Resubmissions
13/08/2024, 02:54
240813-dd5gda1amd1013/08/2024, 02:39
240813-c5kevazflb1013/08/2024, 02:28
240813-cx1rvsvdpm813/08/2024, 02:18
240813-crra8szaqg413/08/2024, 02:18
240813-crdedavbkq413/08/2024, 02:15
240813-cpp1dsyhrc313/08/2024, 02:14
240813-cn7ttayhpe313/08/2024, 00:43
240813-a3a3aazfjp1013/08/2024, 00:10
240813-af4q3syekr813/08/2024, 00:01
240813-aazj6sycjn10Analysis
- max time kernel
694s - max time network
717s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
13/08/2024, 02:54
Errors
Reason
Machine shutdown
General
- Target https://github.com/Da2dalus/The-MALWARE-Repo
- Sample240813-dd5gda1amd
Score
10/10
Malware Config
Signatures
- CryptoLocker
Ransomware family with multiple variants.
- Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (292) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Disables RegEdit via registry modification 2 IoCs
- Disables Task Manager via registry modification
- Disables use of System Restore points 1 TTPs
- Downloads MZ/PE file
- Drops file in Drivers directory 35 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Sets service image path in registry 2 TTPs 32 IoCs
- Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
- Uses Session Manager for persistence 2 TTPs 8 IoCs
Creates Session Manager registry key to run executable early in system boot.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Impair Defenses: Safe Mode Boot 1 TTPs 5 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 9 IoCs
- Checks for any installed AV software in registry 1 TTPs 60 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Drops desktop.ini file(s) 15 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 25 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Checks system information in the registry 2 TTPs 6 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 9 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 40 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 19 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Embeds OpenSSL 2 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 35 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies Internet Explorer settings 1 TTPs 16 IoCs
- Modifies data under HKEY_USERS 12 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 45 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 56 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 60 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 36 IoCs
- Suspicious use of SetWindowsHookEx 45 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe09033cb8,0x7ffe09033cc8,0x7ffe09033cd82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1808 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5800 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6068 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7100 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7440 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7448 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2588 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7560 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7448 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7588 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7380 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7584 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1052 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2952 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6072 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6212 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2600 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6072 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7308 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2940 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6856 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6400 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2968 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7424 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7636 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7640 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7748 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7060 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7080 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7664 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7320 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1520 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6956 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7744 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7316 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7640 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7304 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7564 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1240 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe"C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw.db281356c186842c\avg_antivirus_free_online_setup.exe"C:\Windows\Temp\asw.db281356c186842c\avg_antivirus_free_online_setup.exe" /cookie:mmm_bav_003_999_b8h_m:dlid_FREEGSR-FAD /ga_clientid:13a727e3-351a-4b37-b29c-36c5700c3356 /edat_dir:C:\Windows\Temp\asw.db281356c186842c /geo:GB3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw-67e07132-02b9-403c-b323-42c80d9e6248\common\icarus.exeC:\Windows\Temp\asw-67e07132-02b9-403c-b323-42c80d9e6248\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-67e07132-02b9-403c-b323-42c80d9e6248\icarus-info.xml /install /cookie:mmm_bav_003_999_b8h_m:dlid_FREEGSR-FAD /edat_dir:C:\Windows\Temp\asw.db281356c186842c /geo:GB /track-guid:13a727e3-351a-4b37-b29c-36c5700c3356 /sssid:37324⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw-67e07132-02b9-403c-b323-42c80d9e6248\common\icarus_ui.exeC:\Windows\Temp\asw-67e07132-02b9-403c-b323-42c80d9e6248\common\icarus_ui.exe /cookie:mmm_bav_003_999_b8h_m:dlid_FREEGSR-FAD /edat_dir:C:\Windows\Temp\asw.db281356c186842c /geo:GB /track-guid:13a727e3-351a-4b37-b29c-36c5700c3356 /sssid:3732 /er_master:master_ep_e880e073-b786-4e62-8271-bf234e514f95 /er_ui:ui_ep_9bc3d933-d5c3-4015-9b7e-cd4ea762dea45⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Temp\asw-67e07132-02b9-403c-b323-42c80d9e6248\avg-av-vps\icarus.exeC:\Windows\Temp\asw-67e07132-02b9-403c-b323-42c80d9e6248\avg-av-vps\icarus.exe /cookie:mmm_bav_003_999_b8h_m:dlid_FREEGSR-FAD /edat_dir:C:\Windows\Temp\asw.db281356c186842c /geo:GB /track-guid:13a727e3-351a-4b37-b29c-36c5700c3356 /sssid:3732 /er_master:master_ep_e880e073-b786-4e62-8271-bf234e514f95 /er_ui:ui_ep_9bc3d933-d5c3-4015-9b7e-cd4ea762dea4 /er_slave:avg-av-vps_slave_ep_f868a3ba-0313-4ed2-9bc5-1a5a8f3d5062 /slave:avg-av-vps5⤵
- Uses Session Manager for persistence
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\AVG\Antivirus\defs\24081214\engsup.exe"C:\Program Files\AVG\Antivirus\defs\24081214\engsup.exe" /prepare_definitions_folder6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\Temp\asw-67e07132-02b9-403c-b323-42c80d9e6248\avg-av\icarus.exeC:\Windows\Temp\asw-67e07132-02b9-403c-b323-42c80d9e6248\avg-av\icarus.exe /cookie:mmm_bav_003_999_b8h_m:dlid_FREEGSR-FAD /edat_dir:C:\Windows\Temp\asw.db281356c186842c /geo:GB /track-guid:13a727e3-351a-4b37-b29c-36c5700c3356 /sssid:3732 /er_master:master_ep_e880e073-b786-4e62-8271-bf234e514f95 /er_ui:ui_ep_9bc3d933-d5c3-4015-9b7e-cd4ea762dea4 /er_slave:avg-av_slave_ep_f94e99e7-f090-42e7-975a-249f5c39445e /slave:avg-av5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Uses Session Manager for persistence
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw-67e07132-02b9-403c-b323-42c80d9e6248\avg-av\aswOfferTool.exe"C:\Windows\Temp\asw-67e07132-02b9-403c-b323-42c80d9e6248\avg-av\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AWFC6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Public\Documents\aswOfferTool.exe"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AWFC7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\Temp\asw-67e07132-02b9-403c-b323-42c80d9e6248\avg-av\aswOfferTool.exe"C:\Windows\Temp\asw-67e07132-02b9-403c-b323-42c80d9e6248\avg-av\aswOfferTool.exe" -checkChrome -elevated6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:sw_avgNdis6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:avgNdisFlt /catalog:avgNdisFlt.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRdr2.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgHwid.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgVmm.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRvrt.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer /reg6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\aswAMSI.dll"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /catinstall:"C:\Program Files\AVG\Antivirus\crts.cat" /basename:pkg_{af98c830-528a-46b9-a60e-2db5d9a76b77}.cat /crtid:E89476E7569FC7413EA11A4461D6E3E784B8B6996⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\wsc_proxy.exe"C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /svc /register /ppl_svc6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
-
C:\Program Files\AVG\Antivirus\avDump.exe"C:\Program Files\AVG\Antivirus\avDump.exe" --pid 3792 --exception_ptr 000000DEA3CFE940 --thread_id 2760 --dump_level 21 --dump_file "C:\ProgramData\AVG\Antivirus\log\unp311247811140568836i-manual.mdmp" --comment "Cause: VectoredExceptionHandler Reason: sd is not loaded Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of exception instantiation." --min_interval 607⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\AVG\Icarus\avg-av\aswOfferTool.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av\aswOfferTool.exe" /install_secure_browser /cmd:"/make_default /run_source=avg_install /language=en" /config_def:"C:\Windows\Temp\asw-67e07132-02b9-403c-b323-42c80d9e6248\avg-av\config.def"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\AVG\Icarus\avg-av\securebrowser_setup.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av\securebrowser_setup.exe" /s /make_default /run_source=avg_install /language=en7⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\nszF4EF.tmp\AVGBrowserUpdateSetup.exeAVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en&brand=7602&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\GUMFE24.tmp\AVGBrowserUpdate.exe"C:\Program Files (x86)\GUMFE24.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en&brand=7602&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies"9⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0ie0NDQjE3NUM2LTdGN0EtNDU0Qy1BNDlELTdDODhDRTZGNzY3Nn0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9IntCMTUwMEFFMy03NkMyLTQ0MTEtODUxQS04M0M0MUFGMEI2QUR9IiB1c2VyaWRfZGF0ZT0iMjAyNDA4MTMiIG1hY2hpbmVpZD0iezAwMDBDQkM0LUFBNTMtOTMyRC1GNjQ2LTgzNTZEQzZDRUMyNH0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDgxMyIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9IntDNDI5QzI2Qi0zMTEwLTQ3NjgtOUQwMC1CMUUyNUYzNUNGRUF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7MUM4OUVGMkYtQTg4RS00REUwLTk3RkUtQ0I0MEM4RTRGRUVBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS44LjE2OTMuNiIgbGFuZz0iZW4iIGJyYW5kPSI3NjAyIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI2MTEiLz48L2FwcD48L3JlcXVlc3Q-10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en&brand=7602&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies" /installsource otherinstallcmd /sessionid "{CCB175C6-7F7A-454C-A49D-7C88CE6F7676}" /silent10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --heartbeat --install --create-profile8⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=127.0.25891.89 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdf3e1f7a0,0x7ffdf3e1f7ac,0x7ffdf3e1f7b89⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,8179528812185570951,8789167876943226301,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:29⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1860,i,8179528812185570951,8789167876943226301,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:119⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2176,i,8179528812185570951,8789167876943226301,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:139⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3228,i,8179528812185570951,8789167876943226301,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:19⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,8179528812185570951,8789167876943226301,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:99⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3504,i,8179528812185570951,8789167876943226301,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:99⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=3524,i,8179528812185570951,8789167876943226301,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:149⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4596,i,8179528812185570951,8789167876943226301,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:149⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4588,i,8179528812185570951,8789167876943226301,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:149⤵
- Executes dropped EXE
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --silent-launch8⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=127.0.25891.89 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf3e1f7a0,0x7ffdf3e1f7ac,0x7ffdf3e1f7b89⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2080,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:29⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1904,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:119⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2320,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:139⤵
- Executes dropped EXE
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3556,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3588,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3672,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3676,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3712,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3744,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3724,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3640,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3728,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4064,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3688,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4504,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4344,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4516,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4348,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4520,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4952,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5544,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:19⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5548,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5732,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6248,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4688,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6376,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6552,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6848,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5744,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7172,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6684,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=7548,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6844,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7180,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6688,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=8020,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6840,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=8296 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7184,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=8160,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=8440 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=8604,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=8632 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=7984,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=8628 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=8912,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=8928 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=8100,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=8092 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=3384,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:149⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --enable-protect9⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=127.0.25891.89 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffdf3e1f7a0,0x7ffdf3e1f7ac,0x7ffdf3e1f7b810⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe"C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe" --registration reg-task --taskintr PT10M --runonce10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=8752,i,807044236361548582,1886413788861967000,262144 --variations-seed-version --mojo-platform-channel-handle=8748 /prefetch:149⤵
-
-
-
C:\Program Files\AVG\Browser\Application\127.0.25891.89\Installer\setup.exesetup.exe /silent --create-shortcuts=0 --install-level=1 --system-level8⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\AVG\Browser\Application\127.0.25891.89\Installer\setup.exe"C:\Program Files\AVG\Browser\Application\127.0.25891.89\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=127.0.25891.89 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff7430dbfc0,0x7ff7430dbfcc,0x7ff7430dbfd89⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"9⤵
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --check-run=src=installer --start-minimized8⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=127.0.25891.89 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf3e1f7a0,0x7ffdf3e1f7ac,0x7ffdf3e1f7b89⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2072,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:29⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1884,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:119⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2188,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:139⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3256,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:19⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3268,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3792,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3812,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4320,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4492,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4424,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"9⤵
- Checks processor information in registry
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5628,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"9⤵
-
-
C:\Program Files\AVG\Browser\Application\127.0.25891.89\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\127.0.25891.89\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings9⤵
- Drops file in Windows directory
-
C:\Program Files\AVG\Browser\Application\127.0.25891.89\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\127.0.25891.89\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=127.0.25891.89 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7fbf8bfc0,0x7ff7fbf8bfcc,0x7ff7fbf8bfd810⤵
- Drops file in Windows directory
-
-
C:\Program Files\AVG\Browser\Application\127.0.25891.89\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\127.0.25891.89\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\AVG\Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=0 --no-pin-startmenu10⤵
- Drops file in Windows directory
-
C:\Program Files\AVG\Browser\Application\127.0.25891.89\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\127.0.25891.89\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=127.0.25891.89 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7fbf8bfc0,0x7ff7fbf8bfcc,0x7ff7fbf8bfd811⤵
- Drops file in Windows directory
-
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=5400,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:149⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --enable-protect9⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=127.0.25891.89 --initial-client-data=0xfc,0x100,0x104,0x88,0x108,0x7ffdf3e1f7a0,0x7ffdf3e1f7ac,0x7ffdf3e1f7b810⤵
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=6840,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:19⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --field-trial-handle=6768,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:129⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=7124,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4728,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6580,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=4768,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:19⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6488,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4684,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3636,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:109⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4400,i,12511258958342968744,10714706113973366533,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:149⤵
-
-
-
-
-
C:\Program Files\Common Files\AVG\Overseer\overseer.exe"C:\Program Files\Common Files\AVG\Overseer\overseer.exe" /skip_uptime /skip_remediations6⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\defs\24081214\engsup.exe"C:\Program Files\AVG\Antivirus\defs\24081214\engsup.exe" /avg /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie6⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7428 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,18239868059339844709,5146137108088945997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\Annabelle (1).exe"C:\Users\Admin\Downloads\Annabelle (1).exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Checks processor information in registry
- System policy modification
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\NetSh.exeNetSh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" -r -t 00 -f3⤵
-
-
-
C:\Users\Admin\Downloads\CryptoLocker.exe"C:\Users\Admin\Downloads\CryptoLocker.exe"2⤵
- System Location Discovery: System Language Discovery
- NTFS ADS
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w000002344⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004C01⤵
-
C:\Program Files\AVG\Antivirus\afwServ.exe"C:\Program Files\AVG\Antivirus\afwServ.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\afwServ.exe"C:\Program Files\AVG\Antivirus\afwServ.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\afwServ.exe"C:\Program Files\AVG\Antivirus\afwServ.exe"1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
-
C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus.exe" /repair:avg-av /silent /ii_reason:FwSvcRecovery1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks processor information in registry
-
C:\Program Files\Common Files\AVG\Icarus\avg-av\temp\asw-8f229c71-02d0-4cf5-9809-bdf881d29421\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av\temp\asw-8f229c71-02d0-4cf5-9809-bdf881d29421\icarus.exe" /silent /ii_reason:FwSvcRecovery /er_master:master_ep_654cd6e2-b172-4466-94a9-7b008f126064 /er_ui:ui_ep_70e165e9-0ea8-4725-9537-8631c18aa03c /er_slave:avg-av_slave_ep_61d7ad83-55ea-471e-8348-3ecac82009a2 /slave:avg-av2⤵
- Sets service image path in registry
- Uses Session Manager for persistence
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:sw_avgNdis3⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:avgNdisFlt /catalog:avgNdisFlt.cat3⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRdr2.cat3⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgHwid.cat3⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgVmm.cat3⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRvrt.cat3⤵
- Checks for any installed AV software in registry
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /updater /reg3⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer /reg3⤵
- Checks for any installed AV software in registry
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /updater3⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer3⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" /U "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"3⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" /U "C:\Program Files\AVG\Antivirus\aswAMSI.dll"3⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Modifies Internet Explorer settings
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"3⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\aswAMSI.dll"3⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
- Modifies Internet Explorer settings
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /catinstall:"C:\Program Files\AVG\Antivirus\crts.cat" /basename:pkg_{af98c830-528a-46b9-a60e-2db5d9a76b77}.cat /crtid:E89476E7569FC7413EA11A4461D6E3E784B8B6993⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\wsc_proxy.exe"C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /svc /register /ppl_svc3⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\avDump.exe"C:\Program Files\AVG\Antivirus\avDump.exe" --pid 2500 --exception_ptr 00000072B3B3E9A0 --thread_id 7160 --dump_level 21 --dump_file "C:\ProgramData\AVG\Antivirus\log\unp311247812032570220i-manual.mdmp" --comment "Cause: VectoredExceptionHandler Reason: sd is not loaded Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of exception instantiation." --min_interval 604⤵
-
-
-
C:\Program Files\Common Files\AVG\Overseer\overseer.exe"C:\Program Files\Common Files\AVG\Overseer\overseer.exe" /skip_uptime /skip_remediations3⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" /nogui3⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\AvDump.exe"C:\Program Files\AVG\Antivirus\AvDump.exe" /unregister3⤵
-
-
-
C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\temp\asw-8f229c71-02d0-4cf5-9809-bdf881d29421\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\temp\asw-8f229c71-02d0-4cf5-9809-bdf881d29421\icarus.exe" /silent /ii_reason:FwSvcRecovery /er_master:master_ep_654cd6e2-b172-4466-94a9-7b008f126064 /er_ui:ui_ep_70e165e9-0ea8-4725-9537-8631c18aa03c /er_slave:avg-av-vps_slave_ep_711949e0-e049-4b9f-a451-e0e20352b9dd /slave:avg-av-vps2⤵
- Uses Session Manager for persistence
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
-
C:\Program Files\AVG\Antivirus\defs\24081214\engsup.exe"C:\Program Files\AVG\Antivirus\defs\24081214\engsup.exe" /prepare_definitions_folder3⤵
- Checks for any installed AV software in registry
-
-
-
C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus_ui.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus_ui.exe" /sbr /eid=42278893-276d-46d7-a362-c21bd40e04122⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{F928774E-16AA-4EF5-A90A-6F139D2905F7}\AVGBrowserInstaller.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{F928774E-16AA-4EF5-A90A-6F139D2905F7}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --auto-pin-to-taskbar-on-run --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=msedge --import-cookies --system-level2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{F928774E-16AA-4EF5-A90A-6F139D2905F7}\CR_4D5E0.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{F928774E-16AA-4EF5-A90A-6F139D2905F7}\CR_4D5E0.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{F928774E-16AA-4EF5-A90A-6F139D2905F7}\CR_4D5E0.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --auto-pin-to-taskbar-on-run --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=msedge --import-cookies --system-level3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{F928774E-16AA-4EF5-A90A-6F139D2905F7}\CR_4D5E0.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{F928774E-16AA-4EF5-A90A-6F139D2905F7}\CR_4D5E0.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=127.0.25891.89 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff7f9e3bfc0,0x7ff7f9e3bfcc,0x7ff7f9e3bfd84⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Program Files\AVG\Browser\Application\127.0.25891.89\elevation_service.exe"C:\Program Files\AVG\Browser\Application\127.0.25891.89\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Browser\Application\127.0.25891.89\elevation_service.exe"C:\Program Files\AVG\Browser\Application\127.0.25891.89\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Browser\Application\127.0.25891.89\elevation_service.exe"C:\Program Files\AVG\Browser\Application\127.0.25891.89\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" /welcome1⤵
- Checks computer location settings
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=gpu-process --field-trial-handle=9684,3512040771860738889,7753366995154976156,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --no-sandbox --disable-gpu-driver-bug-workarounds --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --gpu-preferences=SAAAAAAAAADgAABwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --mojo-platform-channel-handle=9692 /prefetch:22⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=9684,3512040771860738889,7753366995154976156,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=utility --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --mojo-platform-channel-handle=9992 /prefetch:82⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=9684,3512040771860738889,7753366995154976156,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=none --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --mojo-platform-channel-handle=10004 /prefetch:82⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --field-trial-handle=9684,3512040771860738889,7753366995154976156,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=10160 /prefetch:12⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Program Files\AVG\Antivirus\afwServ.exe"C:\Program Files\AVG\Antivirus\afwServ.exe"1⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004C01⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3847055 /state1:0x41c64e6d1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
5Active Setup
1Registry Run Keys / Startup Folder
3Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
5Active Setup
1Registry Run Keys / Startup Folder
3Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Safe Mode Boot
1Indicator Removal
2File Deletion
2Modify Registry
10Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
7Software Discovery
1Security Software Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
npAvgBrowserUpdate3.dll
AVGBrowserUpdate.exe
@PaxHeader
@PaxHeader
@PaxHeader
@PaxHeader
Base.dll
Boot.dll
aswClnTg.htm
aswClnTg.txt
aswInfTg.htm
aswInfTg.txt
uiLangRes.dll
AVGSvc.exe
AVGUI.exe
AVGUI.exe
AavmRpch.dll
AvBugReport.exe
AvConsent.exe
AvDump.exe
AvEmUpdate.exe
AvLaunch.exe
BreachGuardSdk.dll
BrowserCleanup.ini
CommChannel.dll
CommonRes.dll
HTMLayout.dll
avgArDisk.sys
avgArPot.sys
avgBoot.exe
avgElam.sys
avgKbd.sys
avgMonFlt.sys
avgNetHub.sys
avgRdr2.sys
avgRvrt.sys
avgSP.sys
avgSnx.sys
avgStm.sys
avgVmm.sys
avgbidsdriver.sys
avgbidsh.sys
avgbuniv.sys
Boost.txt
Crypto++.txt
Detours.txt
GSL.txt
ICU.txt
JsonCpp.txt
LZMA.txt
OpenSSL.txt
PCRE.txt
Xerces.txt
brotli.txt
bsdiff.txt
bzip2.txt
c-ares.txt
cURL.txt
cef.txt
dnscrypt-proxy.txt
intel_asm.txt
jansson.txt
lexbor.txt.ipending.c12621d1
libPNG.txt
libevent.txt
libsodium.txt
lzfse.txt
mbedTLS.txt
mhook.txt
nanopb.txt
nghttp2.txt
protobuf.txt
pugixml.txt
rapidjson.txt
sqlite.txt
unrar.txt
vxWidgets.txt
xmlParser.txt
xxHash.txt
yara.txt
zlib.txt
OobeUtil.exe
RegSvr.exe
aswPEAntivirus.exe
aswPEBrowser.exe
aswPECommander.exe
aswPEShell.exe
aswRegLib.dll
aswShMin.exe
background-loading.png
background.png
waikamd64.mst
wxbase315u_vc.dll
wxmsw315u_core_vc.dll
SecurityProductInformation.ini
SetupInf.exe
SupportTool.exe
VisthAux.exe
afwCoreClient.dll
afwCoreClient.dll
afwRpc.dll
afwServ.exe
afwServ.exe
anen.dll
ashBase.dll
ashQuick.exe
ashServ.dll
ashShell.dll
ashTask.dll
ashUpd.exe
asulaunch.exe
aswAMSI.dll
aswAux.dll
aswAv.dll
aswAvBootTimeScanShMin.exe
aswBrowser.dll
aswChLic.exe
aswCmnBS.dll
aswCmnIS.dll
aswCmnOS.dll
aswDld.dll
aswEngLdr.dll
aswEngSrv.exe
aswIP.dll
aswLog.dll
aswProperty.dll
aswPropertyAv.dll
aswRunDll.exe
aswRvrt.dll
aswSqLt.dll
aswVmm.dll
aswW8ntf.dll
aswavdetection.dll
aswcomm.dll
aswdetallocator.dll
aswhook.dll
aswidpm.dll
aswidsagent.exe
aswntsqlite.dll
aswpsic.dll
aswremoval.dll
aswsecapi.dll
aswwinamapi.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
avg.local_vc142.crt.manifest
concrt140.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_1.dll
vcruntime140_threads.dll
avgToolsSvc.exe
browser_pass.dll
burger_client.dll
chrome_100_percent.pak
chrome_200_percent.pak
chrome_elf.dll
crts.cat
d3dcompiler_47.dll
db_ob2.dat.id-22054AEC.[[email protected]].ncov
engsup.ini
dll_loader.dll
dnd_helper.dll
event_manager.dll
event_manager_burger.dll
event_manager_er.dll
event_manager_ga.dll
event_routing.dll
event_routing_rpc.dll
ffl2.dll
firefox_pass.exe
fltlib_wrapper.dll
gaming_hook.exe
about.js
antiRansomware.js
antiTrack.js
ask.ogg
browserDetection.js
browserDetectionWindow.html
browserExtensions.js
core.js
darkWebMonitor.js
dashboard.js
dataShredder.js
doNotDisturb.js
done.ogg
driverUpdater.js
feedbackForm.js
firewall.js
help.js
i18n.js
kin.js
libs.js
locale-hu.json.ipending.c12621d1
mainCss.css
mainCss_light.css
mainFont.css
mainLayout.js
mainLayoutCss.css
mainSprite.css
mainVars.json
mainWindow.html
myLicenses.js
napi.js
napiAdapter.js
napiExtensions.js
network.js
notifications.js
notify.ogg
offline.htm
overlay.html
pap.js
passwordProtection.js
plugins.js
ras.js
rescueDisk.js
scans.js
search.js
secureDns.js
sensitiveData.js
settings.js
shields.js
smartScan.js
software.js
svelteComponents.js
svelteInternal.js
svgInline.svg
system.js
threat.ogg
tray.js
tuneup.js
update.js
updatefile.json
virusChest.js
webCam.js
resources.ini
hns_tools.dll
icudtl.dat
jsbridge.dll
libEGL.dll
libGLESv2.dll
libcrypto-3-x64.dll
libssl-3-x64.dll
libwaapi.dll
libwaheap.dll
libwalocal.dll
libwaresource.dll
libwautils.dll
libwavmodapi.dll
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
vi.pak
zh-CN.pak
zh-TW.pak
log.dll
mfc140.dll
mfc140u.dll
mfcm140.dll
mfcm140u.dll
module_lifetime.dll
nos.dll
ntp_time.dll
overseer.exe
perfstats.dll
process_monitor.dll
protobuf.dll
resources.pak
sched.exe
serialization.dll
5cfa58aa-76a9-4579-be8d-f6d9ad08a7bf.cab
769310EFC2D1B3BD5086146C33EF78B703BB8423598C6A52D9B1964F6DBB42C1
A5FA240E7572F0B9720E88CFD51BC86A.rmt
update.xml
update.xml
0F2FBE0BC5152A4692E67C0409C3A825.rmt
update.xml
b5464a79-c999-4069-a811-2a6d79a90dfa.ini
config.def
config.def
config.def
d0eb4325-02fb-48be-a633-99cfb6f29c84.ini
0EBE76DF570EF27B48D24A21FB779050.rmt
13AC3B1667CF4B7D592C9EEA4A5C88F0.rmt
4370D3CB9AB8D40B03690D522A41C16391BDB423F39A19B6000099EC49F5E4F4
674CC97CF24F98B0F1C8472B564C5590.rmt
6981C6ED47732DCB649950F4A51B17FF3D366CCF14A51009F0B92D3F210B047C
6981C6ED47732DCB649950F4A51B17FF3D366CCF14A51009F0B92D3F210B047C.sum
C286EEFE8A32C8F50147C9EF9894CB1B.rmt
FD2EA68B17D2709A1FAF902946964749.rmt
update.xml
e580b54d-abf3-49c7-a64f-80a05eceba14.xml
setup.ini
setup.ini
shepherdsync.dll
shred.exe
snapshot_blob.bin
snxhk.dll
streamback.dll
su_adapter.dll
su_common.dll
su_controller.dll
su_worker.exe
libEGL.dll
libGLESv2.dll
task_performance_logger.dll
tasks_core.dll
v8_context_snapshot.bin
vaarclient.dll
wa_3rd_party_host_32.exe
wa_3rd_party_host_64.exe
wsc.dll
wsc_proxy.exe
wsc_proxy.exe.manifest
AavmRpch.dll
AvDump.exe
RegSvr.exe
ashShell.dll
aswAMSI.dll
aswBrowser.dll
aswCmnBS.dll
aswCmnIS.dll
aswCmnOS.dll
aswProperty.dll
aswPropertyAv.dll
aswRunDll.exe
aswhook.dll
API-MS-Win-core-xstate-l2-1-0.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
avg.local_vc142.crt.manifest
concrt140.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_threads.dll
dll_loader.dll
dnd_helper.dll
firefox_pass.exe
gaming_hook.exe
snxhk.dll
ArPot.dll
ArPotEx32.dll
ArPotEx64.dll
BCUEngine.dll
PushPin.dll
Sf2.dll
algo64.dll
aswAR.dll
aswArray.dll
aswBoot64.dll
aswCleanerDLL.dll
aswCmnBS.dll
aswCmnIS64.dll
aswCmnOS.dll
aswEngin.dll
aswFiDb.dll
aswHds.dll
aswJsFlt.dll
aswJsFlt64.dll
aswQcr.dll
aswRawFS64.dll
aswRep.dll
aswScan.dll
certs.map
db_agdx.dat
db_ap2.dat
db_array.dat
db_as.dat
db_bank.dat
db_cf.dat
db_cmd.nmp
db_cmd.sig
db_conb.dat
db_dex.nmp
db_dex.sig
db_dh.dat
db_dns.nmp
db_dns.sig
db_dsign.dat
db_dyna.nmp
db_dyna.sig
db_el.dat
db_elf.nmp
db_elf.sig
db_elfa.nmp
db_elfa.sig
db_evope.dat
db_ext.dat
db_fn.nmp
db_fn.sig
db_java.nmp
db_java.sig
db_js.nmp
db_js.sig
db_mx4.nmp
db_mx4.sig
db_mx95.nmp
db_mx95.sig
db_o7.nmp
db_o7.sig
db_o7c.dat
db_o7c.map
db_ob2.dat
db_pay.dat
db_pe.nmp
db_pe.sig
db_pe3.dat
db_pph.dat
db_qcr.dat
db_sl.nmp
db_sl.sig
db_sn.nmp
db_sn.sig
db_snh.dat
db_sp.dat
db_str.nmp
db_str.sig
db_swf.nmp
db_swf.sig
db_symtrnl.dat
db_tx.dat
db_w6.nmp
db_w6.sig
db_w6c.dat
db_w6c.map
db_wat.nmp
db_wat.sig
db_wh2.dat
db_xtn.map
def.ini
engsup.exe
exts.dll
fwAux.dll
gvma64.dat
idp.dat
list_d.txt
list_i.txt
swhealthex2.dll
uiext.dll
setup.exe
product-info.xml
bug_report.exe
config.def
dump_process.exe
icarus_product.dll
product-def.xml
securebrowser_setup.exe
ecoo.edat
eref.edat
config.def
icarus_product.dll
product-info.xml
OpenSans-Bold.ttf
OpenSans-Italic.ttf
OpenSans-Light.ttf
OpenSans-Regular.ttf
RobotoCondensed-Bold.ttf
RobotoCondensed-Regular.ttf
proximanova-bold.otf
proximanova-light.otf
proximanova-regular.otf
Blocked.htm
image001.png
config.xml.ipending.c12621d1
macaddr.db.ipending.c12621d1
networks.xml.ipending.c12621d1
ports.xml.ipending.c12621d1
rules.ori
rules.xml.ipending.c12621d1
templates.xml.ipending.c12621d1
dnddetection.dat
dnddetection.dat.ver
dndrules.dat
dndrules.dat.ver
overseer_unattend.xml
profile.wprp
settings-24.7.9311.1966.ori
snx_gconfig.xml
event_manager.log
icarus.log
icarus.ini
icarus.ini
icarus.ini
icarus.ini
AvEmUpdate.log
AvEmUpdate.log
AvEmUpdate.log
1B1401C7EC8E96BC79CBFD92F9DF762D_5398732881722BDE3E78D6CA6BB2B78B
settings.dat
19f1efb3-0232-455f-a4ce-1116768e3029.tmp
AVG Secure Browser Profile.ico
Bookmarks
f_000009
f_00000c
f_00000d
f_00000e
f_00000f
f_000010
f_000012
f_000014
f_000017
f_000023
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
index
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
ai_chat.html
app.html
background.html
app.css
options.css
KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2
KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2
KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2
KFOmCnqEu92Fr1Mu4WxKOzY.woff2
KFOmCnqEu92Fr1Mu4mxK.woff2
KFOmCnqEu92Fr1Mu5mxKOzY.woff2
KFOmCnqEu92Fr1Mu72xKOzY.woff2
KFOmCnqEu92Fr1Mu7GxKOzY.woff2
KFOmCnqEu92Fr1Mu7WxKOzY.woff2
KFOmCnqEu92Fr1Mu7mxKOzY.woff2
icon_24.png
icon_64.png
icon_24.png
icon_64.png
animation.lottie.json
clear_chat.png
example_arrow.png
animation.lottie.json
clear_chat.png
example_arrow.png
ai_chat.bundle.js
background.bundle.js
background.bundle.js.LICENSE.txt
popup.bundle.js
manifest.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
background.html
chat.html
app.css
devtools.html
icon_128.png
icon_48.png
icon_128.png
icon_48.png
customize.png
search.png
x.png
customize.png
search.png
x.png
background.bundle.js
chat.bundle.js
chat.bundle.js.LICENSE.txt
devtools.bundle.js
popup.bundle.js
popup.bundle.js.LICENSE.txt
search.bundle.js
sidebar.bundle.js
sidepanel.bundle.js
manifest.json
search.html
sidebar.html
sidepanel.html
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
icon16_active.png
icon32_active.png
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
verified_contents.json
messages.json
messages.json
ccleaner.json
icon16_active.png
icon32_active.png
icon-arrow-down.svg
icon-check.svg
icon-cross.svg
icon-disabled.svg
icon-download-smaller.svg
icon-eula.svg
icon-info.svg
icon-media-audio.svg
icon-media-video.svg
icon-no-video.svg
icon-on.svg
icon-settings.svg
icon-slide-down.svg
icon-slide-up.svg
icon128.png
icon16_dark.png
icon16_light.png
icon32_dark.png
icon32_light.png
icon64.png
background.bundle.js
background.bundle.js.LICENSE.txt
content.bundle.js.LICENSE.txt
popup.bundle.js
popup.bundle.js.LICENSE.txt
manifest.json
popup.html
messages.json
verified_contents.json
content.bundle.js
fpattr.bundle.js
messages.json
verified_contents.json
messages.json
verified_contents.json
background.js
background.js.LICENSE.txt
content.js
contentAPIs.js
icon128.png
icon16-active.png
icon.png
icon.svg
icon.png
icon.svg
icon.png
icon.svg
manifest.json
overlay.js
popup.html
popup.js
messages.json
verified_contents.json
background.bundle.js
options.bundle.js.LICENSE.txt
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences~RFe5fb5cc.TMP
Secure Preferences
Secure Preferences
the-real-index
the-real-index~RFe5fce84.TMP
CURRENT
Local State
Local State
Local State
Local State
Local State
privacy-sandbox-attestations.dat
safety_tips.pb
settings.dat
settings.dat
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe57d0fc.TMP
b9daa09f-6d01-4806-a580-01f0ca0a304a.tmp
1
CURRENT
ddf1c880-002e-47aa-a65b-3c3be429c7f1.tmp
Local State
Local State
Local State
Local State
Local State
Local State
2b330b24-a2f1-43c0-8769-2a0d378b7a9e.tmp
309f2207-d7d2-45f4-89ee-dd5bbde0ec74.tmp
3cff2417-897b-41d6-a558-38347de8d9e6.tmp
55c16ad4-0079-480a-a15f-98a8466f22d4.tmp
6e120bd0-53e2-482b-86c6-a28d88759c57.tmp
6e85e9fd-723d-46bc-bf04-6047dc8561c6.tmp
9837ba29-d740-451b-9a91-41c5b44cd213.tmp
D566D7D7-DCD6-471C-8109-BE0AD33199E3
F07D8C6A-04B6-4025-869C-70A788D7B5C0
af9ccc2e-82d2-4cd5-80d3-b9b766aff1da.tmp
app3697541388997126.tmp
app520255df98e22858.tmp
AVGBrowserUpdateSetup.exe
AccessControl.dll
CR.History.tmp
CR.History.tmp
FF.places.tmp
JsisPlugins.dll
Midex.dll
StdUtils.dll
jsis.dll
nsJSON.dll
thirdparty.dll
messages.json
icon_128.png
icon_16.png
icon_32.png
icon_48.png
ai_chat.png
arrow.png
conversation_logo.gif
conversation_logo.png
genie.png
messages.png
ai_chat.bundle.js.LICENSE.txt
54a7643c-522c-447e-a62b-b0bf875a2431.tmp
messages.json
messages.json
avast.json
avira.json
icon16_active.png
icon32_active.png
content.bundle.js
icon48.png
icon.png
icon.svg
webstore.js
icon_16.png
icon_16.png
icon_64.png
ai_chat.png
amazon_music.png
apple_music.png
code.png
discord.png
evernote.png
facebook.png
genie.png
gmail.png
google_keep.png
linkedin.png
messenger.png
notion.png
onenote.png
outlook.png
selected.png
slack.png
spotify.png
teams.png
twitter.png
whatsapp.png
yahoo.png
youtube.png
youtube_music.png
background.bundle.js.LICENSE.txt
devtools.bundle.js.LICENSE.txt
the-real-index
the-real-index
index
AVG Secure Browser.lnk
Emotet.zip
Unconfirmed 116912.crdownload
Unconfirmed 210000.crdownload
Unconfirmed 243652.crdownload
Unconfirmed 261392.crdownload
Unconfirmed 334485.crdownload
Unconfirmed 361522.crdownload
Unconfirmed 393855.crdownload
Unconfirmed 473239.crdownload
Unconfirmed 552535.crdownload
Unconfirmed 562321.crdownload
Unconfirmed 585210.crdownload
Unconfirmed 59047.crdownload
Unconfirmed 603093.crdownload
Unconfirmed 691963.crdownload
Unconfirmed 728108.crdownload
Unconfirmed 742259.crdownload
Unconfirmed 749209.crdownload
Unconfirmed 844547.crdownload
Unconfirmed 948119.crdownload
Unconfirmed 948119.crdownload:SmartScreen
Unconfirmed 948379.crdownload
Zloader.xlsm
Zloader.xlsm:Zone.Identifier
aswOfferTool.exe
icarus_rvrt.exe
manifest.json
manifest.fingerprint
manifest.json
manifest.json
manifest.json
icarus.exe
bug_report.exe
dump_process.exe
gcapi.dll
icarus.exe
icarus_ui.exe
product-def.xml
setupui.cont
memory/1532-17435-0x00007FF6C1190000-0x00007FF6C272E000-memory.dmp
memory/1532-17430-0x00007FF6C1190000-0x00007FF6C272E000-memory.dmp
memory/1756-16111-0x00007FF6E6A10000-0x00007FF6E786B000-memory.dmp
memory/1756-17425-0x00007FF6E6A10000-0x00007FF6E786B000-memory.dmp
memory/3324-17449-0x00007FF6C1190000-0x00007FF6C272E000-memory.dmp
memory/3324-17447-0x00007FF6C1190000-0x00007FF6C272E000-memory.dmp
memory/5164-9865-0x00007FFE16E20000-0x00007FFE16E21000-memory.dmp
memory/5252-17616-0x0000024CB1970000-0x0000024CB2EFE000-memory.dmp
memory/5252-17594-0x0000024C96310000-0x0000024C97304000-memory.dmp
memory/6900-17623-0x000001F2E6080000-0x000001F2E6081000-memory.dmp
memory/6900-17625-0x000001F2E6080000-0x000001F2E6081000-memory.dmp
memory/6900-17628-0x000001F2E6080000-0x000001F2E6081000-memory.dmp
memory/6900-17627-0x000001F2E6080000-0x000001F2E6081000-memory.dmp
memory/6900-17617-0x000001F2E6080000-0x000001F2E6081000-memory.dmp
memory/6900-17629-0x000001F2E6080000-0x000001F2E6081000-memory.dmp
memory/6900-17618-0x000001F2E6080000-0x000001F2E6081000-memory.dmp
memory/6900-17626-0x000001F2E6080000-0x000001F2E6081000-memory.dmp
memory/6900-17619-0x000001F2E6080000-0x000001F2E6081000-memory.dmp
memory/6900-17624-0x000001F2E6080000-0x000001F2E6081000-memory.dmp
memory/7372-17448-0x00007FF6C1190000-0x00007FF6C272E000-memory.dmp
memory/7372-17450-0x00007FF6C1190000-0x00007FF6C272E000-memory.dmp
memory/7484-17445-0x00007FF6C1190000-0x00007FF6C272E000-memory.dmp
memory/7484-17446-0x00007FF6C1190000-0x00007FF6C272E000-memory.dmp
memory/7504-17687-0x0000000000400000-0x000000000056F000-memory.dmp
memory/7504-17770-0x0000000000400000-0x000000000056F000-memory.dmp
memory/7504-47753-0x0000000000400000-0x000000000056F000-memory.dmp
memory/8008-15780-0x00007FFE15300000-0x00007FFE15310000-memory.dmp
memory/8008-15781-0x00007FFE15300000-0x00007FFE15310000-memory.dmp
memory/8384-17416-0x00007FF6C1190000-0x00007FF6C272E000-memory.dmp
memory/8656-17477-0x00007FF774180000-0x00007FF774940000-memory.dmp
memory/8656-16781-0x00007FF774180000-0x00007FF774940000-memory.dmp
memory/8656-16053-0x00007FF774180000-0x00007FF774940000-memory.dmp
memory/8656-17413-0x00007FF774180000-0x00007FF774940000-memory.dmp
memory/9144-15861-0x00007FF6C1190000-0x00007FF6C272E000-memory.dmp
memory/9144-15859-0x00007FF6C1190000-0x00007FF6C272E000-memory.dmp