infinitylock | fe7e9e548c9b9bdeb1a42c8ef43087ea58d4b64d72d0d561ba7c7477521444d1

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ajF4B5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AVGBrowser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AVGBrowser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ajF4B5.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVGBrowserAutoLaunch_2539D9FFF1F40C0A976762D6C815D3E3 = "\"C:\\Program Files\\AVG\\Browser\\Application\\AVGBrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"Default\""	AVGBrowser.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\ = "AVG Secure Browser"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\StubPath = "\"C:\\Program Files\\AVG\\Browser\\Application\\126.0.25497.127\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Localized Name = "AVG Secure Browser"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\IsInstalled = "1"	setup.exe

Checks for any installed AV software in registry 1 TTPs 7 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\AVAST Software\Avast	avg_secure_browser_setup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	ajF4B5.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\AVAST Software\Avast	ajF4B5.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	AVGBrowser.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	AVGBrowser.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	AVGBrowser.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	avg_secure_browser_setup.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ajF4B5.exe

Downloads MZ/PE file

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini	FiveM.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe\DisableExceptionChainValidation = "0"	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe	AVGBrowserUpdate.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
647	camo.githubusercontent.com
648	camo.githubusercontent.com
692	raw.githubusercontent.com
815	camo.githubusercontent.com
894	camo.githubusercontent.com
649	camo.githubusercontent.com
690	raw.githubusercontent.com
693	raw.githubusercontent.com
695	raw.githubusercontent.com
896	raw.githubusercontent.com
646	camo.githubusercontent.com
689	raw.githubusercontent.com
691	raw.githubusercontent.com
895	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	AVGBrowserUpdate.exe
File opened for modification	\??\PhysicalDrive0	AVGBrowserUpdate.exe
File opened for modification	\??\PhysicalDrive0	AVGBrowser.exe
File opened for modification	\??\PhysicalDrive0	AVGBrowserUpdate.exe
File opened for modification	\??\PhysicalDrive0	ajF4B5.exe

Checks computer location settings 2 TTPs 19 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowserUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	avg_secure_browser_setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	CitizenFX.exe.new
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	ajF4B5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	AVGBrowser.exe

Deletes itself 1 IoCs

pid	Process
1704	CitizenFX.exe.new

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\main-selector.css.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\JP2KLib.dll.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\virgo_mycomputer_folder_icon.svg.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\psmachine_64.dll.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pt-br\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\pt-br\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_cs.dll.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\file_info.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_hu.dll	AVGBrowserUpdate.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\verisign.bmp.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\iw_get.svg.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\uk-ua\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_Line_White@1x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fi-fi\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforcomments.svg.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\desktop_acrobat_logo.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\MSFT_PackageManagement.schema.mfl.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File created	C:\Program Files\AVG\Browser\Temp\source6600_100688836\Safer-bin\126.0.25497.127\aswengineconnector.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\dot.cur.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\it-it\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File created	C:\Program Files\AVG\Browser\Temp\source6600_100688836\Safer-bin\126.0.25497.127\Locales\id.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nb-no\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\example_icons.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\main-selector.css.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\msedgeupdateres_ug.dll.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File created	C:\Program Files (x86)\GUM8653.tmp\AVGBrowserUpdate.exe	AVGBrowserUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-down_32.svg.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\tr-tr\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_no.dll.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIDE.dll.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ca-es\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\example_icons.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\List.txt.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\AppStore_icon.svg.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\msedgeupdateres_mt.dll.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File created	C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sk.dll	AVGBrowserUpdate.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\manifest.json.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0	[email protected]

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EDB7AEE7-E932-4836-AE50-D3B0B7766CB5}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI76D5.tmp	msiexec.exe
File created	C:\Windows\Installer\e6160c1.msi	msiexec.exe
File created	C:\Windows\Installer\e6160bd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e6160bd.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 64 IoCs

pid	Process
1704	CitizenFX.exe.new
4052	FiveM.exe
2480	FiveM.exe
1704	FiveM_b2699_DumpServer
2348	avg_secure_browser_setup.exe
6288	ajF4B5.exe
5060	AVGBrowserUpdateSetup.exe
7312	AVGBrowserUpdate.exe
8060	AVGBrowserUpdate.exe
8092	AVGBrowserUpdate.exe
8116	AVGBrowserUpdateComRegisterShell64.exe
8140	AVGBrowserUpdateComRegisterShell64.exe
8176	AVGBrowserUpdateComRegisterShell64.exe
2088	AVGBrowserUpdate.exe
3520	AVGBrowserUpdate.exe
6436	AVGBrowserUpdate.exe
7124	AVGBrowserInstaller.exe
6600	setup.exe
2088	setup.exe
8012	AVGBrowserCrashHandler.exe
8072	AVGBrowserCrashHandler64.exe
5760	setup.exe
768	setup.exe
5256	AVGBrowser.exe
8032	AVGBrowser.exe
7996	AVGBrowser.exe
7372	elevation_service.exe
6892	AVGBrowser.exe
6968	AVGBrowser.exe
7700	AVGBrowser.exe
524	AVGBrowser.exe
7012	AVGBrowser.exe
4700	AVGBrowser.exe
2536	AVGBrowser.exe
4640	AVGBrowser.exe
5548	elevation_service.exe
6384	AVGBrowser.exe
8156	AVGBrowser.exe
7860	AVGBrowser.exe
1612	AVGBrowser.exe
3276	AVGBrowser.exe
4892	AVGBrowser.exe
7776	AVGBrowser.exe
6440	AVGBrowser.exe
2536	AVGBrowser.exe
7756	AVGBrowser.exe
4024	AVGBrowser.exe
1164	AVGBrowser.exe
4584	AVGBrowser.exe
6752	AVGBrowser.exe
6072	AVGBrowser.exe
2216	AVGBrowser.exe
4392	AVGBrowser.exe
7992	AVGBrowser.exe
1088	AVGBrowser.exe
7056	AVGBrowser.exe
8112	AVGBrowser.exe
7652	AVGBrowser.exe
7016	AVGBrowser.exe
8096	AVGBrowser.exe
7048	AVGBrowser.exe
1008	AVGBrowser.exe
5672	AVGBrowser.exe
8140	AVGBrowser.exe

Loads dropped DLL 64 IoCs

pid	Process
5500	taskmgr.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
6288	ajF4B5.exe
6288	ajF4B5.exe
6288	ajF4B5.exe
6288	ajF4B5.exe
6288	ajF4B5.exe
6288	ajF4B5.exe
6288	ajF4B5.exe
6288	ajF4B5.exe
7312	AVGBrowserUpdate.exe
8060	AVGBrowserUpdate.exe
8092	AVGBrowserUpdate.exe
8116	AVGBrowserUpdateComRegisterShell64.exe
8092	AVGBrowserUpdate.exe
8140	AVGBrowserUpdateComRegisterShell64.exe
8092	AVGBrowserUpdate.exe
8176	AVGBrowserUpdateComRegisterShell64.exe
8092	AVGBrowserUpdate.exe
7312	AVGBrowserUpdate.exe
7312	AVGBrowserUpdate.exe
2088	AVGBrowserUpdate.exe
3520	AVGBrowserUpdate.exe
6436	AVGBrowserUpdate.exe
6436	AVGBrowserUpdate.exe
3520	AVGBrowserUpdate.exe
6436	AVGBrowserUpdate.exe
6288	ajF4B5.exe
5256	AVGBrowser.exe
8032	AVGBrowser.exe
7996	AVGBrowser.exe
8032	AVGBrowser.exe
8032	AVGBrowser.exe
6892	AVGBrowser.exe
6968	AVGBrowser.exe
6892	AVGBrowser.exe
6968	AVGBrowser.exe
6968	AVGBrowser.exe
6892	AVGBrowser.exe
7700	AVGBrowser.exe
7700	AVGBrowser.exe
7700	AVGBrowser.exe
8032	AVGBrowser.exe
6892	AVGBrowser.exe
6892	AVGBrowser.exe
6892	AVGBrowser.exe
524	AVGBrowser.exe
7012	AVGBrowser.exe
7012	AVGBrowser.exe
524	AVGBrowser.exe
7012	AVGBrowser.exe
524	AVGBrowser.exe
4700	AVGBrowser.exe
4700	AVGBrowser.exe
2536	AVGBrowser.exe
4700	AVGBrowser.exe
2536	AVGBrowser.exe
2536	AVGBrowser.exe
4640	AVGBrowser.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AVGBrowser.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AVGBrowser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ajF4B5.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ajF4B5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AVGBrowser.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	[email protected]
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	[email protected]
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	[email protected]
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	[email protected]
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	AVGBrowser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	AVGBrowser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	AVGBrowser.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Colors	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Colors	FiveM.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6"	AVGBrowserUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\Policy = "3"	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppName = "AVGBrowserUpdateWebPlugin.exe"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6"	AVGBrowserUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\Policy = "3"	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppName = "AVGBrowserUpdateBroker.exe"	AVGBrowserUpdate.exe

Modifies data under HKEY_USERS 33 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\devmode = "0"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\MachineId = "000058d4b27a012b9e3e4541471e6c69"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\MachineIdDate = "20240701"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 4ea2e7931e056309e6fcdd448b85129e66ee42a39c82c271e3d94294e49a2102	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update	AVGBrowserUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AVG	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\hostprefix	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = bc2000001a38bb1b06ccda01	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	AVGBrowserUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\endpoint = "update.avgbrowser.com"	AVGBrowserUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	AVGBrowser.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133643465085164649"	AVGBrowser.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E3700FAF-2DC2-4322-99B1-D6A51203AF77}\NumMethods	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC}\NumMethods	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A708F91-06A3-409E-83BC-4A5CF10C8025}\ = "IAppVersionWeb"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.MiscUtils.1.0\CLSID	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A42B2494-93AE-44E1-B76D-BA8509A5167D}\VersionIndependentProgID	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28E08968-59C8-4A77-BEBA-12C9394AE077}\InprocServer32	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CoreClass.1\CLSID\ = "{384098DD-AB6D-412E-B819-2F10032D9767}"	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E3700FAF-2DC2-4322-99B1-D6A51203AF77}\NumMethods	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	AVGBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.OnDemandCOMClassMachine.1.0\ = "Google Update Broker Class Factory"	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\ = "AVG Browser Plugin"	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.html	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7EEA7BDE239E6384EA053D0B7B67C65B\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D37D106C-CDD2-4821-BC7A-F08990DDCA74}\ = "IGoogleUpdateCore"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A27F7BCA-118B-4330-9B07-9092E8F047E2}\InprocHandler32	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BA03866-1403-40EA-81A9-23FCD97810E2}\NumMethods	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CEBE594-0680-4815-86E1-615A6BE65E0E}\ = "IJobObserver2"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C7E81D6-0463-485E-8DF5-2ADAD81FAF40}	AVGBrowserUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A27F7BCA-118B-4330-9B07-9092E8F047E2}	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C32E10AE-6600-4A1E-8BEA-EF89A3072F93}\ = "IAppWeb"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{40C1C1D3-AAEA-46EE-AA2B-79A2CC62F257}\LocalServer32	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B02B2F29-8637-4B78-892A-CFD7CCE793EC}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB785069-B832-4423-B813-47F7422BA6E5}\NumMethods	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C32E10AE-6600-4A1E-8BEA-EF89A3072F93}\NumMethods\ = "17"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7BA03866-1403-40EA-81A9-23FCD97810E2}\NumMethods	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B02B2F29-8637-4B78-892A-CFD7CCE793EC}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB785069-B832-4423-B813-47F7422BA6E5}\ = "ICoCreateAsync"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C50E3A4-12A8-41FB-9941-E8EEB222E07E}\ProxyStubClsid32	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BEBC1D02-EC16-479A-83F6-AA4247CA7F70}\LocalizedString = "@C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\goopdate.dll,-3000"	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CEBE594-0680-4815-86E1-615A6BE65E0E}\ProxyStubClsid32	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C50E3A4-12A8-41FB-9941-E8EEB222E07E}	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.OnDemandCOMClassMachineFallback\CurVer\ = "AVGUpdate.OnDemandCOMClassMachineFallback.1.0"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CoreMachineClass\CurVer\ = "AVGUpdate.CoreMachineClass.1"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23AE0B95-20F3-4632-A2AE-C3D706E1D5D9}\VersionIndependentProgID\ = "AVGUpdate.CoreMachineClass"	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.html\OpenWithProgids	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D37D106C-CDD2-4821-BC7A-F08990DDCA74}\NumMethods	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{804EC8ED-BF49-41ED-BCD0-CA1D716D3E98}	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6CEBE594-0680-4815-86E1-615A6BE65E0E}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}"	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FBDC15B-BBCD-402B-A45F-1853B01A9E3C}\Elevation	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{079CAB07-5001-4E71-9D5A-B412842E5178}\NumMethods\ = "41"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CEBE594-0680-4815-86E1-615A6BE65E0E}	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CredentialDialogMachine.1.0\ = "goopdate CredentialDialog"	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	AVGBrowser.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	FiveM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC}\NumMethods\ = "6"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59577BB5-F97B-4880-B785-510238C5C5CE}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}\NumMethods	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.MiscUtils\CLSID	AVGBrowserUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6972DB5C-E9D6-4A81-B352-B415A3A61CA6}\NumMethods	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DD8E03F-6BE1-41E2-B931-A37C7D1C0317}	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0BE1521-7935-42E6-B606-058A559910BA}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}"	AVGBrowserUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D37D106C-CDD2-4821-BC7A-F08990DDCA74}	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D37D106C-CDD2-4821-BC7A-F08990DDCA74}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CEBE594-0680-4815-86E1-615A6BE65E0E}\ = "IJobObserver2"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.MiscUtils\CLSID\ = "{7E22D0ED-B403-44D2-BABF-4DDD0DFCA692}"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{804EC8ED-BF49-41ED-BCD0-CA1D716D3E98}\ = "IPackage"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{804EC8ED-BF49-41ED-BCD0-CA1D716D3E98}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}"	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\InprocServer32\ThreadingModel = "Apartment"	AVGBrowserUpdate.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}	AVGBrowserUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A42B2494-93AE-44E1-B76D-BA8509A5167D}\VersionIndependentProgID\ = "AVGUpdate.Update3WebMachineFallback"	AVGBrowserUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CredentialDialogMachine\CurVer\ = "AVGUpdate.CredentialDialogMachine.1.0"	AVGBrowserUpdate.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\FakeWindowsUpdate.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\avg_secure_browser_setup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\InfinityCrypt.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe
2348	avg_secure_browser_setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
8032	AVGBrowser.exe
8032	AVGBrowser.exe
8032	AVGBrowser.exe
8032	AVGBrowser.exe
8032	AVGBrowser.exe
8032	AVGBrowser.exe
8032	AVGBrowser.exe
8032	AVGBrowser.exe
8032	AVGBrowser.exe
8032	AVGBrowser.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1704	CitizenFX.exe.new

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	firefox.exe
Token: SeDebugPrivilege	1240	firefox.exe
Token: SeDebugPrivilege	1240	firefox.exe
Token: SeDebugPrivilege	1240	firefox.exe
Token: SeDebugPrivilege	1240	firefox.exe
Token: SeDebugPrivilege	5500	taskmgr.exe
Token: SeSystemProfilePrivilege	5500	taskmgr.exe
Token: SeCreateGlobalPrivilege	5500	taskmgr.exe
Token: 33	5500	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5500	taskmgr.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	7312	AVGBrowserUpdate.exe
Token: SeDebugPrivilege	7312	AVGBrowserUpdate.exe
Token: SeDebugPrivilege	7312	AVGBrowserUpdate.exe
Token: SeDebugPrivilege	1240	firefox.exe
Token: 33	7124	AVGBrowserInstaller.exe
Token: SeIncBasePriorityPrivilege	7124	AVGBrowserInstaller.exe
Token: SeDebugPrivilege	6600	setup.exe
Token: SeDebugPrivilege	6600	setup.exe
Token: SeDebugPrivilege	6600	setup.exe
Token: SeDebugPrivilege	7312	AVGBrowserUpdate.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	6288	ajF4B5.exe
Token: SeIncreaseQuotaPrivilege	6288	ajF4B5.exe
Token: SeIncreaseQuotaPrivilege	6288	ajF4B5.exe
Token: SeDebugPrivilege	5760	setup.exe
Token: SeDebugPrivilege	5760	setup.exe
Token: SeDebugPrivilege	5760	setup.exe
Token: SeDebugPrivilege	5760	setup.exe
Token: SeDebugPrivilege	5760	setup.exe
Token: SeDebugPrivilege	5760	setup.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
4768	FiveM.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
2480	FiveM.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
8032	AVGBrowser.exe
8032	AVGBrowser.exe
9492	chrmstp.exe
8032	AVGBrowser.exe
1240	firefox.exe
1240	firefox.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
4768	FiveM.exe
4308	OpenWith.exe
1240	firefox.exe
2480	FiveM.exe
5356	OpenWith.exe
2480	FiveM.exe
2480	FiveM.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
2348	avg_secure_browser_setup.exe
6288	ajF4B5.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 1704	4768	FiveM.exe	124
PID 4768 wrote to memory of 1704	4768	FiveM.exe	124
PID 1704 wrote to memory of 4052	1704	CitizenFX.exe.new	97
PID 1704 wrote to memory of 4052	1704	CitizenFX.exe.new	97
PID 3908 wrote to memory of 1240	3908	firefox.exe	99
PID 3908 wrote to memory of 1240	3908	firefox.exe	99
PID 3908 wrote to memory of 1240	3908	firefox.exe	99
PID 3908 wrote to memory of 1240	3908	firefox.exe	99
PID 3908 wrote to memory of 1240	3908	firefox.exe	99
PID 3908 wrote to memory of 1240	3908	firefox.exe	99
PID 3908 wrote to memory of 1240	3908	firefox.exe	99
PID 3908 wrote to memory of 1240	3908	firefox.exe	99
PID 3908 wrote to memory of 1240	3908	firefox.exe	99
PID 3908 wrote to memory of 1240	3908	firefox.exe	99
PID 3908 wrote to memory of 1240	3908	firefox.exe	99
PID 4052 wrote to memory of 2480	4052	FiveM.exe	100
PID 4052 wrote to memory of 2480	4052	FiveM.exe	100
PID 1240 wrote to memory of 3660	1240	firefox.exe	101
PID 1240 wrote to memory of 3660	1240	firefox.exe	101
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102
PID 1240 wrote to memory of 1548	1240	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FiveM.exe
"C:\Users\Admin\AppData\Local\Temp\FiveM.exe"
1⤵
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\CitizenFX.exe.new
  CitizenFX.exe.new -bootstrap "C:\Users\Admin\AppData\Local\Temp\FiveM.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Users\Admin\AppData\Local\Temp\FiveM.exe
    "C:\Users\Admin\AppData\Local\Temp\FiveM.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
      "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
      4⤵
      Drops desktop.ini file(s)
      Executes dropped EXE
      Modifies Control Panel
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2480
    - - C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_b2699_DumpServer
        
        "C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_b2699_DumpServer" -dumpserver:1496 -parentpid:2480
        5⤵
        Executes dropped EXE
        
        PID:1704

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:3276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:3960

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.0.2095812999\1213174484" -parentBuildID 20221007134813 -prefsHandle 1864 -prefMapHandle 1856 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {490a5cb6-5c91-4e13-80ae-83f1ac93196a} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 1988 179a9cd3658 gpu
    3⤵
    PID:3660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.1.229634030\1575215138" -parentBuildID 20221007134813 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba20b0d2-0cfc-4781-87e9-8ad77f8d1f7d} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 2396 179a9633558 socket
    3⤵
    PID:1548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.2.1331185442\1246152413" -childID 1 -isForBrowser -prefsHandle 2888 -prefMapHandle 3000 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {345cea05-6833-4272-bb03-39c88d140be9} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 3100 179adba9558 tab
    3⤵
    PID:672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.3.1961259980\1150359069" -childID 2 -isForBrowser -prefsHandle 3612 -prefMapHandle 3608 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {950c1fa9-c274-45b2-bdef-1dfdb51d998c} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 3620 179ae1c0d58 tab
    3⤵
    PID:3768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.4.1996495772\488634364" -childID 3 -isForBrowser -prefsHandle 4648 -prefMapHandle 4644 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7463bf8-71c5-4cd0-b9ed-567295ca9227} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 4660 179b0144558 tab
    3⤵
    PID:4804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.5.624958802\1763345116" -childID 4 -isForBrowser -prefsHandle 4988 -prefMapHandle 5040 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d44896eb-4297-46df-8b28-12ab47447802} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 5096 17995e6a858 tab
    3⤵
    PID:5848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.6.1508836467\638051571" -childID 5 -isForBrowser -prefsHandle 5068 -prefMapHandle 5036 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bf58b7c-d827-48bd-b7b3-6285b83a0897} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 5076 179a9c0c058 tab
    3⤵
    PID:5856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.7.1050769274\37886837" -childID 6 -isForBrowser -prefsHandle 5332 -prefMapHandle 5336 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b602890e-4fc7-44bc-8b9e-85bb15bf88ae} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 5440 179ac570258 tab
    3⤵
    PID:5868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.8.1599662810\436301251" -childID 7 -isForBrowser -prefsHandle 5784 -prefMapHandle 5776 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10d6b4b8-dd74-4cff-a260-839f3b12b6db} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 5840 179b1421958 tab
    3⤵
    PID:5812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.9.1020125266\1043779505" -childID 8 -isForBrowser -prefsHandle 2852 -prefMapHandle 4688 -prefsLen 27416 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d67964e-4ae8-4e09-8ff3-2a87333ca24e} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 4772 179b1647358 tab
    3⤵
    PID:4564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.10.1021604112\294734210" -childID 9 -isForBrowser -prefsHandle 10284 -prefMapHandle 10288 -prefsLen 27416 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28a372c6-7239-47ab-bb7b-a46509572ae7} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 6276 179b1a7a258 tab
    3⤵
    PID:4620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.11.695278978\116467838" -childID 10 -isForBrowser -prefsHandle 6188 -prefMapHandle 5060 -prefsLen 27416 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {599e6acc-84a1-4c1b-bf04-4bb8149c0258} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 9888 179b3837458 tab
    3⤵
    PID:6124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.12.1983846715\664171862" -childID 11 -isForBrowser -prefsHandle 9828 -prefMapHandle 5460 -prefsLen 27416 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {100ec8f5-ab03-4e41-accd-f26fdca27a4d} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 9820 179b316af58 tab
    3⤵
    PID:5396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.13.1525601958\438826052" -childID 12 -isForBrowser -prefsHandle 5184 -prefMapHandle 5180 -prefsLen 27416 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {272f6055-62a3-497e-acc7-c5fe07b31f2f} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 5140 179b1778258 tab
    3⤵
    PID:3544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.14.343582183\1808691833" -childID 13 -isForBrowser -prefsHandle 9588 -prefMapHandle 9584 -prefsLen 27416 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f13308ab-6e00-4cfa-90c5-65d6f343737b} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 9600 179b4524958 tab
    3⤵
    PID:5804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.15.1976402169\302202326" -childID 14 -isForBrowser -prefsHandle 9280 -prefMapHandle 9324 -prefsLen 27416 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {435ac89e-84a8-40cf-883f-c64f8c75ada7} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 9336 179ac8d0b58 tab
    3⤵
    PID:6220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.16.2012824317\871194599" -childID 15 -isForBrowser -prefsHandle 9148 -prefMapHandle 9264 -prefsLen 27416 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0859c9e1-7de5-475b-b054-8706f19583cb} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 9132 179af305358 tab
    3⤵
    PID:6304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.17.1672493490\595289473" -childID 16 -isForBrowser -prefsHandle 9600 -prefMapHandle 9332 -prefsLen 27425 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6202ef3-68d4-47b3-94a2-c596da26fc6d} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 9040 179ab3bab58 tab
    3⤵
    PID:6676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.18.1788475816\65336648" -childID 17 -isForBrowser -prefsHandle 9004 -prefMapHandle 8992 -prefsLen 27425 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3e32b60-e722-4ed3-ba8c-5885063bb84f} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 9088 179ab412b58 tab
    3⤵
    PID:6684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.19.1798171183\368299219" -childID 18 -isForBrowser -prefsHandle 8864 -prefMapHandle 8860 -prefsLen 27425 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4551fd38-43ed-4cf3-83b1-3e6ff301d4c6} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 6476 179ab46cf58 tab
    3⤵
    PID:6704
- - C:\Users\Admin\Downloads\avg_secure_browser_setup.exe
    "C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"
    3⤵
    - Checks for any installed AV software in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\ajF4B5.exe
      "C:\Users\Admin\AppData\Local\Temp\ajF4B5.exe" /relaunch=8 /was_elevated=1 /tagdata
      4⤵
      Checks BIOS information in registry
      Checks for any installed AV software in registry
      Checks whether UAC is enabled
      Writes to the Master Boot Record (MBR)
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks SCSI registry key(s)
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\nsnF967.tmp\AVGBrowserUpdateSetup.exe
        
        AVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome"
        5⤵
        Drops file in Program Files directory
        Executes dropped EXE
        
        PID:5060
      - C:\Program Files (x86)\GUM8653.tmp\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\GUM8653.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome"
        6⤵
        Event Triggered Execution: Image File Execution Options Injection
        Writes to the Master Boot Record (MBR)
        Checks computer location settings
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:7312
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:8060
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:8092
        
        C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:8116
        
        C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:8140
        
        C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:8176
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezgyOTg3QjRGLUY5RTMtNDk2Qy1BMjFELTY5RTI2MEI0MEM3Rn0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9IntCNkJGNDNBMy1GODQ2LTQ0REQtQjM5NS03QTNGOEY1MTg1MTZ9IiB1c2VyaWRfZGF0ZT0iMjAyNDA3MDEiIG1hY2hpbmVpZD0iezAwMDA1OEQ0LUIyN0EtMDEyQi05RTNFLTQ1NDE0NzFFNkM2OX0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDcwMSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9InsxODY3NEU2NC0wNzM4LTQ3RDYtOTBDMy1GM0UxMzBCMjgyMzZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLVVTIiBicmFuZD0iOTIyOCIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNjg2MCIvPjwvYXBwPjwvcmVxdWVzdD4
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2088
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{82987B4F-F9E3-496C-A21D-69E260B40C7F}" /silent
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3520
    - - C:\Program Files\AVG\Browser\Application\126.0.25497.127\Installer\setup.exe
        
        setup.exe /silent --create-shortcuts=0 --install-level=1 --system-level
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5760
      - C:\Program Files\AVG\Browser\Application\126.0.25497.127\Installer\setup.exe
        
        "C:\Program Files\AVG\Browser\Application\126.0.25497.127\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=126.0.25497.127 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff65d9e5390,0x7ff65d9e539c,0x7ff65d9e53a8
        6⤵
        Executes dropped EXE
        
        PID:768
      - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
        
        "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.20.1598830292\711481113" -childID 19 -isForBrowser -prefsHandle 9344 -prefMapHandle 6012 -prefsLen 27465 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58dd3b70-c0cf-4c99-b36f-3c8e41486122} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 8500 179b301b558 tab
    3⤵
    PID:4492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.21.1783068975\908958219" -childID 20 -isForBrowser -prefsHandle 8172 -prefMapHandle 6280 -prefsLen 27465 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cb64920-b44e-4a1b-922e-a168f4c05668} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 8184 179b316a958 tab
    3⤵
    PID:3896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.22.106229906\542320205" -childID 21 -isForBrowser -prefsHandle 10652 -prefMapHandle 8244 -prefsLen 27465 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4590fc3a-b06a-4a0c-87ba-2f7ef73b54ec} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 8220 179accc3e58 tab
    3⤵
    PID:5416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.23.1998232030\1705218670" -childID 22 -isForBrowser -prefsHandle 8376 -prefMapHandle 8012 -prefsLen 27465 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c4e84bc-898f-4762-8e3c-8bd4eaa886f4} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 10696 179b35f8258 tab
    3⤵
    PID:7320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.24.1343990206\315508474" -childID 23 -isForBrowser -prefsHandle 5368 -prefMapHandle 4972 -prefsLen 27549 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57c323f1-092f-4853-8944-b37b1eb4ae33} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 1940 179b491a258 tab
    3⤵
    PID:9132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.25.377349039\595318972" -childID 24 -isForBrowser -prefsHandle 7884 -prefMapHandle 7888 -prefsLen 27549 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ddca16a-dad1-4bb9-bd36-a03d9c27907d} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 7960 179b3ef4858 tab
    3⤵
    PID:10108

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:5268

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
PID:5816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:5840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
PID:3876

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5500

C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc
1⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:6436
- C:\Program Files (x86)\AVG\Browser\Update\Install\{409B9CA1-BBE0-4079-A0B0-927402ACA180}\AVGBrowserInstaller.exe
  "C:\Program Files (x86)\AVG\Browser\Update\Install\{409B9CA1-BBE0-4079-A0B0-927402ACA180}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome --system-level
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:7124
- - C:\Program Files (x86)\AVG\Browser\Update\Install\{409B9CA1-BBE0-4079-A0B0-927402ACA180}\CR_DD5FA.tmp\setup.exe
    "C:\Program Files (x86)\AVG\Browser\Update\Install\{409B9CA1-BBE0-4079-A0B0-927402ACA180}\CR_DD5FA.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{409B9CA1-BBE0-4079-A0B0-927402ACA180}\CR_DD5FA.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome --system-level
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:6600
  - - C:\Program Files (x86)\AVG\Browser\Update\Install\{409B9CA1-BBE0-4079-A0B0-927402ACA180}\CR_DD5FA.tmp\setup.exe
      "C:\Program Files (x86)\AVG\Browser\Update\Install\{409B9CA1-BBE0-4079-A0B0-927402ACA180}\CR_DD5FA.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=126.0.25497.127 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ff7e89a5390,0x7ff7e89a539c,0x7ff7e89a53a8
      4⤵
      Executes dropped EXE
      PID:2088
- C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe
  "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  PID:8012
- C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe
  "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"
  2⤵
  - Executes dropped EXE
  PID:8072

C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --check-run=src=desktop
1⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:8032
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=126.0.25497.127 --initial-client-data=0x114,0x118,0x11c,0x9c,0x120,0x7ffa044d0c80,0x7ffa044d0c8c,0x7ffa044d0c98
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:7996
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2276,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6892
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1948,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6968
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2012,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:7700
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3604,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:524
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3612,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:2
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:7012
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3972,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:2
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4700
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4136,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2536
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --field-trial-handle=3588,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4640
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:6384
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4424,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:8156
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5852,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:7860
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5672,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5656,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5988,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5944,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:7776
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6140,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:6440
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5624,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6456,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:7756
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6436,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6784,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6936,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:6752
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4220,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6288,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:6072
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6616,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4644,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6284,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:7992
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5936,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7368,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:8096
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4708,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:7056
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6776,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:8112
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6088,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:7652
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3036,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:7016
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6692,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:7048
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6304,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3012,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6084,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:5672
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7112,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:8140
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6444,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=7836,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:2
  2⤵
  - Checks computer location settings
  PID:8268
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7272,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:8
  2⤵
  PID:9168
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7372,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:9472
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6780,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=8292 /prefetch:8
  2⤵
  PID:9604
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  PID:9988
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6772,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=7788,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:2
  2⤵
  - Checks computer location settings
  PID:7132
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5684,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:8
  2⤵
  PID:8448
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=8312,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=8396 /prefetch:8
  2⤵
  PID:8768
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=8116,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:2
  2⤵
  - Checks computer location settings
  PID:9672
- C:\Program Files\AVG\Browser\Application\126.0.25497.127\Installer\chrmstp.exe
  "C:\Program Files\AVG\Browser\Application\126.0.25497.127\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
  2⤵
  PID:10140
- - C:\Program Files\AVG\Browser\Application\126.0.25497.127\Installer\chrmstp.exe
    "C:\Program Files\AVG\Browser\Application\126.0.25497.127\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=126.0.25497.127 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff78c9e5390,0x7ff78c9e539c,0x7ff78c9e53a8
    3⤵
    - Drops file in Program Files directory
    PID:9180
- - C:\Program Files\AVG\Browser\Application\126.0.25497.127\Installer\chrmstp.exe
    "C:\Program Files\AVG\Browser\Application\126.0.25497.127\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\AVG\Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=0 --no-pin-startmenu
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:9492
  - - C:\Program Files\AVG\Browser\Application\126.0.25497.127\Installer\chrmstp.exe
      "C:\Program Files\AVG\Browser\Application\126.0.25497.127\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=126.0.25497.127 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff78c9e5390,0x7ff78c9e539c,0x7ff78c9e53a8
      4⤵
      PID:10012
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=7448,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:2
  2⤵
  - Checks computer location settings
  PID:6272
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=6148,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:8892
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --disable-protect
  2⤵
  PID:8576
- - C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
    "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=126.0.25497.127 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa044d0c80,0x7ffa044d0c8c,0x7ffa044d0c98
    3⤵
    PID:7368
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=8352,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:2
  2⤵
  - Checks computer location settings
  PID:2216
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=7004,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:2
  2⤵
  - Checks computer location settings
  PID:10152
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=2832,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:5624
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"
  2⤵
  - Checks computer location settings
  PID:5792
- C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
  "C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=5300,i,171923053474862329,9627222521419550999,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:7160

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3736 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4116

C:\Program Files\AVG\Browser\Application\126.0.25497.127\elevation_service.exe
"C:\Program Files\AVG\Browser\Application\126.0.25497.127\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:7372

C:\Program Files\AVG\Browser\Application\126.0.25497.127\elevation_service.exe
"C:\Program Files\AVG\Browser\Application\126.0.25497.127\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5548

C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /c
1⤵
PID:5844
- C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
  "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /cr
  2⤵
  PID:9096
- C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe
  "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"
  2⤵
  PID:7520
- C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe
  "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"
  2⤵
  PID:4748

C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ua /installsource scheduler
1⤵
PID:3880
- C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
  "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /registermsihelper
  2⤵
  PID:8896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:9336

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:8380

C:\Users\Admin\AppData\Local\Temp\Temp1_InfinityCrypt.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_InfinityCrypt.zip\[email protected]"
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
PID:8420

C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies data under HKEY_USERS
PID:8800

C:\Users\Admin\Downloads\InfinityCrypt\[email protected]
"C:\Users\Admin\Downloads\InfinityCrypt\[email protected]"
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
PID:8768

C:\Users\Admin\Downloads\FakeWindowsUpdate\[email protected]
"C:\Users\Admin\Downloads\FakeWindowsUpdate\[email protected]"
1⤵
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery