExOEJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjAiIHNwPSJTZXJ2aWNlIFBhY2sgMSIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLVVTIiBicmFuZD0iOTI0OSIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMzI5MiIvPjwvYXBwPjwvcmVxdWVzdD45⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1136 -
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9249&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Diexplore --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{11EE9BFF-150C-4A81-947D-D68E66FF2201}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --heartbeat --install --create-profile3⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2756 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=109.0.24111.121 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef6486b78,0x7fef6486b88,0x7fef6486b984⤵
- Executes dropped EXE
PID:588 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 --field-trial-handle=1180,i,10963008263380258700,15943309300571522082,131072 /prefetch:24⤵
- Executes dropped EXE
PID:632 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=1456 --field-trial-handle=1180,i,10963008263380258700,15943309300571522082,131072 /prefetch:84⤵
- Executes dropped EXE
PID:3000 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1592 --field-trial-handle=1180,i,10963008263380258700,15943309300571522082,131072 /prefetch:84⤵
- Executes dropped EXE
PID:3048 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2376 --field-trial-handle=1180,i,10963008263380258700,15943309300571522082,131072 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
PID:2640 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2384 --field-trial-handle=1180,i,10963008263380258700,15943309300571522082,131072 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
PID:2392 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2880 --field-trial-handle=1180,i,10963008263380258700,15943309300571522082,131072 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
PID:1348 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2980 --field-trial-handle=1180,i,10963008263380258700,15943309300571522082,131072 /prefetch:84⤵
- Executes dropped EXE
PID:824 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3440 --field-trial-handle=1180,i,10963008263380258700,15943309300571522082,131072 /prefetch:24⤵
- Executes dropped EXE
PID:2624 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1112 --field-trial-handle=1180,i,10963008263380258700,15943309300571522082,131072 /prefetch:84⤵
- Executes dropped EXE
PID:1652 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --silent-launch3⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1428 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=109.0.24111.121 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6326b78,0x7fef6326b88,0x7fef6326b984⤵
- Executes dropped EXE
PID:2512 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:24⤵
- Executes dropped EXE
PID:1260 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=1464 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:2208 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1548 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:1056 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2560 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
PID:2212 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2568 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
PID:2968 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1368 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:24⤵
- Executes dropped EXE
PID:2708 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --disable-protect4⤵
- Executes dropped EXE
PID:2828 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=109.0.24111.121 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6326b78,0x7fef6326b88,0x7fef6326b985⤵
- Executes dropped EXE
PID:668 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3516 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:1832 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3944 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:2452 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3836 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:1256 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3804 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:2576 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3704 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:2012 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3708 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:1652 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3672 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:2444 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3752 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:2808 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3824 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:2588 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3632 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:1680 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4172 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:1756 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4312 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:2112 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4440 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:2672 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3740 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:1352 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1424 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:2532 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4656 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:2072 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4756 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:1824 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4864 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:2692 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3704 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:2108 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4176 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:2036 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4036 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:2736 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3972 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵
- Executes dropped EXE
PID:832 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3684 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:1508
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4768 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:3052
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4156 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:2732
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4404 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:2388
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3516 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:1612
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4224 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:2516
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5116 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:1048
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4160 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:2172
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3532 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:3036
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4820 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:1036
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=4524 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:14⤵
- Checks computer location settings
PID:1732 -
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4168 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:2368
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4692 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:2424
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3824 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:2612
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4040 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:1388
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5168 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:864
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4220 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:84⤵PID:2564
-
C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files (x86)\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=3788 --field-trial-handle=1220,i,5411757553981203696,11436749583613082273,131072 /prefetch:14⤵PID:440
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{E456941F-F3BD-4E03-BDCF-4D6FFA9A7D11}\AVGBrowserInstaller.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{E456941F-F3BD-4E03-BDCF-4D6FFA9A7D11}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=iexplore --import-cookies --auto-launch-chrome --system-level2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1808 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{E456941F-F3BD-4E03-BDCF-4D6FFA9A7D11}\CR_09439.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{E456941F-F3BD-4E03-BDCF-4D6FFA9A7D11}\CR_09439.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{E456941F-F3BD-4E03-BDCF-4D6FFA9A7D11}\CR_09439.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=iexplore --import-cookies --auto-launch-chrome --system-level3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
PID:2488 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{E456941F-F3BD-4E03-BDCF-4D6FFA9A7D11}\CR_09439.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{E456941F-F3BD-4E03-BDCF-4D6FFA9A7D11}\CR_09439.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=109.0.24111.121 --initial-client-data=0x14c,0x150,0x154,0x120,0x158,0x140097c40,0x140097c50,0x140097c604⤵
- Executes dropped EXE
PID:2028 -
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
PID:2208 -
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
PID:924
-
C:\Program Files (x86)\AVG\Browser\Application\109.0.24111.121\elevation_service.exe"C:\Program Files (x86)\AVG\Browser\Application\109.0.24111.121\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2872
-
C:\Program Files (x86)\AVG\Browser\Application\109.0.24111.121\elevation_service.exe"C:\Program Files (x86)\AVG\Browser\Application\109.0.24111.121\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1664
-
C:\Program Files (x86)\AVG\Browser\Application\109.0.24111.121\elevation_service.exe"C:\Program Files (x86)\AVG\Browser\Application\109.0.24111.121\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1500
-
C:\Program Files (x86)\AVG\Browser\Application\109.0.24111.121\elevation_service.exe"C:\Program Files (x86)\AVG\Browser\Application\109.0.24111.121\elevation_service.exe"1⤵
- Executes dropped EXE
PID:476
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Defense Evasion
Modify Registry
5Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.6MB
MD53154bd011dbecd86e6de6db6393b1f72
SHA1914b3a63458f2dd05432bb5e4d8fc53966ce2ed7
SHA256f5d036674fbeb5ae3b6d6208054151a1f280994cbf8ef80416d54cde1864d119
SHA512a92a5246ccdcaabe370c0eb60f4fb1d7dac672db1ee70acb06f6cfe227d343551cd6f45919906717ec29dc213c56436ff4801bc08586e6a679fb1d42b85b2987
-
Filesize
441KB
MD54604e676a0a7d18770853919e24ec465
SHA1415ef3b2ca0851e00ebaf0d6c9f6213c561ac98f
SHA256a075b01d9b015c616511a9e87da77da3d9881621db32f584e4606ddabf1c1100
SHA5123d89c21f20772a8bebdb70b29c42fca2f6bffcda49dff9d5644f3f3910b7c710a5c20154a7af5134c9c7a8624a1251b5e56ced9351d87463f31bed8188eb0774
-
Filesize
27B
MD5fc8ee03b2a65f381e4245432d5fef60e
SHA1d2b7d9be66c75ccf24fcb45a6d0dacedd8b6dd6f
SHA256751a04263c2ebb889fdcd11045d6f3602690318ebaaa54f66e1332d76dde9ef4
SHA5120837f2b22c9629990165c5e070e710a69ad4951b7fcfe28bd52354c4b8a7246672497b8aaf521a8773c7ec2a4249fc4318330948ab0d8db8c6c74da57b32f1c4
-
Filesize
149KB
MD5f73e60370efe16a6d985e564275612da
SHA12f829a0a611ac7add51a6bc50569e75181cdfd58
SHA2569cf076866935a0c64366efaeff2ec76d45ac816030ebd616fd5defb1870bc30e
SHA5122e44e87c285bb7b72d45c8119d08ea6f2d13cea77cf0005a3cf530790bb86c7f2df7c5edac9d86c9d7214abb224738c3bf6b31f6bf104051512bb1de133042dc
-
Filesize
170KB
MD5deef1e7382d212cd403431727be417a5
SHA1fac0e754a5734dd5e9602a0327a66e313f7473bb
SHA2567d410e9eabd086827b16c89ee953a643c3e2f7929616c0af579253fd8ca60088
SHA5126b472a57fb89b128aad9ab6313a9ce8b171f7d73264c67f669adc5cf1f0421d81f654dad1419b620476abb59dd54e1aa03a74a26c5c93813f6fb8575fbd97d4d
-
Filesize
428KB
MD52a3ad7362e6c8808fbb4d4ccaba4ed4a
SHA13f896f7df7fe202f4a717713c503665bb4dcaed6
SHA2564dcd341907880c8dea840819628b19c5ea42ca2b5c61ad57147d0ac7da9b6759
SHA512892042ac713e4d5b488262a584355dafa18d967035788799c1773eb39a4616461beb9d79a230d9f85cdefd1b4076b8a5e1d4bde17254bff1f08c3eba56469679
-
Filesize
512KB
MD5dd5dc945cd848bf503862d0a68c3ea5d
SHA19b277a0c733ed5698b0656da8c3b99d2f90c7ef8
SHA2568cc98345e367b083f545ace66d93bf69e03a4fa08b84805a9925fa4c94ef3f8f
SHA512f6eab8422bde24d89a7723c6175b4197a50e18aa0bb5b8f419e5a23b265d85dcaacaf136b8f6ef6bbf2bd6c0eaecd8f86093f594fb98e596f4b39e9c6ff227e1
-
Filesize
1.4MB
MD504a6438c50564146e880c5eb9d57905e
SHA1edf5d454de99159d832cc9bd0d8dbe132d749804
SHA25626109d47bf9960e531888e6c545ca8cfc24fee2202b549df29fb8bf9c58e0812
SHA5128705d0ab2f8a6c1ef567ad00b33ff2cca01391b105eb0ade201d981f091e4ba87e709860ab9849bf9781698fb42ab8efe53ea731af310781766bace1eb1dc19d
-
Filesize
42KB
MD5ba03b29d5d44341084eb06bea8f1e702
SHA17d8dd7556ea5e299b55ddc7477ca758fe2c64f48
SHA2566a6aad33e2910c29a6d919aad074d89359c5e6723ced7ba4e215a62e9513749b
SHA51229f902587b7078deb12bee6bf9993748109749ec12e6490d5f84bc9c532a5a1f414149d5760641ef052611bf2d441423d115dfb5a4c4c6f5e6d6a1f386924cf2
-
Filesize
41KB
MD59c77be0843f0fe4864a04f8d5f24a593
SHA1be03adb4d3c33520e652c7a6ee45f09d5ff54a54
SHA25639547fa5d7b93856235288b1021699b4f36f0bea10b10d6b89ea184a3ad77bb1
SHA512f504c98b03a5d72c078b38a2cc4fdd94dbed159f5a2ed47c2c4a53fc6ec8a3b1fd969d5ad85fc7503e64427a36adee7a14f15f1275a9194103e43c8a8ee45d28
-
Filesize
44KB
MD5c0b41217fc33a6a53ec69ae7399460f2
SHA1d7dd8d543b7297f1a1e138efa1806972c9489c3f
SHA256d75a1a41ad7e5277576e3bdf35a858be3a6f540d21c8ab4156c842d8f1b3295b
SHA51237abb726b78421aaccdbc94b358cda6b581e89ac519258eb39c6a7f0706cfc64c3a96f5c29539ba67c6e2d2afd6f10b6b0c063b54366c03376ce234d132a8253
-
Filesize
44KB
MD5aedf6d96ccb64f488379bb1fe65f697a
SHA1901bbb7873d8f698f49c4b6be74fb50b353d7b5e
SHA256941d22186ef1bfe27052e78d21944d6088cea152d1ede51452f04fb032c92f90
SHA512d1d889a1fe75924f3569e07d9ee3f552afc02165210f5c439d4697be898b72db397bb89e7d0706259f92c1cb5759009f9e1ba5c52f764e63514b3da41dada1cc
-
Filesize
44KB
MD5f951cf3ca93e5ae5fc1ce2da93121d98
SHA115bc869406857437babe41cd3f500c356913499b
SHA256eb00cad19ed1d16f52928962f2cc6231d65eb74b2314976ebeb1ec860103e746
SHA512b77086ad2b39723d697d7839d9243c1c0769a2cb0f6287cd3f2d64eabd6a48d8fc2d253e9089c6586637ed5dc5970c2608615fe77cef5003f0c4d53401ef73bc
-
Filesize
43KB
MD57f3dcd851645d3d75f636c8440fb057f
SHA185debe41ddcb46555a0d00795e41e460a35583c2
SHA2560b31785d1931580cad5ef16d4ff5723802d12c38b56746e70fcf91d71162e043
SHA512d0d21c397899aaa6a718b77195a6af1556309615616fd6583ecb84b04aa7087e76eb5fdd6cae0a4ff1c0f85bf72e1f51ae002042078095f640eb95da363889e4
-
Filesize
43KB
MD59a421423686559027e4301d36bcf58b2
SHA19669424f4e7c765ddb917a515d5a8b1486f87daf
SHA2569d8ff148793d99974fab93f38027e1999323a48620b303f82170751be5dd6b69
SHA512f5d62fe17a820323c4b1832cd3bd9c8fa291d44dceb88a8a1a8f94c6166e550ab9baf9357c5ec3388230bc75f0ccd3aa2d5247fa5d242013d22c61001128a951
-
Filesize
45KB
MD51c15851d9dd22e4ae3f3bf249da79035
SHA160fc5652b5e1c55056c961d4d3b961492cb3432b
SHA256a9dd72a08c0c58a71b2289d76efae681a5c8eb5faf73e49b873f15ba4050baa6
SHA5126da386c35b317f39613da73340631f927606bccd0a8c626537eda896eb32c9a2ed1d71c7cf838f1a4b90553f3f788eeb5e02fe84774fb0ad2f574bf4e4d7e248
-
Filesize
45KB
MD50d15748f01df49dae986f1e27dc098ef
SHA135a435bdaaf47795977b28cdae2e4ea1fdae73a3
SHA256df13c38061cb0b02dd8a9023a17da0bbe1cda6fdedad5203129fc702c7fdd9b1
SHA512290e9936f50e3bd11c1b9d28decf3b43f5e23bbff16801e7b0491690773d057b6bcdcf48c48a7ee16fa2400723b3e974e2b74e3899590a8e660c2e9c78b9d141
-
Filesize
43KB
MD502465169cd873c4492196e03457f2771
SHA1837ca5e54a8c12577d0d05a32996dfc04067c5ea
SHA2564eb9edf550bf1f66382e5d8bd4958438891cd2ca46557d14f4b945dc176ec025
SHA512e73b5f3951050f2903b80b89d2b9fd9ebf69adb922eb8238ef4c01f413ae67727d7598d4ac15f7ac8b9257aef0139e0924c70c5898357142a303d7e2b15394c3
-
Filesize
42KB
MD5418853fe486d8c021d0cca2e85a63d63
SHA19504500a7b5076579d74c23294df4bdb1b7c517d
SHA2564cbb2591c1eeda32bcf295685c993ce4d16acc968697fa12e2a00a1b7c4b37a3
SHA512dc2ab4e2056e6d73a274d700bc16f75c7c687b35874029c1908b183428dec010373045d4a52eb3f5745f8b91d624cf5d40cd7f37e353f3a41348e2a054a266a3
-
Filesize
44KB
MD53e5971e8559c77e8901ce30d14034730
SHA104cc21ac4a84abd29f7d7585282345881fd81721
SHA256613418b8779f7440b88f1734d6c514706df9dc9a58a623966cc1c9ba4e29c28f
SHA512b4592b25cf676db6d6de1be811c39bdeecc24bbfd4dc72fa4b3f97de866f9b0fec7c85f7d56f048f61829c1d8b4109e4a0c7e14a9e410e30a6a8da702941e00e
-
Filesize
45KB
MD55f8ea18786d5ef1927cd95537abc3ae0
SHA15530650ecc719d83b7aa89e0b326b5698e8adda2
SHA256fa416294b078226a8919dbb8f75533a6ef96d63d5bd17aac854eae68791433cf
SHA512577dc7d19e4443e8aede759a781826c091c17d12fb06e89b1306133f21e01dab919045183a916e1b5647ddf485134a8459745a9199df5c7e36abe192645d8e25
-
Filesize
43KB
MD55029406d9202d6f2f279fdd3a06f55a1
SHA1dcca8bf9392faa0038c6cb5d25929726b16804af
SHA256cac545e04d701c39f4a730aec4c3dad177d8ea4baca10651f150925644874864
SHA512519538e05f8e21966e4878291692cf25057bba3c993c0034a33b1da7c9eb0a8fb881565717ceb6c1139fd601b73b1f1e2aa46e20aeb6b93f897cd2ef93172934
-
Filesize
42KB
MD58564514501256ff045cf7aa6c1b5a797
SHA140b9aa8d04c48fe2ecf193c2089418ccc938676d
SHA256f3f46a6da6c8ccb3ce7fdd0cb5882f45523decca95852b8c775bb90f8e92c1b3
SHA512701077c8a1c70c1bd0c35f54aa838dba7b7b6f832e0ef2776673092fca546276166c3638676451c9655086b740b9e193cd54f952fd5fca481b964083b881bcc2
-
Filesize
43KB
MD557dad7c22bd635a5af8fcdcd63d4e530
SHA18aa11ea5c1cacd9b23c29989f22e82c43c827d0e
SHA2561e0d05927a455115265db9308e0f78ffb7bbb5442f36b8483549efbe415454a2
SHA5124236609e37ec41bf46d0f45e228c9021c1624e2f98a642eab513d290a4482da13764fcc2d044f78ebdc09e0cfc63a251678d169cb33e251d6f6d5de9b96c31b6
-
Filesize
44KB
MD55ed0105f4043466a99557dde1f70e97f
SHA1c57c935cc4b25b6375ab3fcdfbb265f4c586ec3e
SHA256cfbe0120ddf8d5574f7c44c85488f53aecec4df9bfb25f1cefbabcad5af46096
SHA5124fa641810f758e0031388ec146467fc130780e2f2cc8495b6a2fff0679d7bcbe7526356f85a97b5338e84d791ba14e812b2c182fdae01763640be3324fb59526
-
Filesize
45KB
MD58ddc3f7276c12ac407cadcda6e2a3e12
SHA178c5e802f67c8b6ae3fe13202e6a54d3cca69df4
SHA2567f2f0f9f443a022f5aedacc40c28d0654fec488f34435c75979118464256a8b7
SHA5120d05bdd2d5e9f36eb09182e8b13507ba03e256c4aadb77bbfedf29584a47fd1e0733a825a3f687d3058e53c8075caf6dd9d24ec93f1bdd58ca97106827323540
-
Filesize
45KB
MD5a4061e8408cc59cb898adfdc4f173278
SHA1ae34e3058a40449481590bb3a63aa0225b4f6f98
SHA256e033c950ecc6333dfcb944e70622e77a6498ba0e23fd144117dbe9a2a0c15be6
SHA512d8a847e9a21c86c7b9b072e16914f42185e3c0e1d99f6ea5259382eb0fb89578c7a7f9f62f892f1d20be180dfc327bc076ea038057895c8b92cb1f0c053e0b2a
-
Filesize
43KB
MD538525b8a1b15a8aeb4fcfc8bee8358bc
SHA1ac2ba33b8ad778a8165c87b579dad0dbef5bed75
SHA256271e83bc86e490cd5b6cb9cb34057c7684d233c56a53f4f553aa07507c9dae52
SHA512ad8df196174ceeadce4588dcd365066665267b922078d92b328ba661a4ebfa6d06b4263a4b8a28e4efb4d86e1140d71a3c3bf4b7b60970aa20552aa7f0c73acb
-
Filesize
44KB
MD527c0dbd61a71420bb4d1a0be2373a175
SHA147b4c107b711caf5a6b2978bd6fd6b53ebdec5e3
SHA25643191a4c507a112e96e06f959b6cf78406bf970b021ad8d7db59d1b9c52779bd
SHA512d1f20e9a628bdcbd26b8d5de89b87bdbc8dab871651c86d47c023daea86c7ada0a565fdd05b48c7643a63db044639f4eb89d1640e58c9b32722e4926c3c5e72a
-
Filesize
44KB
MD5114cc594fab2e564ccb24a826f3623e4
SHA1c3c3fb4ef6ea6ff0e7a1e0289320b2fd2788b03b
SHA256c89e223a42d7173f915dd088ebc84b0048cec772bd4221b4b90ce4c0e419ffe6
SHA5129a7eb5710340cecb2d32de26322dc862812e185b6d260d76c0c7f642f30cf9e43c88aec76b515148ef986db0c77fd0e31f71c8fd26d56a4cc72dff0d023abb5d
-
Filesize
43KB
MD57e7deef6ac35c9d52410fc356391c7e4
SHA143b3d918867a93ba109a3e4eacb45f3cd5c40b93
SHA256963f4d2ad7ddcdcfb6185521c0590a92f2014897d5f5f525471ac81f3807fc5e
SHA5129eb0e9be0a973693b4bd167f6c1118dd9d702b1951a90f0a3a6103e77c43ee6afa173b79d3ab21fe94a98c320b17ab0b787cf5b6ec47d9dde9e3e8c14b8cadc7
-
Filesize
43KB
MD5dae35fa037b6248876347521c5298566
SHA18358fc05a675ea56f720052fbb4b384d97b94d86
SHA256ce0652b8dfaf21b6192b66bf75e140b3d72aa545e0edf62d9e82e9b0878ac5c5
SHA5124158b8fef0da76ead12b5d6e421c5709664ba84d1ddde44ef6bbd1023084cad3820a37abea03b206635a945a2435b301234cf5bac3c8e2861a852b2699036ade
-
Filesize
45KB
MD53ae3106694098f8420b182ad5e3354ab
SHA1bc9dab621b03d4126b97c260becd7f4525255462
SHA25659b406b29538c3c3d0f060b5fc0ccd36556f8a6278327935a5475c6b21741dc9
SHA512f3625be57976083d642b01a41a53d6db6cad3bfc584a50de3565fe10975a5d7d2cf4f8b41bcdaa5ac70f8fc4ada113084de07e2ed45f26401dc2d4f8f4c322a9
-
Filesize
41KB
MD531227325c8617b308ccd268c2be7e72a
SHA171e369f26e644e643fcd538d933e4087dd593f1f
SHA2564a98e34a528eff04c2baf4e9e50489086e58d2e32e1851f33674abbe5e104c68
SHA512ba8d94dde5b7b74a39ed54a5f3e47a558e0c1deb632018c82423c06806071143851bb1d8c7a7bada6f13e71734e7a29457f3741266972b777cded41c953a9645
-
Filesize
40KB
MD50cfc5b7b3f86d6bfaec9a0713da74df3
SHA181a278fdee9edc302fe4e7a88c9addb230ce6df2
SHA2561d7fd1b6a614538530385e7a40efc95d3b8be75057ae03bf999aa2419d1f9f24
SHA5128b8f834ccee41c69c581f0b80f26b0cdb536f87bebd5a6b1f02cdf6f1aea5cf5b29c356e82c7a8fd591bb16c0938a790ac8f90f6d27edc95fc48a5aa3c30cbf0
-
Filesize
45KB
MD549000b4a101e635b05123f21b360b492
SHA1635f697f41c0591168e0eee10930728d9dec5a53
SHA256a2aab58a4397c040bff69d45bef4ede6842034bf897799a9347232c4b6c9c7a5
SHA5129b62c2048e9c132089cce7da02ea5c95b5856f1c6e28d5581f4a0b1748e681bdd78c7d537d273a64f9d476e4ec62da5c6021cc1ccb69f7bee216e7bec6ddc6e0
-
Filesize
39KB
MD5dd2f783c0017630f9a2969957f4eb84e
SHA1d42218de12a7c1c48fb5e7d60e61e32ce0cd9ac6
SHA25607e63e0e3d23f192ac131efc459c2d9f79a4ecdc39403d43fbff320c4b5fa261
SHA512689f625df8aec45a6343249739ec094cbb1245a9dd8847ffe6bf62fd2d7042d529f77216dd22e8b33830cf21b158f0ef6ea42af2248051c8d97205eb0229a22b
-
Filesize
43KB
MD538606bfb6c9bfdf74503f833ee2733e5
SHA1670abd1279f642ec7b19f663e53f2813a716331f
SHA256df6c4228da3bf66929d81b99cb35df4a4389418490144630e1d9d5f422b56b38
SHA5126cc6f2fb0e5bf0241656cce5dc7311f05b8d79633f2176f8c172a9fcfa9813e3963576363d539fa1a8a58fa6bba138dd0baa7562274fbe99be5cda60f4671747
-
Filesize
44KB
MD583c356f6310d51f8ffc1d67d580f5914
SHA1f9bc318975f288fa47e8426b4c450a93b10af45c
SHA25698e35cea7cddce15191594a70f8e15ff2dd1c02bde87225af0331441c65bca26
SHA51228a26cb1d88d072d7898ed27c3e9d056efedaa2cd9eccf951429f41df2c0162be3c14e58cfb4cf50b633d759825fa815a9249e7690d2ab75f60424b30dbe0424
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
169KB
MD5af4279bfe0838ee460bda756579f1b65
SHA15801c6f2a9b1f41dec47d9cc88335a47cac1bea0
SHA25634ac120fba1e4ba7c8de65264e9446e84b37053c01a280809950a0c47486330b
SHA51267f3104b87371a58e7e72a42754c43dac33f12cf2afa1272d0bc0a7499d0d8d38f49d3b8303d6ce2a2b607c7755cd238d1ca38a66923fd8b3d8c6c541f8ce4d7
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\gjcfnponmdkenfdibginkmlmediekpnm\1.26.0.854_0\_metadata\verified_contents.json
Filesize4KB
MD50e7bfb2084dd49ad6bd4b927d594794c
SHA1ba3bf3c75cce643968c7a3cb9fe15f9010d938c3
SHA256e281d85bb3163e6ec3ead28efb084400207b64e690c8302d87f7924b821e0064
SHA5122f10dbd08b917c8c674cb658e9911202d6f601d089ee66f05972bf03e27ff48c2b02bf691bbd30da83ed9a4aa0f8b9f72dc3c0fad4d3754833713b8489484060
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\gjcfnponmdkenfdibginkmlmediekpnm\1.26.0.854_0\background.js
Filesize100KB
MD5d0d58c54aa20e17a2fc7c90c5cbe97d5
SHA159de8f3d461128d40634dd9359eb8fd54d47fd7c
SHA256c533093e78dd57b7358b779dc5a8f1ee2b2fb0d79e3a38d4f3a9d8cc0b9d7149
SHA512c3c83771a5d3dfcb8cd03ef10bac4d55408444b17aaa1e6c88746a9950c8fd4051545260b8bea5c01e8f7572a470b6da862fd861e8e12be9bfa235487b0f8aaa
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Extensions\gjcfnponmdkenfdibginkmlmediekpnm\1.26.0.854_0\webstore.js
Filesize428B
MD5ff713828113f6377533d41a36bff5ebd
SHA17157c2333be0a6df2db2dc0c25d36738acc823f4
SHA25660657bad3b62a195d588178203e25df302ecdb8b51fcc49cc4f628aed8998dfb
SHA512b55bd6b59b57003785db6a8f7e0f46b2ff4db619b4ea143c09f1e456ff1c5efffa46226984849cd8da98f48c06a79a4d00edccba3b7e1d4423e448f1be001113
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Network\87bf23da-7e1d-4d49-b3ad-83bf801e9dde.tmp
Filesize957B
MD5e975a3b9ec5c16b02734fbcd514c2f16
SHA1e7fd5f86a62d18e95b3b8db77443b68a65473245
SHA2562c7ef3c1ebc9f487ed24e63326d377367afd1051098cb740cda2e8f27e676dff
SHA51250baa0921171d5f9451bf5455b0eb1e97708414eaa4c83e43835a7a748bd562a397df78761c30cc151bffbbab842cf0e935e438efb41090eb80ad0d582240f8e
-
Filesize
9KB
MD5596506ffafc7174a5e66869ede3bdd04
SHA17036f3d46b5d2002948adbf5a110c63fa6389de0
SHA2560d7f63a28ae3bb862da145b29a60e5d9ca5c0b8795c815993cb7b5021e99bd22
SHA512e709ea0047768f7382cdcb4ea9bd59b3974857cc3e0d333e50e0541696069093857fc2a65456744c17be6c645168ea0e4c2734dca2d1bf02ffed99f2211fda83
-
Filesize
13KB
MD58a432f742c3faa6c352a06f88c6b813e
SHA1c541d248cf86fd3c48eb8d630e71400e4a85da6d
SHA25676b9e91729285466314684f93b43cdd3cc6261e2ac781b62e96025faea1fe0d2
SHA512dc61070a52f076c1874c60c02967f4db7d674dd30f5d17e84dca5b1c2e1513d8dea7746dce95c27a89de41c728bec8a88cf88c022b4aacc0086e9ca88fe39c07
-
Filesize
10KB
MD53e83c296a256436ed1be25b820bddff7
SHA147a96ccae18ad7f54f2b9b55664c9b8c4c18f9f8
SHA25697fda1867ba33499cad49bf7002a317d4cd024f25a021c7de592730df12958a6
SHA51214847aceecce45c93cb41a2f8c634c81cfed31016dd3f3918ba50d1817b744610c313fd3daa6d32a6317fe13f0aca82e8ddf8dee7dbdd2242c22d2064f68f9df
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Site Characteristics Database\CURRENT~RFf783b6b.TMP
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
50B
MD522bf0e81636b1b45051b138f48b3d148
SHA156755d203579ab356e5620ce7e85519ad69d614a
SHA256e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97
SHA512a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0
-
Filesize
15KB
MD513162a1332659b3162288d65db3ada5f
SHA14a7f893aa99d648b3cf6b65f8c534ecfb0aac9ba
SHA2565f34b91d32841c7a48de732fd57c01e390defb7c97e564c5d36b53c56166eed1
SHA51292ba5d17b044bca45a75d01ec04789315f19b426ad7c74d1d1228c4a298aaa055719a1c4960aafd69eee207df0a9dee6f61d4b65ae24dbce2b77b8181ff07513
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
3KB
MD55c2cc7ce0950702bf21892f7bc8ccaa7
SHA1880d9719011a1ec21736b29a8ca9353b828337b5
SHA2569c764714fc9accf29f0f17c1a2711adbad3eba552267b8f02d2ac443962f232e
SHA5121ffeb08eeec73358e3e350f39938050d58f83dbb60480b78e09b4f7eae3e04b278854202e8ed39bed7222b1592b1a22499539dc192f1c7ca02972797eb434bea
-
Filesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
53B
MD54c94408946d796a8b19c17df5cf0562d
SHA189056150d90683f9548dadc308eb2789a67c2a47
SHA25668042cb47d900c4110ffc5f46e5f8395b35f42d33fc75e58ee34c7f5d8726de7
SHA51296a31f0b7254f42fec787233e2d11991709bc0b2514d163dd1f7696015e7318f9810d9811473fc13d6782d65e40f6a94fe6a7ffef3cb962032cff3bfe8b99a29
-
Filesize
195KB
MD57602b88d488e54b717a7086605cd6d8d
SHA1c01200d911e744bdffa7f31b3c23068971494485
SHA2562640e4f09aa4c117036bfddd12dc02834e66400392761386bd1fe172a6ddfa11
SHA512a11b68bdaecc1fe3d04246cfd62dd1bb4ef5f360125b40dadf8d475e603e14f24cf35335e01e985f0e7adcf785fdf6c57c7856722bc8dcb4dd2a1f817b1dde3a
-
Filesize
26KB
MD5c36eb8336b91d277dfa8575eb00d6364
SHA19ec81b49e7675548449e010950bc50bff7cbc960
SHA2564336e05960fee8c775b343209911f14acbfdde1e8d5aa9d1f0ea680fb4407307
SHA5120abe6e367d1c934fec8a89617b5fbfea5ab7f8e557ada7a667aedb495f637c8782a2f4723c2d68b9edae4f426deb5bbc0536f643fc65ecc2cd33295078474394
-
Filesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
Filesize
5.0MB
MD53476d4395be1207da665dcda0a6a2472
SHA19f491995d1da8d19de2d055f1e13bdd0dea295e9
SHA256f96ab4ba458d267608cc847d760457289317883f0a5add517be53f39a6d8cf97
SHA51223011454397ff897211779e8a46ec0a2a99cf302842bfd6216980fd8b7d6c9200a1fc0cd3f47bcbebc2112c23877decc4a52d3d32afda97f7c1aae9db0d21949
-
Filesize
126KB
MD5581c4a0b8de60868b89074fe94eb27b9
SHA170b8bdfddb08164f9d52033305d535b7db2599f6
SHA256b13c23af49da0a21959e564cbca8e6b94c181c5eeb95150b29c94ff6afb8f9dd
SHA51294290e72871c622fc32e9661719066bafb9b393e10ed397cae8a6f0c8be6ed0df88e5414f39bc528bf9a81980bdcb621745b6c712f4878f0447595cec59ee33d
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_106061592\CRX_INSTALL\js\options.bundle.js.LICENSE.txt
Filesize2KB
MD54e994bc011dc4913520bd9f4cefd135a
SHA1de9aa409a953bce76c488dd9b7297a23f63eb909
SHA256923090b15eca2d9a8c7f02431cbc23961b45e34a33c6ca0df8c162abc6f91688
SHA5122d64ebcf3b135c6249d4883c54de3f9bc0cef36c9c071b1295816ee416481659ee1f62d06c92c1b4a92e48c88cb29312398d8cf4e54d3dd5112d801ef3b080db
-
Filesize
1.3MB
MD506d466a1cde4306356506b35153c5ebd
SHA1c43850528e8150e1f0e253653d2f0155d00585fd
SHA2566b1205e9b435c6241ab9c244b1dc3c309c1d82211268501e71e43c4425fbf590
SHA5125d79ae61fea7097ddf4b5f2c639ddd1ebdffb7d0e69b74aac47e166afbe94e88e3a4dbd1cf34d55c6c8b0fcba3c30b676c8460b120470c17278caf22896b0b33
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1440326505\631bc258-4ff6-4833-a29f-f1793bc3412a.tmp
Filesize839KB
MD5f50e00df362d5a597b9e7f549df2587c
SHA1cf6aafdc3f25bcffdcabd3a5db2e40d1cf42dbc9
SHA2561518106d36a5770684ce0cd86279e19ee601225d9222f7f555421990a130eebf
SHA5124691ef983c58d2f027bb0a283ed0a3b11da972588c4c4ab3462fd2e4546f0df85ed1c1f56a481cd86470e3ed02ee8859f22bd04c75a47ce1fe5cb5c983e64577
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1498056949\9ac3efa4-7f8f-4151-bca2-5e41d733515b.tmp
Filesize2.8MB
MD5f75cbfbb5eaa5f46574955ed6651da78
SHA14ce276c03898e57667b401761fe1df5f11304a68
SHA256643962e7cc16bb8e9edbea5f05473764199c7179d06a65bd88a0d101d1d5a9bd
SHA512287847c5caae39fc80e90ae105a5fb0c9349f402872721c599eb9c9ccaf171437879f0ef8bdeae923bf4520befa316b60acd3e975caf8496f05dad24e1b34e40
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1821403576\088dfa76-ac97-43d8-8ee5-ce67420d1e5f.tmp
Filesize90KB
MD565a028a0d2831eed0228ecda4ab9ef2f
SHA186d5eaec3e1c7ecde3f37ab36a017599ddcb2138
SHA2565cae2b06bc5525e26e08cfaa43be7a5f8df88053397676cf81a5402a1ea0059a
SHA512edad812dffcc0c8b399d3c5c216973bab2fe9e9dbc0d2c6efffc8cca5f1c58e126b83046c4c90febf003f3afd3d3c12c9ba46ad9d18975f2a6c5094643ca4f87
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1981639573\aab6f44a-2a08-4fe2-8f5e-65369a053cb8.tmp
Filesize2.2MB
MD5ffcff8e2ba102530ce54f9ea1529ce48
SHA10d3ebcf3ca535032d825b6a0c5a4c5e45733033a
SHA256bfaebcbdaf420eac93d20ad94680fd13fa391bb8d4f7a29603b5172628fc093f
SHA512e5c8aeccc919a8b07442bb291b1da38a0f82f5a1352b8ac1edbbf9b471675b92cfae53d118c819ed32dc8992ef8efb943e8ecea73d28706a7c88b8d83fd025ec
-
Filesize
1.2MB
MD5d343a7167bf2962f27b54de17ec166a9
SHA1cec2497d5ea819f05be656b8e15f79a6eaf27acf
SHA256a00f73fe6dedd17fd34252c40d89c6be5524027ddb2c0effdbb298d7d7065de3
SHA51264ada12e0bbd202c2f4817bb804d7583baaac469eaac0fd8db0df6bbc9d8d33603feb0cbeae6830b205fa056765da835b0e35b0733e3ce8964b8890aba382a4d
-
Filesize
936KB
MD579e1a051e0bb64259538622f94be9988
SHA19b53e95bdb4a0923ed84a69972dc7168bc2fc942
SHA2565bbcdbe935746ee78233c06331293ccf7a62f359cfd2d88a910cfcb8d9ec65f4
SHA5126beb6aaf5afb4b5f36cee371a149ce5dab8a4553446553a1341996affe10f888f6ec2de19cf3ef355552d71287844fa8cf988d90bf050008f4a7591cfaa31511
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_884216614\CRX_INSTALL\img\common\extensions_page\icon_16.png
Filesize540B
MD567816b9f9f56727c41d64793d0eb4902
SHA199dee423dc2ec6ddb923208240b2fd13409c8ca5
SHA2567b9847ea5d27c37df0430ff4056ecf18b2248d18a10d7ee1cd7f8908f0a82d5d
SHA5126fab420866894593620e95ce3cd988e6a9525b6bdb0b4577f8ee5fe513f3ba187996ccbda9d0b54b493122136e52c7bd179da22cd8106725f24401816429a3c7
-
Filesize
1.9MB
MD521b06e448a0bee23eb6b80dfb39f1e82
SHA1d60b3a9021a704247af4ba58bd539d42f780661f
SHA2563cad9f24f2ec2bee7bef2410ef713924640bda964e865096db6dde37103481ba
SHA5129678b1302eb289f04c0fad0a60455da7d24da4bb72177561f8668f0995d695485eba915bb222d7231a8188ac6ff3b4b0ffbbfe3b725b9c0112ca6af9465f5709
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
204KB
MD5cbcdf56c8a2788ed761ad3178e2d6e9c
SHA1bdee21667760bc0df3046d6073a05d779fdc82cb
SHA256e9265a40e5ee5302e8e225ea39a67d452eaac20370f8b2828340ba079abbbfd3
SHA5125f68e7dffdd3424e0eb2e5cd3d05f8b6ba497aab9408702505341b2c89f265ebb4f9177611d51b9a56629a564431421f3ecb8b25eb08fb2c54dfeddecb9e9f2e
-
Filesize
5.8MB
MD5acb51434fd82eb460b052f05950b8dca
SHA1707d192db2ce7cefdefce3037dfb85a18b8811f3
SHA25629ffa251cb267969af445eb664df04d1a7badbcade61a7f754de42b6d4340055
SHA512013dc0abcc9760c6298b7e48007eb1ac4bc2e453f06c1ce4aff218f50cd1e2c4bb44ad6bc5687edb057df8b0e38fa0aaada7a8d045ed08412278d3031527229d
-
Filesize
2.1MB
MD5bd94620c8a3496f0922d7a443c750047
SHA123c4cb2b4d5f5256e76e54969e7e352263abf057
SHA256c0af9e25c35650f43de4e8a57bb89d43099beead4ca6af6be846319ff84d7644
SHA512954006d27ed365fdf54327d64f05b950c2f0881e395257b87ba8e4cc608ec4771deb490d57dc988571a2e66f730e04e8fe16f356a06070abda1de9f3b0c3da68
-
Filesize
127KB
MD54b27df9758c01833e92c51c24ce9e1d5
SHA1c3e227564de6808e542d2a91bbc70653cf88d040
SHA256d37408f77b7a4e7c60800b6d60c47305b487e8e21c82a416784864bd9f26e7bb
SHA512666f1b99d65169ec5b8bc41cdbbc5fe06bcb9872b7d628cb5ece051630a38678291ddc84862101c727f386c75b750c067177e6e67c1f69ab9f5c2e24367659f4
-
Filesize
36KB
MD5ddb56a646aea54615b29ce7df8cd31b8
SHA10ea1a1528faafd930ddceb226d9deaf4fa53c8b2
SHA25607e602c54086a8fa111f83a38c2f3ee239f49328990212c2b3a295fade2b5069
SHA5125d5d6ee7ac7454a72059be736ec8da82572f56e86454c5cbfe26e7956752b6df845a6b0fada76d92473033ca68cd9f87c8e60ac664320b015bb352915abe33c8
-
Filesize
93KB
MD5070335e8e52a288bdb45db1c840d446b
SHA19db1be3d0ab572c5e969fea8d38a217b4d23cab2
SHA256c8cf0cf1c2b8b14cbedfe621d81a79c80d70f587d698ad6dfb54bbe8e346fbbc
SHA5126f49b82c5dbb84070794bae21b86e39d47f1a133b25e09f6a237689fd58b7338ae95440ae52c83fda92466d723385a1ceaf335284d4506757a508abff9d4b44c
-
Filesize
1.6MB
MD59750ea6c750629d2ca971ab1c074dc9d
SHA17df3d1615bec8f5da86a548f45f139739bde286b
SHA256cd1c5c7635d7e4e56287f87588dea791cf52b8d49ae599b60efb1b4c3567bc9c
SHA5122ecbe819085bb9903a1a1fb6c796ad3b51617dd1fd03234c86e7d830b32a11fbcbff6cdc0191180d368497de2102319b0f56bfd5d8ac06d4f96585164801a04b
-
Filesize
5.7MB
MD5f36f05628b515262db197b15c7065b40
SHA174a8005379f26dd0de952acab4e3fc5459cde243
SHA25667abd9e211b354fa222e7926c2876c4b3a7aca239c0af47c756ee1b6db6e6d31
SHA512280390b1cf1b6b1e75eaa157adaf89135963d366b48686d48921a654527f9c1505c195ca1fc16dc85b8f13b2994841ca7877a63af708883418a1d588afa3dbe8