hxxps://www[.]roblox[.]com/home

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\ = "AVG Secure Browser"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\StubPath = "\"C:\\Program Files\\AVG\\Browser\\Application\\124.0.25069.209\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Localized Name = "AVG Secure Browser"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}	setup.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe	AVGBrowserUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe\DisableExceptionChainValidation = "0"	AVGBrowserUpdate.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\Geo\Nation	avg_secure_browser_setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\Geo\Nation	ajB393.exe
Key value queried	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe

Executes dropped EXE 29 IoCs

pid	Process
6864	Ready Or Not Trainer Setup.exe
10280	Ready Or Not (Steam) Trainer Setup.exe
4904	avg_secure_browser_setup.exe
10516	ajB393.exe
8552	AVGBrowserUpdateSetup.exe
7520	AVGBrowserUpdate.exe
8092	AVGBrowserUpdate.exe
9220	AVGBrowserUpdate.exe
9956	AVGBrowserUpdateComRegisterShell64.exe
10832	AVGBrowserUpdateComRegisterShell64.exe
5832	AVGBrowserUpdateComRegisterShell64.exe
8876	AVGBrowserUpdate.exe
3412	AVGBrowserUpdate.exe
3252	AVGBrowserUpdate.exe
10092	AVGBrowserInstaller.exe
9708	setup.exe
5760	setup.exe
4976	AVGBrowserCrashHandler.exe
6660	AVGBrowserCrashHandler64.exe
10308	setup.exe
8452	setup.exe
10216	AVGBrowser.exe
6352	AVGBrowserUpdate.exe
3056	AVGBrowserUpdate.exe
10016	AVGBrowserUpdate.exe
7776	AVGBrowserCrashHandler64.exe
6000	AVGBrowserCrashHandler.exe
6284	AVGBrowserUpdate.exe
2356	AVGBrowserUpdate.exe

Loads dropped DLL 43 IoCs

pid	Process
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
10516	ajB393.exe
10516	ajB393.exe
10516	ajB393.exe
10516	ajB393.exe
10516	ajB393.exe
10516	ajB393.exe
10516	ajB393.exe
10516	ajB393.exe
7520	AVGBrowserUpdate.exe
8092	AVGBrowserUpdate.exe
9220	AVGBrowserUpdate.exe
9956	AVGBrowserUpdateComRegisterShell64.exe
9220	AVGBrowserUpdate.exe
10832	AVGBrowserUpdateComRegisterShell64.exe
9220	AVGBrowserUpdate.exe
5832	AVGBrowserUpdateComRegisterShell64.exe
9220	AVGBrowserUpdate.exe
7520	AVGBrowserUpdate.exe
7520	AVGBrowserUpdate.exe
8876	AVGBrowserUpdate.exe
3412	AVGBrowserUpdate.exe
3252	AVGBrowserUpdate.exe
3252	AVGBrowserUpdate.exe
3412	AVGBrowserUpdate.exe
3252	AVGBrowserUpdate.exe
10516	ajB393.exe
10216	AVGBrowser.exe
9440	taskmgr.exe
9440	taskmgr.exe
6352	AVGBrowserUpdate.exe
3056	AVGBrowserUpdate.exe
10016	AVGBrowserUpdate.exe
6284	AVGBrowserUpdate.exe
2356	AVGBrowserUpdate.exe
2356	AVGBrowserUpdate.exe
3056	AVGBrowserUpdate.exe
2356	AVGBrowserUpdate.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 23 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll"	AVGBrowserUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ThreadingModel = "Both"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ThreadingModel = "Both"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll"	AVGBrowserUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ThreadingModel = "Both"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ThreadingModel = "Both"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A725D612-7D72-48B8-857A-4777781F415C}\LocalServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A725D612-7D72-48B8-857A-4777781F415C}\LocalServer32\ServerExecutable = "C:\\Program Files\\AVG\\Browser\\Application\\124.0.25069.209\\notification_helper.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ThreadingModel = "Both"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine_64.dll"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32\ThreadingModel = "Both"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A725D612-7D72-48B8-857A-4777781F415C}\LocalServer32\ = "\"C:\\Program Files\\AVG\\Browser\\Application\\124.0.25069.209\\notification_helper.exe\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}\InProcServer32	AVGBrowserUpdateComRegisterShell64.exe

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	ajB393.exe
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\AVAST Software\Avast	ajB393.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	avg_secure_browser_setup.exe
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\AVAST Software\Avast	avg_secure_browser_setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ajB393.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ajB393.exe
File opened for modification	\??\PhysicalDrive0	AVGBrowserUpdate.exe
File opened for modification	\??\PhysicalDrive0	AVGBrowserUpdate.exe
File opened for modification	\??\PhysicalDrive0	AVGBrowserUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files (x86)\GUMDCD2.tmp\goopdateres_de.dll	AVGBrowserUpdateSetup.exe
File created	C:\Program Files (x86)\GUMDCD2.tmp\goopdateres_mr.dll	AVGBrowserUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdate.exe	AVGBrowserUpdate.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\chrome.dll	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Locales\ms.pak	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Locales\th.pak	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\mojo_core.dll	setup.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pt-BR.dll	AVGBrowserUpdate.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\Install\{0FB15589-676D-4FBA-8306-D271D8ECF3E4}\AVGBrowserInstaller.exe	AVGBrowserUpdate.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\Install\{0FB15589-676D-4FBA-8306-D271D8ECF3E4}\CR_257BD.tmp\SETUP.EX_	AVGBrowserInstaller.exe
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_bg.dll	AVGBrowserUpdate.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateOnDemand.exe	AVGBrowserUpdate.exe
File created	C:\Program Files (x86)\GUMDCD2.tmp\psmachine.dll	AVGBrowserUpdateSetup.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_id.dll	AVGBrowserUpdate.exe
File created	C:\Program Files\AVG\Browser\Application\AVGBrowser.exe	setup.exe
File created	C:\Program Files (x86)\GUMDCD2.tmp\acuapi.dll	AVGBrowserUpdateSetup.exe
File created	C:\Program Files (x86)\GUMDCD2.tmp\goopdateres_ro.dll	AVGBrowserUpdateSetup.exe
File created	C:\Program Files (x86)\GUMDCD2.tmp\goopdateres_ta.dll	AVGBrowserUpdateSetup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\resources.pak	setup.exe
File created	C:\Program Files (x86)\GUMDCD2.tmp\@PaxHeader	AVGBrowserUpdateSetup.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_th.dll	AVGBrowserUpdate.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\browser_crash_reporter.exe	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Locales\sr.pak	setup.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_kn.dll	AVGBrowserUpdate.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ur.dll	AVGBrowserUpdate.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Locales\he.pak	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\AVGBrowserProtect.exe	setup.exe
File opened for modification	C:\Program Files (x86)\AVG\Browser\Update\Download\{48F69C39-1356-4A7B-A899-70E3539D4982}\124.0.25069.209\AVGBrowserInstaller.exe	AVGBrowserUpdate.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Locales\ta.pak	setup.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\Recovery\GUR773A.tmp\AVGBrowserUpdateSetup.crx3	AVGBrowserUpdate.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdate.exe	AVGBrowserUpdate.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_mr.dll	AVGBrowserUpdate.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_te.dll	AVGBrowserUpdate.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe	AVGBrowserUpdate.exe
File created	C:\Program Files (x86)\GUMDCD2.tmp\psuser_64.dll	AVGBrowserUpdateSetup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\elevation_service.exe	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Locales\et.pak	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Locales\cs.pak	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Locales\tr.pak	setup.exe
File created	C:\Program Files (x86)\GUMDCD2.tmp\goopdateres_en-GB.dll	AVGBrowserUpdateSetup.exe
File created	C:\Program Files (x86)\GUMDCD2.tmp\goopdateres_hi.dll	AVGBrowserUpdateSetup.exe
File created	C:\Program Files (x86)\GUMDCD2.tmp\goopdateres_ms.dll	AVGBrowserUpdateSetup.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_nl.dll	AVGBrowserUpdate.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\AVGBrowser.exe.sig	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Locales\am.pak	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Locales\hr.pak	setup.exe
File created	C:\Program Files (x86)\GUMDCD2.tmp\goopdateres_sk.dll	AVGBrowserUpdateSetup.exe
File created	C:\Program Files (x86)\GUMDCD2.tmp\goopdateres_uk.dll	AVGBrowserUpdateSetup.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateSetup.exe	AVGBrowserUpdate.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\Install\{0FB15589-676D-4FBA-8306-D271D8ECF3E4}\CR_257BD.tmp\setup.exe	AVGBrowserInstaller.exe
File created	C:\Program Files (x86)\GUMDCD2.tmp\goopdateres_tr.dll	AVGBrowserUpdateSetup.exe
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ro.dll	AVGBrowserUpdate.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Locales\sw.pak	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\124.0.25069.209.manifest	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Locales\gu.pak	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Locales\vi.pak	setup.exe
File opened for modification	C:\Program Files\AVG\Browser\Application\SetupMetrics\20240606031814.pma	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\Locales\lv.pak	setup.exe
File created	C:\Program Files\AVG\Browser\Temp\source9708_892190186\Safer-bin\124.0.25069.209\setup_helper_syslib.dll	setup.exe
File opened for modification	C:\Program Files\AVG\Browser\Application\initial_preferences	setup.exe
File created	C:\Program Files (x86)\GUMDCD2.tmp\goopdateres_vi.dll	AVGBrowserUpdateSetup.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI7AD4.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e6679cf.msi	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\Installer\e6679cb.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EDB7AEE7-E932-4836-AE50-D3B0B7766CB5}	msiexec.exe
File opened for modification	C:\Windows\Installer\e6679cb.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ajB393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ajB393.exe

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6"	AVGBrowserUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\Policy = "3"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppName = "AVGBrowserUpdateBroker.exe"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppName = "AVGBrowserUpdateWebPlugin.exe"	AVGBrowserUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\Policy = "3"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}	AVGBrowserUpdate.exe

Modifies data under HKEY_USERS 34 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\hostprefix	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	AVGBrowserUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\endpoint = "update.avgbrowser.com"	AVGBrowserUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	AVGBrowserUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AVG	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\MachineIdDate = "20240606"	AVGBrowserUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\MachineId = "000058d4b27a012b9e3e4541471e6c69"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\devmode = "0"	AVGBrowserUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	AVGBrowserUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 6c090000745d51c4c0b7da01	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 207f014d9d60103f6dfddb03ec0b1d5a51d4f84ad4d8df40d614557db5d7560d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update	AVGBrowserUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45F7CBA5-258D-4852-AD0A-B18F3FB214F4}\ProxyStubClsid32	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{41A025DF-6171-460F-B9A1-29ECE33E754E}	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E3700FAF-2DC2-4322-99B1-D6A51203AF77}\NumMethods	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191}\NumMethods\ = "8"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DD8E03F-6BE1-41E2-B931-A37C7D1C0317}\NumMethods\ = "4"	AVGBrowserUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "1240"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A708F91-06A3-409E-83BC-4A5CF10C8025}\NumMethods\ = "10"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgHTML\Application\ApplicationCompany = "Gen Digital Inc."	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E21E991-301D-47FD-AB7A-99FBE864EF65}\ProxyStubClsid32	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{41A025DF-6171-460F-B9A1-29ECE33E754E}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FBDC15B-BBCD-402B-A45F-1853B01A9E3C}\ = "Google Update Broker Class Factory"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.OnDemandCOMClassMachine\CLSID\ = "{1FBDC15B-BBCD-402B-A45F-1853B01A9E3C}"	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CoreMachineClass\CLSID	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23AE0B95-20F3-4632-A2AE-C3D706E1D5D9}	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "SR Engine (11.0) Text Normalization"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "207"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgHTML\AppUserModelId = "AVG_Secure_Browser"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AVGBrowserUpdate.exe\AppID = "{82C85EAA-7C94-4702-AA75-DF39403AE358}"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "HKEY_LOCAL_MACHINE/SOFTWARE\\Microsoft\\Speech_OneCore\\AudioOutput\\TokenEnums\\MMAudioOut\\"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "{BAE3E62C-37D4-49AC-A6F1-0E485ECD6757}"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVR = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033David"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8159E37-5EDF-4E6D-8E6D-E558E8DDC2A0}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}"	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59577BB5-F97B-4880-B785-510238C5C5CE}	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B02B2F29-8637-4B78-892A-CFD7CCE793EC}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E3700FAF-2DC2-4322-99B1-D6A51203AF77}	AVGBrowserUpdateComRegisterShell64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{633D953B-278A-4DAC-8E4B-D15296A1C845}\VersionIndependentProgID\ = "AVGUpdate.Update3WebSvc"	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8159E37-5EDF-4E6D-8E6D-E558E8DDC2A0}\ProxyStubClsid32	AVGBrowserUpdateComRegisterShell64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.Update3WebMachine.1.0\CLSID	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.ProcessLauncher\CurVer	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{079CAB07-5001-4E71-9D5A-B412842E5178}\ = "IAppBundle"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC}\ = "IProcessLauncher"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C32E10AE-6600-4A1E-8BEA-EF89A3072F93}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{358EC846-617A-4763-8656-50BF6E0E8AA2}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{358EC846-617A-4763-8656-50BF6E0E8AA2}\1.0\0	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b6a1d4eebeb7da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D37D106C-CDD2-4821-BC7A-F08990DDCA74}\ = "IGoogleUpdateCore"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.Update3WebMachine	AVGBrowserUpdate.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}\ = "IAppVersion"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E21E991-301D-47FD-AB7A-99FBE864EF65}\ = "IApp"	AVGBrowserUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.bing.com\ = "4446"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.Update3WebSvc	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A42B2494-93AE-44E1-B76D-BA8509A5167D}	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A708F91-06A3-409E-83BC-4A5CF10C8025}\NumMethods\ = "10"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E3700FAF-2DC2-4322-99B1-D6A51203AF77}\NumMethods	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.OnDemandCOMClassMachine.1.0\ = "Google Update Broker Class Factory"	AVGBrowserUpdate.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Ready Or Not Trainer Setup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Ready Or Not (Steam) Trainer Setup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\avg_secure_browser_setup.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
10516	ajB393.exe
10516	ajB393.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
10516	ajB393.exe
10516	ajB393.exe
10516	ajB393.exe
10516	ajB393.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
10516	ajB393.exe
10516	ajB393.exe
10516	ajB393.exe
10516	ajB393.exe
10516	ajB393.exe
10516	ajB393.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe
4904	avg_secure_browser_setup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5912	MicrosoftEdgeCP.exe

Suspicious behavior: MapViewOfSection 34 IoCs

pid	Process
1924	MicrosoftEdgeCP.exe
1924	MicrosoftEdgeCP.exe
1924	MicrosoftEdgeCP.exe
1924	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4988	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4988	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4988	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	500	MicrosoftEdge.exe
Token: SeDebugPrivilege	500	MicrosoftEdge.exe
Token: SeDebugPrivilege	4072	firefox.exe
Token: SeDebugPrivilege	4072	firefox.exe
Token: SeDebugPrivilege	4072	firefox.exe
Token: SeDebugPrivilege	4072	firefox.exe
Token: SeDebugPrivilege	4072	firefox.exe
Token: SeDebugPrivilege	4072	firefox.exe
Token: SeDebugPrivilege	4072	firefox.exe
Token: SeDebugPrivilege	4072	firefox.exe
Token: SeDebugPrivilege	4072	firefox.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	7520	AVGBrowserUpdate.exe
Token: SeDebugPrivilege	7520	AVGBrowserUpdate.exe
Token: SeDebugPrivilege	7520	AVGBrowserUpdate.exe
Token: 33	10092	AVGBrowserInstaller.exe
Token: SeIncBasePriorityPrivilege	10092	AVGBrowserInstaller.exe
Token: SeDebugPrivilege	9708	setup.exe
Token: SeDebugPrivilege	9708	setup.exe
Token: SeDebugPrivilege	9708	setup.exe
Token: SeDebugPrivilege	7520	AVGBrowserUpdate.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10516	ajB393.exe
Token: SeIncreaseQuotaPrivilege	10516	ajB393.exe
Token: SeIncreaseQuotaPrivilege	10516	ajB393.exe
Token: SeDebugPrivilege	10308	setup.exe
Token: SeDebugPrivilege	10308	setup.exe
Token: SeDebugPrivilege	10308	setup.exe
Token: SeDebugPrivilege	10308	setup.exe
Token: SeDebugPrivilege	10308	setup.exe
Token: SeDebugPrivilege	10308	setup.exe
Token: SeDebugPrivilege	10308	setup.exe
Token: SeDebugPrivilege	10308	setup.exe
Token: SeDebugPrivilege	10308	setup.exe
Token: SeDebugPrivilege	10308	setup.exe
Token: SeDebugPrivilege	10308	setup.exe
Token: SeIncreaseQuotaPrivilege	10516	ajB393.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe
9440	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
500	MicrosoftEdge.exe
1924	MicrosoftEdgeCP.exe
4988	MicrosoftEdgeCP.exe
1924	MicrosoftEdgeCP.exe
4072	firefox.exe
3672	MicrosoftEdge.exe
5748	MicrosoftEdgeCP.exe
5912	MicrosoftEdgeCP.exe
5912	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
5912	MicrosoftEdgeCP.exe
5912	MicrosoftEdgeCP.exe
5912	MicrosoftEdgeCP.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
6864	Ready Or Not Trainer Setup.exe
6864	Ready Or Not Trainer Setup.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
10280	Ready Or Not (Steam) Trainer Setup.exe
10280	Ready Or Not (Steam) Trainer Setup.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4072	firefox.exe
4904	avg_secure_browser_setup.exe
10516	ajB393.exe
7152	firefox.exe
7152	firefox.exe
7152	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 5040	1924	MicrosoftEdgeCP.exe	79
PID 1924 wrote to memory of 5040	1924	MicrosoftEdgeCP.exe	79
PID 1924 wrote to memory of 5040	1924	MicrosoftEdgeCP.exe	79
PID 1924 wrote to memory of 5040	1924	MicrosoftEdgeCP.exe	79
PID 1924 wrote to memory of 5040	1924	MicrosoftEdgeCP.exe	79
PID 1924 wrote to memory of 5040	1924	MicrosoftEdgeCP.exe	79
PID 1924 wrote to memory of 5040	1924	MicrosoftEdgeCP.exe	79
PID 1924 wrote to memory of 5040	1924	MicrosoftEdgeCP.exe	79
PID 1924 wrote to memory of 5040	1924	MicrosoftEdgeCP.exe	79
PID 1924 wrote to memory of 5040	1924	MicrosoftEdgeCP.exe	79
PID 6124 wrote to memory of 4072	6124	firefox.exe	82
PID 6124 wrote to memory of 4072	6124	firefox.exe	82
PID 6124 wrote to memory of 4072	6124	firefox.exe	82
PID 6124 wrote to memory of 4072	6124	firefox.exe	82
PID 6124 wrote to memory of 4072	6124	firefox.exe	82
PID 6124 wrote to memory of 4072	6124	firefox.exe	82
PID 6124 wrote to memory of 4072	6124	firefox.exe	82
PID 6124 wrote to memory of 4072	6124	firefox.exe	82
PID 6124 wrote to memory of 4072	6124	firefox.exe	82
PID 6124 wrote to memory of 4072	6124	firefox.exe	82
PID 6124 wrote to memory of 4072	6124	firefox.exe	82
PID 4072 wrote to memory of 4056	4072	firefox.exe	83
PID 4072 wrote to memory of 4056	4072	firefox.exe	83
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84
PID 4072 wrote to memory of 4584	4072	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://www.roblox.com/home"
1⤵
PID:4472

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:500

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1252

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4988

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5040

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.0.2081621945\1993622336" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1704 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7b52898-c56f-4f98-a97f-2ed9358515ad} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 1796 17a6a3f5758 gpu
    3⤵
    PID:4056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.1.981770878\1029204406" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac3da55f-5b8c-4649-b61d-611636a6486b} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 2152 17a57f71c58 socket
    3⤵
    - Checks processor information in registry
    PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.2.1291048012\777858106" -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 3032 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb8a6655-07b0-485d-abd2-0505f80c84c6} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 2800 17a6e69ee58 tab
    3⤵
    PID:4692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.3.235793421\870472130" -childID 2 -isForBrowser -prefsHandle 3480 -prefMapHandle 3476 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2c4cafd-0cf4-4fc4-9e87-162bc5471943} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 3492 17a6eceb958 tab
    3⤵
    PID:4256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.4.532924416\1695948495" -childID 3 -isForBrowser -prefsHandle 4112 -prefMapHandle 4080 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd7ed341-c5a2-41fe-81bd-74157ea9519c} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 4132 17a704b9558 tab
    3⤵
    PID:5356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.5.1908002436\1758023550" -childID 4 -isForBrowser -prefsHandle 5032 -prefMapHandle 5044 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0030892-f6cd-48f3-8d83-be6af3e64627} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 5028 17a6ecebc58 tab
    3⤵
    PID:5932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.6.2040816155\1993664017" -childID 5 -isForBrowser -prefsHandle 5088 -prefMapHandle 5092 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fbb988c-cc60-442f-ac1e-1a5c18ee61f9} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 4784 17a70bd2e58 tab
    3⤵
    PID:5936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.7.836498443\707205363" -childID 6 -isForBrowser -prefsHandle 5284 -prefMapHandle 5288 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7df5fc8-c0c5-4eeb-b8dc-13d9e37addfc} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 5368 17a70bd3458 tab
    3⤵
    PID:5948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.8.415764005\487949805" -childID 7 -isForBrowser -prefsHandle 5528 -prefMapHandle 3924 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af716564-b572-45e0-9ebe-07ba518d0bea} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 5660 17a6a6ab658 tab
    3⤵
    PID:4504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.9.530069478\171867095" -parentBuildID 20221007134813 -prefsHandle 4636 -prefMapHandle 4044 -prefsLen 26786 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c1a9211-ae7c-4282-bd15-d0ab1683a940} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 4544 17a72473158 rdd
    3⤵
    PID:68
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.10.50369145\653574319" -childID 8 -isForBrowser -prefsHandle 3924 -prefMapHandle 4712 -prefsLen 26786 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e022741-dada-4713-8492-2e0c13c0c977} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 3600 17a6cd5be58 tab
    3⤵
    PID:2968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.11.1197661936\724975620" -childID 9 -isForBrowser -prefsHandle 5388 -prefMapHandle 5276 -prefsLen 26786 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e65f7650-d2c7-4766-a70d-3f3c46607d01} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 4840 17a72cde758 tab
    3⤵
    PID:7248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.12.1262248193\953243025" -childID 10 -isForBrowser -prefsHandle 10024 -prefMapHandle 10020 -prefsLen 26786 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0354891c-46cd-4e1f-814a-f92375f56428} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 10040 17a72d66f58 tab
    3⤵
    PID:7712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.13.886240099\1413355297" -childID 11 -isForBrowser -prefsHandle 10136 -prefMapHandle 10132 -prefsLen 26786 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aee366e3-639d-469f-b00e-aea55f613b02} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 9996 17a72d67258 tab
    3⤵
    PID:7824
- - C:\Users\Admin\Downloads\Ready Or Not Trainer Setup.exe
    "C:\Users\Admin\Downloads\Ready Or Not Trainer Setup.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:6864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.14.1565438380\1756947742" -childID 12 -isForBrowser -prefsHandle 9608 -prefMapHandle 9600 -prefsLen 26835 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c00b38d6-0a0b-446e-a4dc-89579d639dac} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 4884 17a739cb458 tab
    3⤵
    PID:9788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.15.1521500818\1379976276" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 4040 -prefMapHandle 4024 -prefsLen 26835 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb16f51b-896f-416d-9643-0506357885c6} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 9496 17a73a5cb58 utility
    3⤵
    PID:10076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.16.1802861479\1812555211" -childID 13 -isForBrowser -prefsHandle 9408 -prefMapHandle 9404 -prefsLen 26835 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7ef7b73-f6b0-4a8a-b09e-53f3b1a030f1} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 9396 17a73b56158 tab
    3⤵
    PID:10168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.17.1265004878\529903259" -childID 14 -isForBrowser -prefsHandle 6220 -prefMapHandle 9200 -prefsLen 26835 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e16b526a-f051-4ad1-9bf7-f56366df601a} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 6416 17a74947058 tab
    3⤵
    PID:7436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.18.42103340\1145836908" -childID 15 -isForBrowser -prefsHandle 9280 -prefMapHandle 4828 -prefsLen 26835 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ddb04092-ca31-4f60-8f86-5de6359c7bb3} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 10172 17a73a5b058 tab
    3⤵
    PID:8480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.19.1484732752\2109103478" -childID 16 -isForBrowser -prefsHandle 9100 -prefMapHandle 9096 -prefsLen 26835 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67bd76f2-29e4-41ff-beb1-eb3ab893864b} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 9108 17a73b56a58 tab
    3⤵
    PID:8468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.20.2083171813\1360991372" -childID 17 -isForBrowser -prefsHandle 5672 -prefMapHandle 9532 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63104677-9fb6-444c-ba69-73f10603b1c3} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 5176 17a741e4d58 tab
    3⤵
    PID:7668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.21.854802704\1290082216" -childID 18 -isForBrowser -prefsHandle 5944 -prefMapHandle 5872 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f874a7b8-b814-4a30-8fc5-e57a4d6642f5} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 5724 17a74ce7258 tab
    3⤵
    PID:6716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.22.1191031384\1124610865" -childID 19 -isForBrowser -prefsHandle 9148 -prefMapHandle 9132 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4b2df5f-1359-44ec-a062-682b46cf10d6} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 4860 17a74d3aa58 tab
    3⤵
    PID:8744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.23.1359862789\1917866938" -childID 20 -isForBrowser -prefsHandle 5460 -prefMapHandle 5392 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e932559-ed81-498b-a7f5-ce43d33c5ead} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 5448 17a74d9ab58 tab
    3⤵
    PID:9144
- - C:\Users\Admin\Downloads\Ready Or Not (Steam) Trainer Setup.exe
    "C:\Users\Admin\Downloads\Ready Or Not (Steam) Trainer Setup.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:10280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.24.1322112840\1880342935" -childID 21 -isForBrowser -prefsHandle 9504 -prefMapHandle 9996 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {751ba9e8-260f-432a-982a-b63f46c46eb3} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 9932 17a7501d258 tab
    3⤵
    PID:10940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.25.339650179\1715405056" -childID 22 -isForBrowser -prefsHandle 5316 -prefMapHandle 5176 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a980fd5a-20a7-419b-8845-69d73611c7fa} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 8716 17a7545c258 tab
    3⤵
    PID:9304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.26.1320744407\1101204691" -childID 23 -isForBrowser -prefsHandle 10088 -prefMapHandle 8736 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {070423a8-6f46-4d5a-b6f2-40c193159e74} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 8772 17a7545d758 tab
    3⤵
    PID:6812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.27.1516276107\400354733" -childID 24 -isForBrowser -prefsHandle 8796 -prefMapHandle 8800 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e328fbd6-1f7e-4dd5-8ea6-98d65e1f8ba1} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 5436 17a75312858 tab
    3⤵
    PID:5240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.28.1787121084\1042031531" -childID 25 -isForBrowser -prefsHandle 9960 -prefMapHandle 9520 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc298565-f5ce-4d56-b72d-7f8a8bd46aae} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 6280 17a73b96958 tab
    3⤵
    PID:700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.29.482062077\1837406911" -childID 26 -isForBrowser -prefsHandle 9164 -prefMapHandle 4500 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {30746a70-1353-4ed9-b32a-edb69f15dee2} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 9512 17a75fee558 tab
    3⤵
    PID:9776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.30.162617738\297208961" -childID 27 -isForBrowser -prefsHandle 4884 -prefMapHandle 8620 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {66ac1c65-2801-4d2d-8901-95b756035a5e} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 9048 17a759ce558 tab
    3⤵
    PID:7188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.31.788669528\824070259" -childID 28 -isForBrowser -prefsHandle 9212 -prefMapHandle 8932 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5d3084b-eb60-4f43-95f2-b1d4c869fb41} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 8996 17a76281d58 tab
    3⤵
    PID:3276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.32.1526692256\97588173" -childID 29 -isForBrowser -prefsHandle 8516 -prefMapHandle 9808 -prefsLen 26891 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64a992bf-9c83-4910-b297-9ae16900791e} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 8996 17a753fb258 tab
    3⤵
    PID:1332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.33.14175070\2111937485" -childID 30 -isForBrowser -prefsHandle 5176 -prefMapHandle 8576 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e1de7a9-589d-4e79-a330-bbed0481d3be} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 8572 17a77acde58 tab
    3⤵
    PID:1936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.34.540427017\828818585" -childID 31 -isForBrowser -prefsHandle 5708 -prefMapHandle 5944 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6721fb8f-b835-4627-8e41-ae647ec2e156} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 10192 17a74e4b858 tab
    3⤵
    PID:9080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.35.607887247\978092216" -childID 32 -isForBrowser -prefsHandle 9112 -prefMapHandle 9124 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dfa20ccf-83f9-49f8-b311-168ae1a0105e} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 9900 17a74dd2258 tab
    3⤵
    PID:10312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.36.96791112\2107638687" -childID 33 -isForBrowser -prefsHandle 8444 -prefMapHandle 8384 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e23383f-13ab-48e0-b0cb-38cdbdbccd55} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 8636 17a79afdb58 tab
    3⤵
    PID:7680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.37.134640478\709494643" -childID 34 -isForBrowser -prefsHandle 5992 -prefMapHandle 8456 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {241e71b6-3d76-4ad8-a7b7-8e88fdd24941} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 8464 17a799df858 tab
    3⤵
    PID:1480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.38.540025472\412059890" -childID 35 -isForBrowser -prefsHandle 8064 -prefMapHandle 8060 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b251c1d7-7c00-46ba-8303-9e305b8d3f23} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 8076 17a799e0758 tab
    3⤵
    PID:4232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.39.1076915305\1901660791" -childID 36 -isForBrowser -prefsHandle 7936 -prefMapHandle 7944 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b82d8dc-7e55-415e-a5f6-8499a0d644f1} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 5444 17a799e0d58 tab
    3⤵
    PID:9160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.40.953347268\550302686" -childID 37 -isForBrowser -prefsHandle 7768 -prefMapHandle 9212 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5280902-8a0d-45ec-9d94-e0949fc6df54} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 7764 17a7a928c58 tab
    3⤵
    PID:11120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.41.946321437\297669195" -childID 38 -isForBrowser -prefsHandle 7688 -prefMapHandle 7684 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8266c05-ca33-486f-b216-32a1dd0e031f} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 7700 17a7ac0e858 tab
    3⤵
    PID:8240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.42.1992287397\1626381221" -childID 39 -isForBrowser -prefsHandle 7472 -prefMapHandle 7468 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da9c5efd-a9ce-420b-8f10-68c3efa6dac1} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 7712 17a7ac11258 tab
    3⤵
    PID:2688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.43.2052159795\2067447363" -childID 40 -isForBrowser -prefsHandle 7248 -prefMapHandle 7128 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebaf65e2-e0f5-4e4f-be2c-54cb11177967} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 7260 17a7ae2f958 tab
    3⤵
    PID:10064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.44.754343416\860029668" -childID 41 -isForBrowser -prefsHandle 7092 -prefMapHandle 7088 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4deecc3d-3279-4e68-87b5-c75c56efff95} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 7104 17a7aef2558 tab
    3⤵
    PID:10164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.45.1770644568\1360749494" -childID 42 -isForBrowser -prefsHandle 6896 -prefMapHandle 6892 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {649b46f1-608f-45df-98df-12a1ca22a873} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 6904 17a7aef2e58 tab
    3⤵
    PID:10212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.46.733110711\1819195592" -childID 43 -isForBrowser -prefsHandle 6728 -prefMapHandle 6924 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f281474-c4fd-43ce-9bba-be9590faea7e} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 6720 17a7ab9ef58 tab
    3⤵
    PID:8024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.47.1942627029\1140953665" -childID 44 -isForBrowser -prefsHandle 6548 -prefMapHandle 6552 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b96a210-0c0d-49b4-89f8-9b04e7dd6217} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 5884 17a7b4ad758 tab
    3⤵
    PID:10160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.48.1462056373\369363987" -childID 45 -isForBrowser -prefsHandle 5220 -prefMapHandle 5204 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80112f64-66ed-4234-8bb9-c0fd10e8002f} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 5232 17a7b4af258 tab
    3⤵
    PID:6232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.49.384804915\1036120286" -childID 46 -isForBrowser -prefsHandle 10436 -prefMapHandle 10440 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d780ee9-2d1e-4b5c-9e83-b535f6ec34e8} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 10428 17a7b880458 tab
    3⤵
    PID:10504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.50.1010642711\653494547" -childID 47 -isForBrowser -prefsHandle 10628 -prefMapHandle 10548 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f4070a1-f8ba-466f-81ae-14cfa12e7040} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 10640 17a7bce7358 tab
    3⤵
    PID:7476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.51.301875839\511528340" -childID 48 -isForBrowser -prefsHandle 10812 -prefMapHandle 10828 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8680ccbf-f509-4e97-99f9-40a7857711ae} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 10548 17a7a099a58 tab
    3⤵
    PID:7220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.52.358288022\1942968044" -childID 49 -isForBrowser -prefsHandle 10984 -prefMapHandle 10980 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce359a4d-bfdd-4dbf-b048-bf0a84986441} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 10896 17a7a09a658 tab
    3⤵
    PID:8456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.53.1634865064\151120546" -childID 50 -isForBrowser -prefsHandle 10736 -prefMapHandle 11116 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c05f74d-bc89-4982-a0db-918fb873bfa8} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 10984 17a76e6bb58 tab
    3⤵
    PID:8436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.54.1519860340\1968063818" -childID 51 -isForBrowser -prefsHandle 6240 -prefMapHandle 8156 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cff07869-4b8c-4e1a-88dc-05235f652dd4} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 8172 17a749d8658 tab
    3⤵
    PID:6568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.55.569177592\1360269443" -childID 52 -isForBrowser -prefsHandle 7952 -prefMapHandle 7860 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {95b79dac-5e0e-4e8b-8338-b77caeee74e1} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 7924 17a749d7158 tab
    3⤵
    PID:4092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.56.1335046740\1055690179" -childID 53 -isForBrowser -prefsHandle 7860 -prefMapHandle 8100 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6340b268-2c96-4518-a884-dc5958bf2c99} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 6028 17a7c3f5758 tab
    3⤵
    PID:10800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.57.1947254715\204386257" -childID 54 -isForBrowser -prefsHandle 6540 -prefMapHandle 7080 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {105073a8-da38-41f9-acaa-cca8bf1d2bb5} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 6644 17a7c795858 tab
    3⤵
    PID:6804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.58.1506224737\2953701" -childID 55 -isForBrowser -prefsHandle 6952 -prefMapHandle 9900 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbb1d2f1-3676-422e-900d-a1d8dc0aa5e8} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 7084 17a7cab0e58 tab
    3⤵
    PID:8800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.59.995961958\1562807091" -childID 56 -isForBrowser -prefsHandle 8540 -prefMapHandle 9048 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9bdb737c-1484-4fbc-a671-b5f0bff4b8df} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 8628 17a7b194658 tab
    3⤵
    PID:10600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.60.1982304602\140924550" -childID 57 -isForBrowser -prefsHandle 8400 -prefMapHandle 8952 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8406384f-c1b4-4435-8dba-f075257198ea} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 8884 17a7c3f7258 tab
    3⤵
    PID:4812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.61.1950210730\1320832978" -childID 58 -isForBrowser -prefsHandle 9036 -prefMapHandle 10196 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e23a0db-e46d-4848-8cd1-3ea79cdb9446} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 6740 17a79c64758 tab
    3⤵
    PID:4044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.62.2092384869\906994014" -childID 59 -isForBrowser -prefsHandle 6916 -prefMapHandle 5192 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f902956c-a6f3-488d-8f64-6f6f332bf680} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 7324 17a79c64a58 tab
    3⤵
    PID:8308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.63.1028248431\587147392" -childID 60 -isForBrowser -prefsHandle 7000 -prefMapHandle 7836 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {865eb364-1850-41a3-bb26-4382275de81c} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 6888 17a7aef1358 tab
    3⤵
    PID:10940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.64.1749978153\1218513704" -childID 61 -isForBrowser -prefsHandle 7032 -prefMapHandle 6892 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2752fc83-9330-45ae-a84f-06595e1d512f} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 7188 17a79cb9b58 tab
    3⤵
    PID:2848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.65.1124053379\1948364785" -childID 62 -isForBrowser -prefsHandle 6084 -prefMapHandle 4860 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff127b5c-c4db-4040-aec5-f04098a048f5} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 8940 17a79cb9e58 tab
    3⤵
    PID:4848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4072.66.355837365\1480556926" -childID 63 -isForBrowser -prefsHandle 9964 -prefMapHandle 8296 -prefsLen 27435 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c717f5b9-f41d-4d85-bc15-2e40bee7f265} 4072 "\\.\pipe\gecko-crash-server-pipe.4072" 5688 17a7cf69458 tab
    3⤵
    PID:3864
- - C:\Users\Admin\Downloads\avg_secure_browser_setup.exe
    "C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks for any installed AV software in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\ajB393.exe
      "C:\Users\Admin\AppData\Local\Temp\ajB393.exe" /relaunch=8 /was_elevated=1 /tagdata
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks for any installed AV software in registry
      Checks whether UAC is enabled
      Writes to the Master Boot Record (MBR)
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:10516
    - - C:\Users\Admin\AppData\Local\Temp\nswB43E.tmp\AVGBrowserUpdateSetup.exe
        
        AVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:8552
      - C:\Program Files (x86)\GUMDCD2.tmp\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\GUMDCD2.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome"
        6⤵
        Sets file execution options in registry
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Drops file in Program Files directory
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:7520
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:8092
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:9220
        
        C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:9956
        
        C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:10832
        
        C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:5832
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0ie0NFNEQyQzAxLTQ5NDQtNDdDOC05Q0Q2LTk3MkZENURFRDQ3Rn0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9Ins5QzZGOEE4MC04RjNCLTQ4MUYtOTkzRS02QTg0MEVBRTVFMkF9IiB1c2VyaWRfZGF0ZT0iMjAyNDA2MDYiIG1hY2hpbmVpZD0iezAwMDA1OEQ0LUIyN0EtMDEyQi05RTNFLTQ1NDE0NzFFNkM2OX0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDYwNiIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9Ins4MjdGRkIyMy0yQTFCLTQzODktOEI4RC1CQTQyMTMwQzFFQjR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTUwNjMuMCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLVVTIiBicmFuZD0iOTIyOCIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNzk3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:8876
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{CE4D2C01-4944-47C8-9CD6-972FD5DED47F}" /silent
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3412
    - - C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\setup.exe
        
        setup.exe /silent --create-shortcuts=0 --install-level=1 --system-level
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:10308
      - C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\setup.exe
        
        "C:\Program Files\AVG\Browser\Application\124.0.25069.209\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff66eb8a3f0,0x7ff66eb8a3fc,0x7ff66eb8a408
        6⤵
        Executes dropped EXE
        
        PID:8452
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:10216

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3672

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5748

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5912

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3984

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:2276

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:1664

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6780

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:980

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:8104

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2440

C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:3252
- C:\Program Files (x86)\AVG\Browser\Update\Install\{0FB15589-676D-4FBA-8306-D271D8ECF3E4}\AVGBrowserInstaller.exe
  "C:\Program Files (x86)\AVG\Browser\Update\Install\{0FB15589-676D-4FBA-8306-D271D8ECF3E4}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome --system-level
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:10092
- - C:\Program Files (x86)\AVG\Browser\Update\Install\{0FB15589-676D-4FBA-8306-D271D8ECF3E4}\CR_257BD.tmp\setup.exe
    "C:\Program Files (x86)\AVG\Browser\Update\Install\{0FB15589-676D-4FBA-8306-D271D8ECF3E4}\CR_257BD.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{0FB15589-676D-4FBA-8306-D271D8ECF3E4}\CR_257BD.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome --system-level
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:9708
  - - C:\Program Files (x86)\AVG\Browser\Update\Install\{0FB15589-676D-4FBA-8306-D271D8ECF3E4}\CR_257BD.tmp\setup.exe
      "C:\Program Files (x86)\AVG\Browser\Update\Install\{0FB15589-676D-4FBA-8306-D271D8ECF3E4}\CR_257BD.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=124.0.25069.209 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff79438a3f0,0x7ff79438a3fc,0x7ff79438a408
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:5760
- C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe
  "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe
  "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  PID:6660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:9444

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:9440

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:10268
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:7152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7152.0.1349045418\2031701581" -parentBuildID 20221007134813 -prefsHandle 1608 -prefMapHandle 1600 -prefsLen 21869 -prefMapSize 233995 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c6cf40f-0667-4252-9c53-1061ba89e9b2} 7152 "\\.\pipe\gecko-crash-server-pipe.7152" 1684 24e40be8b58 gpu
    3⤵
    PID:8508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7152.1.1029574226\1325575081" -parentBuildID 20221007134813 -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 21914 -prefMapSize 233995 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d02e115-e98d-41f2-919b-393d59d3c6e5} 7152 "\\.\pipe\gecko-crash-server-pipe.7152" 2004 24e2e9de158 socket
    3⤵
    - Checks processor information in registry
    PID:8500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7152.2.487894194\1393255233" -childID 1 -isForBrowser -prefsHandle 2768 -prefMapHandle 2764 -prefsLen 22375 -prefMapSize 233995 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cb16215-b920-4ec3-b927-19d10f3a39a7} 7152 "\\.\pipe\gecko-crash-server-pipe.7152" 2632 24e443db758 tab
    3⤵
    PID:8300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7152.3.1957181929\1589304605" -childID 2 -isForBrowser -prefsHandle 3168 -prefMapHandle 3164 -prefsLen 27461 -prefMapSize 233995 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f06b143-9735-47ea-8efc-6432174230fd} 7152 "\\.\pipe\gecko-crash-server-pipe.7152" 3180 24e2e968158 tab
    3⤵
    PID:9468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7152.4.1277565865\151157376" -childID 3 -isForBrowser -prefsHandle 3688 -prefMapHandle 3684 -prefsLen 27461 -prefMapSize 233995 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0504a21-f98d-45e1-903b-ad0689765773} 7152 "\\.\pipe\gecko-crash-server-pipe.7152" 3700 24e45a9c658 tab
    3⤵
    PID:1252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7152.5.722789681\1325276327" -childID 4 -isForBrowser -prefsHandle 4464 -prefMapHandle 4448 -prefsLen 27461 -prefMapSize 233995 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c579b1ee-f3a9-4654-974c-31ddf4144fe8} 7152 "\\.\pipe\gecko-crash-server-pipe.7152" 4488 24e45a9b158 tab
    3⤵
    PID:5308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7152.6.1941870269\580285772" -childID 5 -isForBrowser -prefsHandle 4640 -prefMapHandle 4644 -prefsLen 27461 -prefMapSize 233995 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad6f39fc-3d3b-4fbc-a92e-9c24623083d8} 7152 "\\.\pipe\gecko-crash-server-pipe.7152" 4632 24e470ad858 tab
    3⤵
    PID:5296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7152.7.753180249\475293857" -childID 6 -isForBrowser -prefsHandle 4816 -prefMapHandle 4820 -prefsLen 27461 -prefMapSize 233995 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {14b4cf4c-e593-4ead-988c-7c07ac5415dd} 7152 "\\.\pipe\gecko-crash-server-pipe.7152" 4808 24e475a7258 tab
    3⤵
    PID:5280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7152.8.1109287622\839152546" -childID 7 -isForBrowser -prefsHandle 3800 -prefMapHandle 3796 -prefsLen 27461 -prefMapSize 233995 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {374bb097-12fb-4f0f-b270-081d2f8f0aef} 7152 "\\.\pipe\gecko-crash-server-pipe.7152" 3788 24e4433ef58 tab
    3⤵
    PID:9000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7152.9.1607642919\1703131180" -childID 8 -isForBrowser -prefsHandle 5280 -prefMapHandle 5688 -prefsLen 27613 -prefMapSize 233995 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce3972b0-c321-40ad-806c-4759516d600d} 7152 "\\.\pipe\gecko-crash-server-pipe.7152" 5628 24e443c5758 tab
    3⤵
    PID:7024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7152.10.147222391\1229693842" -childID 9 -isForBrowser -prefsHandle 4716 -prefMapHandle 4788 -prefsLen 27613 -prefMapSize 233995 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {71e37d08-baab-4434-a079-6ce8288342d2} 7152 "\\.\pipe\gecko-crash-server-pipe.7152" 4804 24e475ae258 tab
    3⤵
    PID:8252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7152.11.1949826515\1439780079" -childID 10 -isForBrowser -prefsHandle 5224 -prefMapHandle 4800 -prefsLen 27895 -prefMapSize 233995 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f6d5666-6c93-44df-a8fc-3165e855fb5a} 7152 "\\.\pipe\gecko-crash-server-pipe.7152" 4972 24e4a37fb58 tab
    3⤵
    PID:10232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7152.12.1470339804\489893078" -childID 11 -isForBrowser -prefsHandle 3740 -prefMapHandle 5400 -prefsLen 27895 -prefMapSize 233995 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9ec9727-5957-4620-9bf5-8ee90abfbf2b} 7152 "\\.\pipe\gecko-crash-server-pipe.7152" 5408 24e4a620e58 tab
    3⤵
    PID:4500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7152.13.1249288040\818192091" -childID 12 -isForBrowser -prefsHandle 2296 -prefMapHandle 10212 -prefsLen 27895 -prefMapSize 233995 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fab288b4-8154-44b4-b086-88c8799c4df4} 7152 "\\.\pipe\gecko-crash-server-pipe.7152" 10192 24e4c57ea58 tab
    3⤵
    PID:11000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7152.14.956139341\1969764218" -parentBuildID 20221007134813 -prefsHandle 9932 -prefMapHandle 9936 -prefsLen 27895 -prefMapSize 233995 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f0060c0-11b0-4a60-a2b1-24f12243eb5a} 7152 "\\.\pipe\gecko-crash-server-pipe.7152" 9972 24e4c580858 rdd
    3⤵
    PID:10496

C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:3056
- C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
  "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /registermsihelper
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6284

C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /c
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6352
- C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
  "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /cr
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  PID:10016
- C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe
  "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  PID:6000
- C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe
  "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  PID:7776

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2412

C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies data under HKEY_USERS
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery