Analysis
- max time kernel
1199s - max time network
1143s - platform
windows11-21h2_x64 - resource
win11-20240709-en - resource tags
- submitted
18/07/2024, 18:18
General
- Target avast_free_antivirus_setup_online.exe
- Size 257KB
- Sample240718-wxwbxstdqf
- SHA256 1fb53cd33d285e2807dca6ee3005689f1425b363c46b377958a7431a46488207
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
wannacry
Ransom Note
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets
-
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Wannacry
WannaCry is a ransomware cryptoworm.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Drops file in Drivers directory 61 IoCs
- Sets service image path in registry 2 TTPs 15 IoCs
- Drops startup file 2 IoCs
- Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 6 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Checks for any installed AV software in registry 1 TTPs 64 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Downloads MZ/PE file
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 45 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory 3 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 8 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Embeds OpenSSL 5 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 30 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 14 IoCs
- Modifies Internet Explorer settings 1 TTPs 12 IoCs
- Modifies data under HKEY_USERS 29 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 25 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 45 IoCs
- Suspicious use of SendNotifyMessage 18 IoCs
- Suspicious use of SetWindowsHookEx 53 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\avast_free_antivirus_setup_online.exe"C:\Users\Admin\AppData\Local\Temp\avast_free_antivirus_setup_online.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\asw.6fe629814a498e99\avast_free_antivirus_setup_online_x64.exe"C:\Windows\Temp\asw.6fe629814a498e99\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_ava_998_999_000_m:dlid_FAV-ONLINE-FAD /ga_clientid:e400941b-999e-4358-b214-b1b0a85ed781 /edat_dir:C:\Windows\Temp\asw.6fe629814a498e992⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\asw.0d833bfd29bf5cdf\instup.exe"C:\Windows\Temp\asw.0d833bfd29bf5cdf\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.0d833bfd29bf5cdf /edition:1 /prod:ais /stub_context:2150a3f5-325a-42b7-8162-e8a04b8fe11b:9925720 /guid:3b10e228-3f7f-4c82-a105-305b7cb34f80 /ga_clientid:e400941b-999e-4358-b214-b1b0a85ed781 /no_delayed_installation /cookie:mmm_ava_998_999_000_m:dlid_FAV-ONLINE-FAD /ga_clientid:e400941b-999e-4358-b214-b1b0a85ed781 /edat_dir:C:\Windows\Temp\asw.6fe629814a498e993⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\instup.exe"C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.0d833bfd29bf5cdf /edition:1 /prod:ais /stub_context:2150a3f5-325a-42b7-8162-e8a04b8fe11b:9925720 /guid:3b10e228-3f7f-4c82-a105-305b7cb34f80 /ga_clientid:e400941b-999e-4358-b214-b1b0a85ed781 /no_delayed_installation /cookie:mmm_ava_998_999_000_m:dlid_FAV-ONLINE-FAD /edat_dir:C:\Windows\Temp\asw.6fe629814a498e99 /online_installer4⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Impair Defenses: Safe Mode Boot
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\aswOfferTool.exe"C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\aswOfferTool.exe" -checkGToolbar -elevated5⤵
- Executes dropped EXE
-
-
C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\aswOfferTool.exe"C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\aswOfferTool.exe" /check_secure_browser5⤵
- Executes dropped EXE
-
-
C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\aswOfferTool.exe"C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\aswOfferTool.exe" -checkChrome -elevated5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\aswOfferTool.exe"C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFC5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\Documents\aswOfferTool.exe"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFC6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\aswOfferTool.exe"C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFC5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\Documents\aswOfferTool.exe"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFC6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\aswOfferTool.exe"C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\aswOfferTool.exe" -checkChrome -elevated5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\sbr.exe"C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\sbr.exe" 3712 "Avast Antivirus setup" "Avast Antivirus is being installed. Do not shut down your computer!"5⤵
- Executes dropped EXE
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /netservice:sw_aswNdis5⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /netservice:aswNdisFlt /catalog:aswNdisFlt.cat5⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRdr2.cat5⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswHwid.cat5⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswVmm.cat5⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRvrt.cat5⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /elaminst C:\Windows\system32\drivers\aswElam.sys5⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
-
-
C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\aswOfferTool.exe"C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\aswOfferTool.exe" /install_secure_browser /brandcode:102 /cmd:"/make_default /language=en-US" /config_def:C:\Windows\Temp\asw.0d833bfd29bf5cdf\config.def5⤵
- Executes dropped EXE
-
C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\securebrowser_setup.exe"C:\Windows\Temp\asw.0d833bfd29bf5cdf\New_180617e9\securebrowser_setup.exe" /s /run_source=av_install /make_default /language=en-US6⤵
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\nsk9B00.tmp\AvastBrowserUpdateSetup.exeAvastBrowserUpdateSetup.exe /silent /install "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en-US&brand=3602&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dfirefox --import-cookies"7⤵
- Drops file in Program Files directory
- Executes dropped EXE
-
C:\Program Files (x86)\GUMA3E7.tmp\AvastBrowserUpdate.exe"C:\Program Files (x86)\GUMA3E7.tmp\AvastBrowserUpdate.exe" /silent /install "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en-US&brand=3602&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dfirefox --import-cookies"8⤵
- Event Triggered Execution: Image File Execution Options Injection
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /regsvc9⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /regserver9⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezZEMzdDNzYwLThGRUQtNDhBNS1BNEE0LUNFQzA5NUIyRDhERH0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5Ny42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5Ny42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezg4NzEyQTBCLURDMTYtNEVGRS04OTZDLUQyMEU1NUJCMDM5Nn0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9Ins0Mzk3RDE1Ny0wRkRBLTQ3MzctOTQ1OC0zNERCQjBGN0IwREF9IiB1c2VyaWRfZGF0ZT0iMjAyNDA3MTgiIG1hY2hpbmVpZD0iezAwMDA5QkIwLTk4NjYtMzU5Mi1BM0E2LTA4NkJDQzI5MDlFN30iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDcxOCIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9IntDNjQ0MTY5OS05QzZGLTQ5NTMtQjEwMS1CRjM5OTQ1MzFDMTB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NkQzN0M3NjAtOEZFRC00OEE1LUE0QTQtQ0VDMDk1QjJEOEREfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS44LjE2OTcuNiIgbGFuZz0iZW4tVVMiIGJyYW5kPSIzNjAyIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIzOTMiLz48L2FwcD48L3JlcXVlc3Q-9⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /handoff "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en-US&brand=3602&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dfirefox --import-cookies" /installsource otherinstallcmd /sessionid "{88712A0B-DC16-4EFE-896C-D20E55BB0396}" /silent9⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exeAvastBrowser.exe --heartbeat --install --create-profile7⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0xf8,0xfc,0x100,0x80,0x104,0x7ffb903e0c80,0x7ffb903e0c8c,0x7ffb903e0c988⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,12156605567431154495,404350553801904610,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:28⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2184,i,12156605567431154495,404350553801904610,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:118⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2376,i,12156605567431154495,404350553801904610,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:138⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=3592,i,12156605567431154495,404350553801904610,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:148⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3628,i,12156605567431154495,404350553801904610,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:18⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3652,i,12156605567431154495,404350553801904610,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:98⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3712,i,12156605567431154495,404350553801904610,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:98⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4428,i,12156605567431154495,404350553801904610,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:148⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4648,i,12156605567431154495,404350553801904610,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:148⤵
- Executes dropped EXE
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exeAvastBrowser.exe --silent-launch7⤵
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Executes dropped EXE
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb903e0c80,0x7ffb903e0c8c,0x7ffb903e0c988⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2104,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:28⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1828,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:118⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2352,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:138⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=2964,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:148⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=2892,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:148⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3560,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:148⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3576,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:148⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3584,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:148⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3632,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:148⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3596,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:148⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3640,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:148⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4168,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3668,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4052,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4324,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4788,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4336,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4784,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4636,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4800,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4976,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5280,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4804,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5108,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6020,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6340,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5700,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5864,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6640,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6348,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6180,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6636,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7244,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7520,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6352,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7820,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6788,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6028,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6032,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=8408,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=8416 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=8572,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7260,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7832,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=9040,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=9080 /prefetch:98⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=9104,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=9208 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=8852,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=9348 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=9748,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=9780 /prefetch:18⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=9756,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=9808 /prefetch:98⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=10060,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=10088 /prefetch:98⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=9324,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=10224 /prefetch:98⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=10444,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=10472 /prefetch:98⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=10440,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=10644 /prefetch:98⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.fd3d4225efc02761 > \\.\pipe\chrome.nativeMessaging.out.fd3d4225efc027618⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=09⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=10792,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=10068 /prefetch:98⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --enable-protect8⤵
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb903e0c80,0x7ffb903e0c8c,0x7ffb903e0c989⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowserProtect.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowserProtect.exe" --registration reg-task --taskintr PT10M --runonce9⤵
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=5800,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=9164 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=9120,i,13258466426639322826,9348533078976770118,262144 --variations-seed-version --mojo-platform-channel-handle=9452 /prefetch:148⤵
-
-
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\setup.exesetup.exe /silent --create-shortcuts=0 --install-level=1 --system-level7⤵
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\setup.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff784c27390,0x7ff784c2739c,0x7ff784c273a88⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk"8⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exeAvastBrowser.exe --check-run=src=installer --start-minimized7⤵
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb903e0c80,0x7ffb903e0c8c,0x7ffb903e0c988⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2104,i,10196787127000161559,17541454129817094573,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:28⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1900,i,10196787127000161559,17541454129817094573,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:118⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2400,i,10196787127000161559,17541454129817094573,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:138⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3240,i,10196787127000161559,17541454129817094573,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:18⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3256,i,10196787127000161559,17541454129817094573,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:98⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3420,i,10196787127000161559,17541454129817094573,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:98⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3712,i,10196787127000161559,17541454129817094573,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:98⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3824,i,10196787127000161559,17541454129817094573,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:98⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3876,i,10196787127000161559,17541454129817094573,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:98⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4608,i,10196787127000161559,17541454129817094573,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:98⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4384,i,10196787127000161559,17541454129817094573,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:98⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\Avast Secure Browser.lnk"8⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.9de4a8a431f8b95 > \\.\pipe\chrome.nativeMessaging.out.9de4a8a431f8b958⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=09⤵
- Checks processor information in registry
-
-
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings8⤵
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff750067390,0x7ff75006739c,0x7ff7500673a89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\AVAST Software\Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=0 --no-pin-startmenu9⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff750067390,0x7ff75006739c,0x7ff7500673a810⤵
-
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk"8⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5952,i,10196787127000161559,17541454129817094573,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=6100,i,10196787127000161559,17541454129817094573,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:148⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --enable-protect8⤵
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb903e0c80,0x7ffb903e0c8c,0x7ffb903e0c989⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.b35f2fb1ce1d609 > \\.\pipe\chrome.nativeMessaging.out.b35f2fb1ce1d6098⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=09⤵
- Checks processor information in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.21a0611b9e8c197c > \\.\pipe\chrome.nativeMessaging.out.21a0611b9e8c197c8⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=09⤵
- Checks processor information in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.6f728ebae716ef90 > \\.\pipe\chrome.nativeMessaging.out.6f728ebae716ef908⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=09⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5996,i,10196787127000161559,17541454129817094573,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:148⤵
-
-
-
-
-
C:\Program Files\Avast Software\Avast\AvEmUpdate.exe"C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer /reg5⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\Avast Software\Avast\AvEmUpdate.exe"C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer5⤵
- Drops file in Drivers directory
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
-
-
C:\Program Files\Avast Software\Avast\x86\RegSvr.exe"C:\Program Files\Avast Software\Avast\x86\RegSvr.exe" "C:\Program Files\Avast Software\Avast\x86\aswAMSI.dll"5⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
-
-
C:\Program Files\Avast Software\Avast\RegSvr.exe"C:\Program Files\Avast Software\Avast\RegSvr.exe" "C:\Program Files\Avast Software\Avast\aswAMSI.dll"5⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
-
-
C:\Program Files\Avast Software\Avast\x86\RegSvr.exe"C:\Program Files\Avast Software\Avast\x86\RegSvr.exe" "C:\Program Files\Avast Software\Avast\x86\asOutExt.dll"5⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Modifies registry class
-
-
C:\Program Files\Avast Software\Avast\RegSvr.exe"C:\Program Files\Avast Software\Avast\RegSvr.exe" "C:\Program Files\Avast Software\Avast\asOutExt.dll"5⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
-
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" /install5⤵
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /catinstall:"C:\Program Files\Avast Software\Avast\setup\crts.cat" /basename:pkg_{af98c830-4f53-4176-a7b0-ec21fc603adc}.cat /crtid:D9D1E63123760F5EE0F69B6613E0933E9CBCAB115⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
-
-
C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe"C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe" /skip_uptime /skip_remediations5⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\Program Files\Avast Software\Avast\defs\24071806\engsup.exe"C:\Program Files\Avast Software\Avast\defs\24071806\engsup.exe" /prepare_definitions_folder5⤵
- Drops file in Program Files directory
- Checks processor information in registry
-
-
C:\Program Files\Avast Software\Avast\wsc_proxy.exe"C:\Program Files\Avast Software\Avast\wsc_proxy.exe" /svc /register /ppl_svc5⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
C:\Program Files\Avast Software\Avast\avDump.exe"C:\Program Files\Avast Software\Avast\avDump.exe" --pid 9496 --exception_ptr 00000077F02FE9C0 --thread_id 14384 --dump_level 0 --handle_data 1 --dump_file "C:\ProgramData\Avast Software\Avast\log\unp311196791525089056x-manual.mdmp" --comment "Cause: VectoredExceptionHandler Reason: sd is not loaded Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of exception instantiation." --min_interval 606⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
-
-
C:\Program Files\Avast Software\Avast\defs\24071806\engsup.exe"C:\Program Files\Avast Software\Avast\defs\24071806\engsup.exe" /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie /get_latest_trpar5⤵
- Checks processor information in registry
-
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1840 -prefsLen 25749 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e18c460-69e8-4f03-a7d0-e5ff2ed14e6e} 780 "\\.\pipe\gecko-crash-server-pipe.780" gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2348 -parentBuildID 20240401114208 -prefsHandle 2324 -prefMapHandle 2320 -prefsLen 25785 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3b0cdc8-0b48-4596-a906-38150d6b24d0} 780 "\\.\pipe\gecko-crash-server-pipe.780" socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2840 -childID 1 -isForBrowser -prefsHandle 2580 -prefMapHandle 3080 -prefsLen 25926 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0841471-e35c-44e3-946b-390c23846f28} 780 "\\.\pipe\gecko-crash-server-pipe.780" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1424 -childID 2 -isForBrowser -prefsHandle 3672 -prefMapHandle 3644 -prefsLen 31159 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c04420ec-150f-48b7-a482-febf592bcd03} 780 "\\.\pipe\gecko-crash-server-pipe.780" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4176 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4188 -prefMapHandle 4184 -prefsLen 31159 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86134d6d-9318-4957-8528-4d345f9c9e4c} 780 "\\.\pipe\gecko-crash-server-pipe.780" utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5460 -childID 3 -isForBrowser -prefsHandle 5440 -prefMapHandle 5448 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {667582be-1239-4e8d-9821-0d16fb61632e} 780 "\\.\pipe\gecko-crash-server-pipe.780" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5552 -childID 4 -isForBrowser -prefsHandle 5624 -prefMapHandle 5620 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01808568-9316-4431-8704-e2d7ebef6326} 780 "\\.\pipe\gecko-crash-server-pipe.780" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 5 -isForBrowser -prefsHandle 5764 -prefMapHandle 5768 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e21733b2-6d72-4718-90e7-f4529e65d155} 780 "\\.\pipe\gecko-crash-server-pipe.780" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6072 -childID 6 -isForBrowser -prefsHandle 6064 -prefMapHandle 6060 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60ef7505-3ae5-4eb6-8460-3ea12d3105f1} 780 "\\.\pipe\gecko-crash-server-pipe.780" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5532 -childID 7 -isForBrowser -prefsHandle 5940 -prefMapHandle 5952 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09458588-b8a9-43a2-8d77-e95ceb4e6967} 780 "\\.\pipe\gecko-crash-server-pipe.780" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6412 -childID 8 -isForBrowser -prefsHandle 6444 -prefMapHandle 6452 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bc5727c-c7a1-4f59-b11d-220dcab7e352} 780 "\\.\pipe\gecko-crash-server-pipe.780" tab3⤵
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /svc1⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{3FE28934-3681-4E5D-A363-FDA29797B54D}\AvastBrowserInstaller.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{3FE28934-3681-4E5D-A363-FDA29797B54D}\AvastBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --auto-pin-to-taskbar-on-run --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=firefox --import-cookies --system-level2⤵
- Drops file in Program Files directory
- Executes dropped EXE
-
C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{3FE28934-3681-4E5D-A363-FDA29797B54D}\CR_5B441.tmp\setup.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{3FE28934-3681-4E5D-A363-FDA29797B54D}\CR_5B441.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{3FE28934-3681-4E5D-A363-FDA29797B54D}\CR_5B441.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --auto-pin-to-taskbar-on-run --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=firefox --import-cookies --system-level3⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{3FE28934-3681-4E5D-A363-FDA29797B54D}\CR_5B441.tmp\setup.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{3FE28934-3681-4E5D-A363-FDA29797B54D}\CR_5B441.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff657d17390,0x7ff657d1739c,0x7ff657d173a84⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserCrashHandler.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserCrashHandler64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"1⤵
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"1⤵
-
C:\Program Files\Avast Software\Avast\afwServ.exe"C:\Program Files\Avast Software\Avast\afwServ.exe"1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" /welcome1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=gpu-process --field-trial-handle=7056,773000713903015427,2636028373114104076,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --no-sandbox --disable-gpu-driver-bug-workarounds --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=disable --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --gpu-preferences=SAAAAAAAAADgAABwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=9752 /prefetch:22⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=7056,773000713903015427,2636028373114104076,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=utility --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=disable --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=4468 /prefetch:82⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=7056,773000713903015427,2636028373114104076,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=none --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=disable --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=5256 /prefetch:82⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --field-trial-handle=7056,773000713903015427,2636028373114104076,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=disable --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=5776 /prefetch:12⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\VisthAux.exe"C:\Program Files\Avast Software\Avast\VisthAux.exe" /runavservice2⤵
-
-
C:\Program Files\Avast Software\Avast\VisthAux.exe"C:\Program Files\Avast Software\Avast\VisthAux.exe" /runtoolsservice2⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --check-run=src=av-install2⤵
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb903e0c80,0x7ffb903e0c8c,0x7ffb903e0c983⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:23⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2196,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:113⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2372,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:133⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3140,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:93⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3172,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:93⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3552,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:13⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3560,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:93⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4232,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:93⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2980,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:93⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3148,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:93⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.b44750a661aab131 > \\.\pipe\chrome.nativeMessaging.out.b44750a661aab1313⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=04⤵
- Checks processor information in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.d131503f299a0a11 > \\.\pipe\chrome.nativeMessaging.out.d131503f299a0a113⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=04⤵
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --enable-protect3⤵
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb903e0c80,0x7ffb903e0c8c,0x7ffb903e0c984⤵
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=3164,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5436,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:143⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.d838059de0c9ddfd > \\.\pipe\chrome.nativeMessaging.out.d838059de0c9ddfd3⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=04⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.cda271c9fab798da > \\.\pipe\chrome.nativeMessaging.out.cda271c9fab798da3⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=04⤵
- Checks for any installed AV software in registry
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5452,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:143⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.3e1a7c49858201d3 > \\.\pipe\chrome.nativeMessaging.out.3e1a7c49858201d33⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=04⤵
- Checks processor information in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.5868af15ef8af77c > \\.\pipe\chrome.nativeMessaging.out.5868af15ef8af77c3⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=04⤵
- Checks processor information in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.a29b8aa9229d6185 > \\.\pipe\chrome.nativeMessaging.out.a29b8aa9229d61853⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=04⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.99a8ba53c2a77ac2 > \\.\pipe\chrome.nativeMessaging.out.99a8ba53c2a77ac23⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=04⤵
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5640,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6112,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5472,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5696,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:103⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=2776,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5684,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=1572 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5812,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5908,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5872,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5720,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5528,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5464,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5476,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5968,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5916,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6044,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5596,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=1164 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6060,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:143⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6024,i,9078559602070484257,7665025774586418474,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:143⤵
-
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --field-trial-handle=7056,773000713903015427,2636028373114104076,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=disable --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=5124 /prefetch:12⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --field-trial-handle=7056,773000713903015427,2636028373114104076,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=disable --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=7268 /prefetch:12⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\VisthAux.exe"C:\Program Files\Avast Software\Avast\VisthAux.exe" /runavservice2⤵
-
-
C:\Program Files\Avast Software\Avast\VisthAux.exe"C:\Program Files\Avast Software\Avast\VisthAux.exe" /runtoolsservice2⤵
-
-
C:\Program Files\Avast Software\Avast\afwServ.exe"C:\Program Files\Avast Software\Avast\afwServ.exe"1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
C:\Program Files\Avast Software\Avast\afwServ.exe"C:\Program Files\Avast Software\Avast\afwServ.exe"1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
C:\Program Files\Avast Software\Avast\afwServ.exe"C:\Program Files\Avast Software\Avast\afwServ.exe"1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe"1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe"1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"1⤵
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"1⤵
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe"1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 156451721327016.bat2⤵
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Checks processor information in registry
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "puoawzavxa263" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\tasksche.exe\"" /f2⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "puoawzavxa263" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exetaskdl.exe2⤵
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe"1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /ua /installsource scheduler1⤵
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /registermsihelper2⤵
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /c1⤵
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /cr2⤵
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserCrashHandler.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserCrashHandler.exe"2⤵
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserCrashHandler64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserCrashHandler64.exe"2⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /svc1⤵
- Writes to the Master Boot Record (MBR)
- Modifies data under HKEY_USERS
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowserProtect.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowserProtect.exe" --runonce1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Indicator Removal
1File Deletion
1Modify Registry
7Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
e5e3ba2.rbs
AvastBrowserCrashHandler.exe
AvastBrowserCrashHandler64.exe
AvastBrowserUpdate.exe
@PaxHeader
@PaxHeader
asw0ed566cd14a09821.tmp
asw16d88b3e2ccd4fbf.tmp
asw275f4990b4ef84d5.tmp
asw4b428857a3255aa0.tmp
asw7710dd5a511e7113.tmp
asw8f420fa03f9dc156.tmp
asw9883ddbd13060069.tmp
AvastUI.exe
aswcf95ccba7e94cade.tmp
asw3b9fbb155b9f4284.tmp
aswee84af0b1339a1e6.tmp
asw005417ba0b2524da.tmp
asw1c88818e972bc570.tmp
asw1f8b30af17674b90.tmp
asw2fce208808a15b45.tmp
asw344aa30d64a3cb8e.tmp
asw351b75a11255ebb8.tmp
asw42037d9ff08dbb7d.tmp
asw482cf5f633beddd5.tmp
asw4b6d534f0ec2071f.tmp
asw4ee9ef52436d6c36.tmp
asw5109e6069661bd37.tmp
asw57d537fe18a7a277.tmp
asw69d3047422131156.tmp
asw6b1911ba9aab2bf3.tmp
asw75be341cde1342ce.tmp
asw76285fede7b824b8.tmp
asw79537adcb045b690.tmp
asw7956ddb67c0d01d4.tmp
asw84819f411bb5b356.tmp
asw8e126a0b7b700b08.tmp
asw947d2cc42d8f5fe1.tmp
asw9c1333b672091941.tmp
asw9eff483ef6f27d50.tmp
aswa343883734c40760.tmp
aswa4e0e7b539f20765.tmp
aswa9976744e1a29df4.tmp
aswae2729ff3ecd6c13.tmp
aswaf426c61a5fe5d63.tmp
aswb74d13b6001cc970.tmp
aswbdb6c3098b6fce81.tmp
aswc387f5de04fd66a9.tmp
aswc64a51d8e5f0aec2.tmp
aswd4b87230c726f6a6.tmp
aswd4c2e6a742a5eb00.tmp
aswd567863045eeaab0.tmp
aswdebe2f98d54f2ceb.tmp
aswdfea6b0376577a21.tmp
aswed21446773b31254.tmp
asw076155b7d836ebee.tmp
asw127fac3e421d7ef9.tmp
asw1a83df780acd9a97.tmp
asw34ef5c5f04baf324.tmp
asw3a9f9b17bd592012.tmp
asw59e63931f4c2198f.tmp
asw676e90b069a46764.tmp
asw6fdf517297933764.tmp
aswab3674075ba05acc.tmp
aswd12b5eca15a702e0.tmp
aswfd3bf54d3020bb0e.tmp
ashServ.dll
ashServ.dll
ashServ.dll.sum.172132690546811
ashTask.dll
asw01a29ac1ec87a620.tmp
asw02c6d115f6c47256.tmp
asw042d5e1d0da71996.tmp
asw055d8f30f94f81ca.tmp
asw05db67b81ad2655e.tmp
asw05ec418e9cbadba5.tmp
asw066e583b38507c87.tmp
asw09606a88a2a1f813.tmp
asw0f96e12676e37105.tmp
asw1209945c575bf0ff.tmp
asw13009dff6ae603df.tmp
asw1799f816761e3cdb.tmp
asw1854a2386dc2a287.tmp
asw19b84bbcc448f3d6.tmp
asw1bef8207ed14d82f.tmp
asw1d6e73c356f3ab7e.tmp
asw1f2ea1e9d0266f4d.tmp
asw21ab8cd717c1898f.tmp
asw2511c93db0348926.tmp
asw26b65e339c338140.tmp
asw26d55e96063e75da.tmp
asw2751c8a3856aea1b.tmp
asw27f93cbe07b26a44.tmp
asw280d8651ad61e0ea.tmp
asw2839b8c36d7bd6c6.tmp
asw283a052a5540a154.tmp
asw2e6a891336459cd8.tmp
asw3005b324910f99fa.tmp
asw30b9ec0f1bc1ec32.tmp
asw313b14e7c229be25.tmp
asw35d115ff04398f4e.tmp
asw36ce7cd4a6faf657.tmp
asw38a30962430ec12d.tmp
asw39c5f6920fc5db43.tmp
asw3c04c3b4426cd444.tmp
asw4087de8bf794ded8.tmp
asw418c6922212dfd5e.tmp
asw42543e73a2f617bf.tmp
asw441e4902090c79c8.tmp
asw46a30bb32e9b847a.tmp
asw48cc84f531964f16.tmp
asw4dfe928b77d8d5f0.tmp
asw4f59e06d36af605d.tmp
asw4f7b0187783c38b5.tmp
asw518e755ced2a74a9.tmp
asw532e3e8fa951aaf7.tmp
asw533c6b7cb81c948c.tmp
asw539cf30374137a07.tmp
asw53e5fe3f7dfa46d5.tmp
asw550c09e3bfc61277.tmp
asw5511328662efc104.tmp
asw55ba7af809eecd48.tmp
asw56d14000d35c3b4f.tmp
asw5916dd71858e18aa.tmp
asw5d1f7ef6db5e7a96.tmp
asw61d9933a6ecca903.tmp
asw629e79e0505138cf.tmp
asw663edfe1daf7aa5c.tmp
asw66916d8ca1e99939.tmp
asw6b5ec2b6991246ef.tmp
asw6cf5116b6898a105.tmp
asw6d55ee9e03f5de80.tmp
asw6d5dfe7cfeef0e30.tmp
asw6f0d077a516de053.tmp
asw71db784c17b294b7.tmp
asw724a700d01bf62a4.tmp
asw74890396a4cb06ca.tmp
asw7581fd0c71ef5673.tmp
asw7609197f0e1884bc.tmp
asw76cdb29e6777f905.tmp
asw78890868da74f5c6.tmp
asw7d123ea800e6c996.tmp
asw7f644f2096ae9e57.tmp
asw7fc2ed7d99f50a5a.tmp
asw827436437c8fe1b9.tmp
asw88102f876dc13c3b.tmp
asw88e37fad074c2db5.tmp
asw891653d6810bf1a4.tmp
asw89d70a526904e664.tmp
asw8ae5de04ddc0fa13.tmp
asw8b3bbf86f2443783.tmp
asw90453adf7f9dcd35.tmp
asw90c2f5df8639ae47.tmp
asw91482618304c17ae.tmp
asw940f2bff431ee91b.tmp
asw99a5ecd51ba22104.tmp
asw9adaf8627897f986.tmp
asw9af9e0c27a2df7a9.tmp
aswAv.dll
aswa700ca23a6455dc6.tmp
aswa73b43a4e90c259e.tmp
aswac3300b7a8468d43.tmp
aswb3017131e33964d1.tmp
aswb7d2d7f100c6d48b.tmp
aswb7f9d24b4f31d254.tmp
aswb979339db0ce91bb.tmp
aswbc60bac634317444.tmp
aswbed6d073649e0091.tmp
aswc1e21cc9520efa08.tmp
aswc2a1db41b0d8c348.tmp
aswc32dcdb6c2da0a5d.tmp
aswc4c458fade97302e.tmp
aswc6c2c944fc8e0323.tmp
aswcbaa84c83eb54b63.tmp
aswcf2886e6c22dfef0.tmp
aswd438761bc9f78357.tmp
aswd576f00bbc279e06.tmp
aswdaf0138fb9cdda11.tmp
aswe728389dea69b9b5.tmp
aswe9bff1aa2885515e.tmp
aswec5b39392b2d1cb2.tmp
aswed2a567ec18c58cb.tmp
aswf10b3840df4cffe5.tmp
aswf3aa6fbf2b327047.tmp
aswf4356f1e5729e7e4.tmp
aswf51b06acdc6a36ac.tmp
aswf72a747d8f5bf409.tmp
aswf9a3838da26d883c.tmp
aswfa01088adde83d01.tmp
aswfb712745b1e3f65f.tmp
aswfbe05bb9e1abe241.tmp
aswfce8514a455900b7.tmp
aswfd8ee21add191c79.tmp
aswfe21d0bde7917ce8.tmp
asw028422c6b35c6260.tmp
asw060d2bc9611886bc.tmp
asw0df090a55438b25c.tmp
asw0e1bcc6a48107e5d.tmp
asw0e9344cdd3e8fce1.tmp
asw1fb151a2d625f552.tmp
asw1fef9cc79ec28a48.tmp
asw2fd9896b407f2b29.tmp
asw33b3b4b2a0638cbb.tmp
asw374c9afe21148b71.tmp
asw3af193271823cdb9.tmp
asw3b3896b149083345.tmp
asw3e8f681331c3826e.tmp
asw40ef9d4f26d3d5d1.tmp
asw4a386bd88cb66522.tmp
asw4ef24045ee2a84d1.tmp
asw4fecbb94552aab02.tmp
asw5849a981c51b15b7.tmp
asw631a3035a2d0f585.tmp
asw6619b0e557f1c9cf.tmp
asw684487293b142f59.tmp
asw68c655edd61e8e1f.tmp
asw6a72aa1468f85817.tmp
asw6e18f801e844b474.tmp
asw7095e0b228b9a1b0.tmp
asw74b68678fb4e5750.tmp
asw7506773811422840.tmp
asw8aca5c34cf155c9f.tmp
asw919261a0e9b0a802.tmp
asw983cf10b8e490ca3.tmp
asw9eb3bac09e87d4aa.tmp
aswa328cdfe91e2f7b5.tmp
aswa7aa25b8c02e315e.tmp
aswaa4629ff57a6cafb.tmp
aswac8172709e206717.tmp
aswad34667af931199e.tmp
aswb99136fd647ef3bb.tmp
aswba46ff0cbd3107a2.tmp
aswbf91481439890746.tmp
aswc572b30fbe6a0881.tmp
aswc67b1665e96aa612.tmp
aswc77a47287646a649.tmp
aswd0658b4196d93e37.tmp
aswd26605f5e7972c0b.tmp
aswde540bb653565846.tmp
asweba7b1b87c54d665.tmp
aswec802aff575c0a81.tmp
aswedaeb41fe02a9e31.tmp
aswedc394cc8bd0d02a.tmp
aswf6c5b6db24046fcc.tmp
aswf923cb46b4280549.tmp
aswf9bc94d0bc59f70e.tmp
aswfb00aa4b7e0f7549.tmp
aswfffe9009a4c96e3d.tmp
asw075ffdc4402f6fe4.tmp
asw087d8996a2fdcd00.tmp
asw0aff0901ade8e47f.tmp
asw0dacb9595074a6ff.tmp
asw0ec15384f1fe8b6a.tmp
asw0fab6fed97cf46aa.tmp
asw137a0253c878272f.tmp
asw1383620e629ee6c7.tmp
asw166572a9892ac054.tmp
asw196313fdc803705b.tmp
asw19b88df311d260ad.tmp
asw22a534493db25439.tmp
asw24afa49eb328a871.tmp
asw2ac6bd6b73fa9c0a.tmp
asw2cea9a42542b1439.tmp
asw2d3823c7219da7a2.tmp
asw2d46a5b088648fec.tmp
asw2f8bc0f2d83d28d6.tmp
asw32412d958362c452.tmp
asw32ba615ca3a2773f.tmp
asw3501ddd416fdd10e.tmp
asw3db694eeebb6de8d.tmp
asw3de99ed753157ac6.tmp
asw4000d78d9883f9a0.tmp
asw405c5467bc4642f1.tmp
asw43819a6da600bcb1.tmp
asw442493891fbb7a5f.tmp
asw4922a773f5c4b2e0.tmp
asw4cc087727c2fc615.tmp
asw4d0603260b8f3551.tmp
asw4d1bb50e3e6e7a3f.tmp
asw4f76331e194b5318.tmp
asw4fd33b159a1b990c.tmp
asw59997aac095c5b8d.tmp
asw61be1dc00f9e0b36.tmp
asw62e277dcaf923b96.tmp
asw63b8bdae94862fe8.tmp
asw641e6fdc41b9db97.tmp
asw652deaf7b1f01d02.tmp
asw690b29db2308f778.tmp
asw6c57aa47f651243a.tmp
asw7511c5c8771ce481.tmp
asw77f85a865e4dee7f.tmp
asw7d61713f5e5e0aa4.tmp
asw7f093824983225ca.tmp
asw85966070da96b606.tmp
asw8617162bd0b1d8ba.tmp
asw8c6669dea1272f4b.tmp
asw905cf07b36aa44d1.tmp
asw93f3a15e137bfe44.tmp
asw96b023373a2961ef.tmp
asw9741575e4c61dcbb.tmp
asw97c55805eba05c0f.tmp
asw9817e1e26229583a.tmp
asw991423249377175c.tmp
asw9cc0bbade3422ccf.tmp
asw9f2725f76fa6f984.tmp
asw9f411e08ecfe7017.tmp
aswa15902a29ed48e53.tmp
aswa3ae63e423448b66.tmp
aswadaff0f1b87f4add.tmp
aswaffebc69a65817e9.tmp
aswb17fc5d54f5c6a1b.tmp
aswb4e6fba611276c13.tmp
aswb5debc7f848d942c.tmp
aswb974a2651acd5b87.tmp
aswbee0de1f8e59bcdc.tmp
aswc438209405f92c26.tmp
aswc5c0d76e9090ae61.tmp
aswc60436162013395c.tmp
aswc75b663b258ffe03.tmp
aswc79cf72909da99dd.tmp
aswc8c5136090604a1a.tmp
aswcb609380d170146b.tmp
aswcccc778fad5ca4d2.tmp
aswcea82bbe223fc33c.tmp
aswd07ead1758b8d267.tmp
aswd453ba9cfcde11b2.tmp
aswd5a8520b2b16d614.tmp
aswda97a90aac9afd89.tmp
aswdc471221ed21b9ff.tmp
aswdd2ecd0c89519e00.tmp
aswdea515671dddda1b.tmp
aswdfa686ec172aed03.tmp
aswe44fa8cd6bd3d505.tmp
aswe490a72b4fd57429.tmp
aswe7ce21590d366df7.tmp
aswe83617c34b5332f7.tmp
aswea713ba59aef7da3.tmp
asweb2a362111a8fcde.tmp
aswed6518e72ab58b3c.tmp
aswf12044d07d927339.tmp
aswf3f3247b55ae804d.tmp
aswf524374ee9837c10.tmp
aswf5bf850d7a1510a0.tmp
aswf68f58a20d899788.tmp
aswf7cdf95705bcc324.tmp
aswfb347541349eaff6.tmp
aswfbcc0973bfb3c1dc.tmp
aswffb494b98fc029bd.tmp
asw011323664bd52e71.tmp
asw02a80577463295b3.tmp
asw033d6df13080a2f2.tmp
asw05047cabf6015b43.tmp
asw079555224d7b7097.tmp
asw0ff9b07f250fe6bc.tmp
asw1771d96e2543c784.tmp
asw1809c6a9f60a432c.tmp
asw190cae679f280522.tmp
asw1b248af1a3935af2.tmp
asw21d76d21a70e4bad.tmp
asw26e4d598a458093f.tmp
asw27913ab38b063f93.tmp
asw2a7058c1dcade6de.tmp
asw2b588d6bf6d26faf.tmp
asw2e010b82dac18341.tmp
asw3a7f156e437bba12.tmp
asw3e9ea822e64b5d9d.tmp
asw41af783668a764e1.tmp
asw41e68d7fe973bf0f.tmp
asw4885412558290cea.tmp
asw4c1278027af1b175.tmp
asw59dc7f09f5767318.tmp
asw5b7c6564cbd64ef8.tmp
asw5bc98af780cfea0a.tmp
asw5f3572665b92284d.tmp
asw670b7c1a8ffec330.tmp
asw7015d65518815992.tmp
asw79d56d6e8165aa5e.tmp
asw7d71a0136d413e6c.tmp
asw82aee196bbea532e.tmp
asw8ef76610dd83c5a5.tmp
asw8fa5d0dc47c74f7f.tmp
asw8fe87e08bb330f95.tmp
asw936093d3c6a936d0.tmp
asw93afcd12778f0949.tmp
asw9684ba9b09d04f87.tmp
asw9bdde098f46fa9c3.tmp
asw9c97b3c56e94c942.tmp
asw9eff21f165cbb74e.tmp
aswa0204a4b0d0be6f7.tmp
aswa45299fb3e6fd01d.tmp
aswa59e6d04fb016eb8.tmp
aswa64edca380b5d5a3.tmp
aswa883a03ed23e3c04.tmp
aswa8fb811c8c8032b1.tmp
aswa98e2e3839eaa829.tmp
aswabd2645a22158b7d.tmp
aswb0eb6a304b72b065.tmp
aswb1925a8e71f8af35.tmp
aswb671c26fe469f3af.tmp
aswb74e5483522a8b65.tmp
aswba219395ca0984a1.tmp
aswbe543e095d4eea63.tmp
aswc2b809ccf5500233.tmp
aswccb782dfe9554395.tmp
aswcf998d5f0b68d02f.tmp
aswcfa992197e0101ee.tmp
aswd0af892e52c6ae1c.tmp
aswd192b6cc9a68994c.tmp
aswd99004f78a727663.tmp
aswe475e49964cfc433.tmp
aswe59750386025f708.tmp
aswe6b543eba3a1ad4e.tmp
aswe8cc0ea5891ceb49.tmp
aswf30bee7e1888591f.tmp
aswf3de3fadd95e777c.tmp
aswf6f1bbe5bfe58498.tmp
aswfafd45a8af6b980b.tmp
aswfb7a230204b63055.tmp
aswfc0a5857102a843d.tmp
aswfd400dfd52d991a1.tmp
aswfd94903d4baa4bb2.tmp
aswff261bea0725a784.tmp
asw02cbff9e02336f2a.tmp
asw03e45bea687b01b8.tmp
asw11dc2f84beffa756.tmp
asw12e44739722fabb4.tmp
asw18a02fb5b2b61367.tmp
asw1bc0eb2ef28e4be6.tmp
asw22bf715b36787722.tmp
asw25041b875296ce3c.tmp
asw2939cea0a0409a2f.tmp
asw30986ab01e126db6.tmp
asw35c2343163b39325.tmp
asw38afa274e406321e.tmp
asw39bc51178d7156c6.tmp
asw39c49bde70bded26.tmp
asw3a37d592d5a11468.tmp
asw4b94dac02d9c468c.tmp
asw4bd368e3f680b837.tmp
asw4ec6749cc839786d.tmp
asw5013894ce9a9782c.tmp
asw56b34682dd5bbd8b.tmp
asw57c8edb4023f8786.tmp
asw5933ff4d1ca7464a.tmp
asw5d86b77ce8baad93.tmp
asw5de775e6646f3a88.tmp
asw600423abe2267eb1.tmp
asw674790d847eb2a7b.tmp
asw7164607fd566412b.tmp
asw716d1fcfe56cc75d.tmp
asw7264d93e91a39fb1.tmp
asw79ff333442b2ce5b.tmp
asw7e267a7e29f23f30.tmp
asw83362212a36325e3.tmp
asw8423c2d6e34c07f8.tmp
asw84b7085009aaec0b.tmp
asw87a93de677c33ca0.tmp
asw88a42fe174a1d954.tmp
asw89720306979eb6c3.tmp
asw8f16d918bcdf20de.tmp
asw9c530034800ad1b6.tmp
asw9cc5d3fbdce56f6b.tmp
aswa2142591315dd98d.tmp
aswa4d8357850cb509f.tmp
aswa6887bd274d11d89.tmp
aswad9e920e4cd598a7.tmp
aswb5d97f3cc42494ca.tmp
aswc345bbc2575a4fbe.tmp
aswc4b5f5d407368cde.tmp
asweb2775cad27bd018.tmp
asweb557d85a189c82d.tmp
aswf026a116c0fc6c2b.tmp
aswf403d08819c2a905.tmp
aswf85a4f3f19d8be2e.tmp
aswf8dd3a1bca61928b.tmp
065ce477-9582-4138-a4e1-53f692eda027.cab
update.xml
4a565d6e-c497-4960-a32a-9ec13b8f96dc.cab
update.xml
6d57ac0d-2c71-4971-b296-6fc34bba1e5f.ini
42AC296A3317ADC0798049B57987CDAF.rmt
update.xml
8d2bb78a-f782-484c-a230-ca104efa5ae2.cab
716471AC2DC3AD3B9FA31E6349EFB3AA.rmt
F5A2D1E391A646F3B90F0DA15BE81B8F.rmt
update.xml
asw03872160bc47eab7.tmp
asw08c32c35a6deb573.tmp
asw0d57d19ae5044167.tmp
asw22ca6d592fd0a1de.tmp
asw2ff4bab7f30d3176.tmp
asw4550438f7c6e5d1a.tmp
asw4dce3192eb87307d.tmp
asw6f075b6abcfb049d.tmp
asw7139a1f4a4876aea.tmp
asw73be09acd13e463d.tmp
asw951f8b7ce84e030d.tmp
aswa0ae11d0050624b3.tmp
aswc5c1a324ba34a97c.tmp
aswd41ba20d653d2d63.tmp
aswe69422a577efafd6.tmp
aswe98142c448b82984.tmp
Stats.ini
Stats.ini
Stats.ini
Stats.ini
Stats.ini
Stats.ini
aca3b0dd-0f93-4c21-8795-77e00a624ea8.cab
ais_cmp_bpc-7e7.vpx
ais_cmp_cleanup_x64-842.vpx
ais_cmp_fw_x64-97e.vpx
ais_cmp_gamingmode-925.vpx
ais_cmp_idp_x64-924.vpx
ais_cmp_rescuedisk_x64-8d9.vpx
ais_cmp_securebrowser-7cc.vpx
ais_cmp_swhealth_x64-8d9.vpx
ais_core-98e.vpx
ais_dll_eng-887.vpx
ais_dll_eng_x64-8d9.vpx
ais_fw-88b.vpx
ais_gen_crt_x64-834.vpx
ais_gen_crt_x86-833.vpx
ais_gen_gui_x64-8d9.vpx
ais_gen_openssl_x64-7ee.vpx
ais_gen_protobuf_x64-7d3.vpx
ais_gen_streamfilter_x64-958.vpx
ais_gen_tools-97b.vpx
ais_gen_tools_x64-97b.vpx
ais_gui_cef-7d6.vpx
ais_gui_res-8ac.vpx
ais_res-98e.vpx
ais_shl_mai_x64-8d9.vpx
ais_x64-98e.vpx
aswc1db8129221418b6.tmp
aswdd7aa46a0e689786.tmp
b4e4a82e-85f4-4895-b05b-5c33a1b69a48.ini
b66d396e-3c57-45a6-8337-5f95663427cc.xml
2A2AF20C4CCD138657130F2F26E58F93.rmt
update.xml
8DA7E27CF87FFBA2A61354896D1FB8C8.rmt
update.xml
180B16C9DC06AA2C9D0911292ABCCB1D.rmt
update.xml
jrog2-1513.vpx
setup.ini
vps_binaries-14ef.vpx
vps_binaries_64-14f0.vpx
vps_tools_64-14ef.vpx
aswc3505f922e4703e0.tmp
aswc59b00127b8de348.tmp
asw1600fbafaf8aad0c.tmp
asw171e186c944d4596.tmp
asw179376067ea7db8e.tmp
asw18f94d3e6fd2e905.tmp
asw2152937845b720f9.tmp
asw2b452352a2c398fd.tmp
asw3ffb7ffbc10ba4fb.tmp
asw5513fd88dbbcc1fa.tmp
asw633e19da85038689.tmp
asw6655b3a5dafd6c7b.tmp
asw69c881b77330e372.tmp
asw6d4ffeb3652e2d61.tmp
asw6e6df3e43387169e.tmp
asw84d1387b9c1d6429.tmp
asw8592a51e6b2b317d.tmp
asw937c2d4c1e3836b2.tmp
aswac0f8eca120dd7d7.tmp
aswb39ec7267706ee48.tmp
aswbfb6b1327c70cbb2.tmp
aswcd73df2907a85dee.tmp
aswd2ad7faea8c5685d.tmp
aswd338f8181e9c11c2.tmp
aswdf84ac8ea3511070.tmp
asw00e52ea7be31eb5b.tmp
asw0333e207f914f9e1.tmp
asw088891099a4147ea.tmp
asw0e33a33584433e06.tmp
asw1008514062164406.tmp
asw119d6f140d4232da.tmp
asw182103ad1857819c.tmp
asw21e898a41ce63277.tmp
asw261e9aa732f21f61.tmp
asw2c17b28ac751c664.tmp
asw2dfb7cd0dd2cf25f.tmp
asw2f35e4d166578b9d.tmp
asw348f84f0a1dbcb8e.tmp
asw399b4631e093eaaf.tmp
asw3b9188b0d61b0bed.tmp
asw3c046bad31a694ee.tmp
asw3e0c4582f13329cc.tmp
asw4739dc3b9f0d9082.tmp
asw5735e66999057198.tmp
asw5d1a1286269da7dc.tmp
asw5e14b72af39e7060.tmp
asw61998ff8a885d7f1.tmp
asw65b674385420722d.tmp
asw700b6bd8f06a5db3.tmp
asw71f7ad3d41b843a3.tmp
asw7bb167cc89674c3a.tmp
asw830f1bd3519c1315.tmp
asw8614cb2d0768b0cb.tmp
asw866615d445833b5f.tmp
asw911adb9f8a49c3f0.tmp
asw97e4d5d193e69e68.tmp
aswa01216f2a9b77aac.tmp
aswa5a5ad617fe0b1eb.tmp
aswafb42748c83f6c11.tmp
aswb51b74e23d8cc018.tmp
aswc2e824a25d9d77ed.tmp
aswc924226d2d3cfe26.tmp
aswc930e176db3efdfc.tmp
aswd7f9514211c99d10.tmp
aswd821b0aabfddc98a.tmp
aswde46efb90c28f839.tmp
aswe292fdd094ed803a.tmp
aswe4fcf143b76cb66b.tmp
aswe9266b796b01d658.tmp
asweb6147ac7cd76a51.tmp
aswec8c5c8cd9ffa49d.tmp
aswedca79287d0d6aea.tmp
aswf267a089d4916e4e.tmp
aswf4ff6fc8fab3c502.tmp
aswf59d1f6c54efcf1d.tmp
aswf7a7403a4a4b1407.tmp
aswf8315560dd6f2c60.tmp
aswf86498ca4edf3b2e.tmp
aswf87fbe42cdc0a2c1.tmp
setup.exe
asw30a160ae0f8f0a44.tmp
asw38349423b1e1b542.tmp
asw44933b783755388e.tmp
aswa2bba6d6d611d699.tmp
aswb3411537d3588f64.tmp
aswd661ca0402097301.tmp
aswe4c3b3ad9ac2c164.tmp
aswf802e8b42f9ee07b.tmp
aswf8abd85457e3f619.tmp
asw21a8c2cacc9b8841.tmp
aswa96901e5bcaa3590.tmp
SecurityProductInformation.ini
asw029c3335003ff9b3.tmp
asw23bb4aca35b45b9a.tmp
asw255c0475f84e6f1b.tmp
asw6666effa4f41458b.tmp
avast5.ini
asw1de2f3eb8bf44f78.tmp
asw3500173380134b24.tmp
asw90552e71e19927ad.tmp
aswe0768f08c70a9257.tmp
aswefbb151ab89dd3bb.tmp
aswf66150333a17cfc4.tmp
asw05a0d05673d3674e.tmp
asw48e3ec4b20bc276f.tmp
asw61cb44a4ea249807.tmp
aswfa70de5dd9f4f4aa.tmp
szb.log
AvEmUpdate.log
AvEmUpdate.log
Setup.log
Setup.log
Setup.log
event_manager.log
crl-set
settings.dat
Preload Data
7188ab34-de70-49fc-acc4-1ab8895ab578.tmp
Bookmarks
the-real-index
the-real-index
the-real-index
the-real-index~RFe5a51bb.TMP
verified_contents.json
background.js
background.js.LICENSE.txt
contentScript.css
contentScript.js.LICENSE.txt
Roboto-Black.woff2
Roboto-Bold.woff2
Roboto-Light.woff2
Roboto-Medium.woff2
Roboto-Regular.woff2
icon128.png
icon16.png
icon32.png
icon48.png
iconDisabled16.png
iconDisabled32.png
manifest.json
popover.html
siteScript.js
verified_contents.json
popup.html
privacy-policy.html
cross_32.png
cross_bold_32.png
icon.png
icon128.png
icon16.png
icon48.png
background.js
background.js.LICENSE.txt
popup.js
manifest.json
popup.css
privacy-consent.css
messages.json
verified_contents.json
background.js
background.js.LICENSE.txt
content.js
contentAPIs.js
icon128.png
icon16-active.png
icon.png
icon.svg
icon.png
icon.svg
icon.png
icon.svg
manifest.json
overlay.js
popup.html
popup.js
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
ai_chat.html
app.html
background.html
app.css
options.css
KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2
KFOmCnqEu92Fr1Mu4WxKOzY.woff2
KFOmCnqEu92Fr1Mu4mxK.woff2
KFOmCnqEu92Fr1Mu5mxKOzY.woff2
KFOmCnqEu92Fr1Mu72xKOzY.woff2
KFOmCnqEu92Fr1Mu7GxKOzY.woff2
KFOmCnqEu92Fr1Mu7WxKOzY.woff2
KFOmCnqEu92Fr1Mu7mxKOzY.woff2
icon_24.png
icon_64.png
icon_24.png
icon_64.png
animation.lottie.json
clear_chat.png
example_arrow.png
animation.lottie.json
clear_chat.png
example_arrow.png
ai_chat.bundle.js
background.bundle.js
background.bundle.js.LICENSE.txt
popup.bundle.js
manifest.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
background.html
app.css
icon_128.png
icon_16.png
icon_32.png
icon_64.png
icon_128.png
icon_128_off.png
icon_128_paused.png
icon_16.png
icon_16_off.png
icon_16_paused.png
icon_32.png
icon_32_off.png
icon_32_paused.png
icon_48_off.png
icon_48_paused.png
icon_64.png
arrow.png
balanced_mode_active.png
essential_mode.png
essential_mode_active.png
expanded_icon.png
gear.png
header_background.png
header_logo.png
header_logo_off.png
header_logo_paused.png
info_icon.png
open.png
options_logo.png
options_logo_off.png
pro_strict.png
settings_icon.png
strict_close.png
strict_mode.png
strict_mode_active.png
support.png
whitelist_action.png
arrow.png
balanced_mode.png
balanced_mode_active.png
essential_mode.png
essential_mode_active.png
expanded_icon.png
gear.png
header_background.png
header_logo.png
header_logo_off.png
header_logo_paused.png
info_icon.png
open.png
options_logo.png
options_logo_off.png
pro_strict.png
settings_icon.png
strict_close.png
strict_mode.png
strict_mode_active.png
support.png
whitelist_action.png
background.bundle.js
logger.bundle.js
logger.bundle.js.LICENSE.txt
options.bundle.js
popup.bundle.js
logger.html
manifest.json
options.html
messages.json
icon16_active.png
icon32_active.png
content.bundle.js
messages.json
verified_contents.json
content.bundle.js
fpattr.bundle.js
messages.json
verified_contents.json
messages.json
verified_contents.json
content.css
content.js
icon_48.png
icon_48.png
balanced_mode.png
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences~RFe5a51da.TMP
Secure Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index~RFe5a734d.TMP
CURRENT
download_file_types.pb
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe5a4e50.TMP
crs.pb
kp_pinslist.pb
privacy-sandbox-attestations.dat
ssl_error_assistant.pb
safety_tips.pb
Filtering Rules
metadata.pb
activity-stream.discovery_stream.json.tmp
258f5420-6d2d-4480-aed4-4d5ce5f12ec6.tmp
4d38ca74-f1d2-4886-885c-55d339f0acc8.tmp
4f6b1444-9da5-433c-bfa5-03c240b0c8a4.tmp
5425e7ec-dcab-4fec-9226-4a6ccf295583.tmp
54f38c87-4067-4187-a2d4-55f0c6aff7e8.tmp
tor.exe
m_finnish.wnry
a3d68f9d-a354-4097-a9b2-bef6aa95a952.tmp
app90a01bced12b0325.tmp
appfc58efa9642126b9.tmp
bc10781e-691e-40ab-bc8b-002d699e9b18.tmp
dd2bd4ef-e4dd-4a70-8431-6ab2dc754d7e.tmp
dfc80d65-3d1b-4365-92e1-3df56780a8ef.tmp
e4e07f86-c545-44aa-99e7-65bc35db6e22.tmp
e9c52306-4948-4eb1-9f20-7553ee166969.tmp
mozilla-temp-41
AvastBrowserUpdateSetup.exe
CR.History.tmp
CR.History.tmp
FF.places.tmp
JsisPlugins.dll
Midex.dll
StdUtils.dll
icon48.png
icon.png
icon.svg
webstore.js
messages.json
64dec6ae-3e1c-4e2c-bbdf-3abee8898901.tmp
icon_128.png
icon_16.png
icon_32.png
icon_48.png
ai_chat.png
arrow.png
conversation_logo.gif
conversation_logo.png
genie.png
messages.png
ai_chat.bundle.js.LICENSE.txt
messages.json
messages.json
allowed.png
blocked.png
icon_close.png
logger_icon.png
logger_table_icon.jpg
pro.png
table_list_icon.png
table_regex_icon.png
warning.png
background.bundle.js.LICENSE.txt
icon_16.png
contentScript.js
fonts.css
content.js
content.css
tmpaddon
tmpaddon-1
index
the-real-index
the-real-index~RFe5bf72e.TMP
Network Persistent State
Network Persistent State~RFe5ccbc4.TMP
Avast Secure Browser.lnk
AlternateServices.bin
AlternateServices.bin
data.safe.tmp
data.safe.tmp
44e9c27a-d18d-4e63-aa60-073f00d14922
5d06cae7-0c53-40ee-ad77-00fc79d47efc
6bccf805-c406-40c8-bd73-12963d925f4d
cd3abbb3-83f8-44b3-aeaa-7e4dc0eee167
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs.js
prefs.js
sessionCheckpoints.json.tmp
recovery.baklz4
recovery.baklz4
recovery.baklz4
cached-microdescs.new
e5e3b9f.msi
manifest.json
manifest.json
widevinecdm.dll.sig
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
manifest.fingerprint
manifest.json
manifest.json
manifest.json
HTMLayout.dll
Instup.dll
Instup.exe
asw0d9cbb7acde3e00f.tmp
asw4a978891f467ff63.tmp
gcapi.dll
securebrowser_setup.exe
asw4a5b190f8eeb82c7.tmp
avbugreport_x64_ais-a42.vpx
avdump_x64_ais-a42.vpx
avdump_x86_ais-a42.vpx
config.def
config.def
config.ini
part-jrog2-1513.vpx
part-prg_ais-180617e9.vpx
part-setup_ais-180617e9.vpx
part-vps_windows-24071806.vpx
prod-pgm.vpx
prod-vps.vpx
prod-vps.vpx
servers.def
servers.def.vpx
setup.def
uat64.dll
uat64.vpx
avast_free_antivirus_setup_online_x64.exe
ecoo.edat
memory/436-20118-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/896-19081-0x00000237761C0000-0x0000023776322000-memory.dmp
memory/1308-20128-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/1308-20130-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/1692-18137-0x00000230E6BD0000-0x00000230E6D32000-memory.dmp
memory/1692-18134-0x00007FFB9D240000-0x00007FFB9D250000-memory.dmp
memory/1692-18133-0x00007FFB9D240000-0x00007FFB9D250000-memory.dmp
memory/3496-11763-0x00007FFB9F2C0000-0x00007FFB9F2C1000-memory.dmp
memory/3712-858-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-336-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-2251-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-1094-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-17967-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-11355-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-11374-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-11376-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-19954-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-19912-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-1245-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-6334-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-369-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-728-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-10814-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-11228-0x000002329D240000-0x000002329D639000-memory.dmp
memory/3712-19058-0x000002329D240000-0x000002329D639000-memory.dmp
memory/5856-23694-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/5872-23696-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/5872-23697-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/6704-20133-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/6704-20135-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/6712-20249-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/6712-20250-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/6988-20245-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/8556-20132-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/8556-20134-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/9312-20401-0x0000000010000000-0x0000000010010000-memory.dmp
memory/9740-20117-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/13340-19950-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/13340-19951-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/13392-20151-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/13392-20152-0x00007FF6C8DD0000-0x00007FF6CA33F000-memory.dmp
memory/14496-23749-0x00000000739B0000-0x0000000073A32000-memory.dmp
memory/14496-23747-0x0000000073A40000-0x0000000073AC2000-memory.dmp
memory/14496-23748-0x00000000736E0000-0x00000000738FC000-memory.dmp
memory/14496-23751-0x0000000000470000-0x000000000076E000-memory.dmp
memory/14496-23750-0x0000000073900000-0x0000000073922000-memory.dmp
memory/14496-23781-0x0000000073AD0000-0x0000000073AEC000-memory.dmp
memory/14496-23780-0x0000000000470000-0x000000000076E000-memory.dmp
memory/14496-23786-0x0000000073900000-0x0000000073922000-memory.dmp
memory/14496-23785-0x00000000736E0000-0x00000000738FC000-memory.dmp
memory/14496-23784-0x0000000073930000-0x00000000739A7000-memory.dmp
memory/14496-23783-0x00000000739B0000-0x0000000073A32000-memory.dmp
memory/14496-23825-0x0000000000470000-0x000000000076E000-memory.dmp
memory/14496-23782-0x0000000073A40000-0x0000000073AC2000-memory.dmp