Analysis
- user interaction
yes - max time kernel
660s - max time network
660s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
04/05/2026, 15:59
General
- Target https://gta-5-free.net/
- Sample260504-tfftsse181
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 2 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Uses Session Manager for persistence 2 TTPs 2 IoCs
Creates Session Manager registry key to run executable early in system boot.
- Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 39 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks for any installed AV software in registry 1 TTPs 31 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 15 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 6 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 44 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 18 IoCs
- Modifies Internet Explorer settings 1 TTPs 8 IoCs
- Modifies data under HKEY_USERS 30 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 10 IoCs
- Runs regedit.exe 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gta-5-free.net/1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7fff20cfc188,0x7fff20cfc194,0x7fff20cfc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,9549420541715157673,16202403792597306229,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:32⤵
- Downloads MZ/PE file
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,1179799941135633372,3740568070544235615,262144 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,15085698987891219665,8913439972107280624,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,1763630632814804748,1291363620622883224,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,14400168915223994045,15638735171330402091,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,4682944088736751107,17889701212533412522,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,4882612483499157265,4480627585583565191,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,4512510699450730083,8884829456791416517,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,4512510699450730083,8884829456791416517,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6116,i,1136003930199847945,7804736145839412215,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6432,i,6589413220022376838,672036452132479300,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6276,i,7590461981895603350,16861107576646272673,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6220,i,8132615600509049718,3119590945470013429,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6780,i,14190218297065045655,6949905727519396637,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6844,i,13852654701753631449,13912610643681564979,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7220,i,17052757372661119498,4647639301363265819,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7048,i,9041519815979519494,9057393759801906375,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7388,i,6890427374291276547,9308869915542636929,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7524,i,10072659643888457134,7142930482160264829,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7684,i,14428086366042368678,13187468012162408989,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7700,i,10790412892946421946,6216958798981302482,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7824,i,11438782986155666504,14451583965079692244,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=8200,i,1898810332892429040,6999396888793870506,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8204 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8372,i,10384720899182530461,11985953548629922358,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8184 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8412,i,7605767395707415769,2874962278504561690,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8556 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6188,i,10757336472466880595,8355809645811084259,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6272,i,13480399945076377403,2313904928587305296,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8616,i,15597603754048313272,8740511007090207104,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8644 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8580,i,1084014345798612569,5046757033128044433,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8592 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=780,i,16531888737416403721,6895961680105660989,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,8151739634780628668,8605622780203011278,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7500,i,4804643692323754543,13562556050341841964,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5148,i,583110249948705679,14117025571795249117,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,8100576101960435362,10348347922828873087,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7488,i,10397002670321894615,17641509616585039962,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8676 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7432,i,8932747294304429912,6757860416718655980,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7124,i,8747932560410064501,1456651013311747011,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,3413741943665879597,11532441509182957763,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8072 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7852,i,17804760079420339247,10120829658480575208,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7064,i,9573696591649802215,5333233959435800747,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=4968,i,18121891245492849816,2027573771241723538,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8676 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8708,i,12266955893812630026,13491007699308698821,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,1003078629229414345,1989099645714342886,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,2931007298289516824,11681973952746430294,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8732,i,17904586449185538440,4408425853608232650,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7388,i,9075751866776305715,15026569038703551215,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=6380,i,341649497372390165,12789191051835860192,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8620,i,2666544307864151545,1215831317818211917,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7764,i,14798547759389272488,12208223844747738210,262144 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=6748,i,9450708770687869992,4686395150487866457,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8864,i,3517944637166710796,11536697119211284726,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=136 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8996,i,726147299262955193,5285401138949063448,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7776,i,5021388181114193166,10996674748552084159,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8772,i,5362408969709383625,13583680896099970572,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,404827691641942277,10820102477732378260,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8728 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,13380930581558282763,16412304130614579859,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=7504,i,15425597976186184725,2111326910514035101,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=5352,i,4538141162698200526,15641796943142296709,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8652 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=7608,i,7891475114485959509,11050620933956144520,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,5531957682479739201,14863415087577498366,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8768 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,5531957682479739201,14863415087577498366,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8768 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9012,i,8304187978610582429,9793706862156871506,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8956 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=5548,i,1995572536334519065,17091442449416947641,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=9192 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=7536,i,1760169003819375536,3153817895822845732,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9116,i,15637657943663913602,8740233146410482311,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8328 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8172,i,16647751835153737677,16882046139215720674,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=9132 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9008,i,17801689015146998225,14367287873814058922,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=3464,i,7539707648219071539,7002806891468057835,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8232,i,3550976535156594451,15898173895610577242,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=5712,i,1196308634472298677,17128455319581619916,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8360 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=4808,i,7774422751544348276,3246319987661092585,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=8856,i,14967596122967769264,219234987279550093,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=9012 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=7988,i,12255088868973692962,387144956356667335,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8716,i,10764481912576373272,7348549050287388623,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8288 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1348,i,6775694807915379667,13918259640655961539,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=1016 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,6661029706538243523,5675288433546186027,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8292 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=8468,i,286851364439083710,8246556281654422294,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=5984,i,3089740443786830732,17934462018855846304,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8124 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=8308,i,217734452291603771,4270792823157668684,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=7604,i,5279910871512343039,665398279585729167,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8340 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=5132,i,2639833237012717874,5678066216536288342,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8324 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=7880,i,15867201872477160157,14638165991077320184,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=3612,i,4641315064360125262,6135143898700976289,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,12068218619385021628,10633758344858955399,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8228 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=4236,i,6349521430070557374,2434040644758214474,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,11769869584024899883,4158751068507495084,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=9184 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=5088,i,6191687011476328541,9676165059768316224,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8896 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7544,i,17974092137418321553,436077505365689974,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\avast_secure_browser_setup.exe"C:\Users\Admin\Downloads\avast_secure_browser_setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\nsbCAEA.tmp\AvastBrowserInstaller.exe"C:\Users\Admin\AppData\Local\Temp\nsbCAEA.tmp\AvastBrowserInstaller.exe" "C:\Users\Admin\Downloads\avast_secure_browser_setup.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\nsbCAEA.tmp\AvastBrowserUpdateSetup.exeAvastBrowserUpdateSetup.exe /silent /install "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en&brand=6406&installargs= --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\GUMDC7D.tmp\AvastBrowserUpdate.exe"C:\Program Files (x86)\GUMDC7D.tmp\AvastBrowserUpdate.exe" /silent /install "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en&brand=6406&installargs= --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies"5⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /regsvc6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /regserver6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezZEMzdDNzYwLThGRUQtNDhBNS1BNEE0LUNFQzA5NUIyRDhERH0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTk5NS42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTk5NS42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0ie0Q2RjEwMkYxLUVDRDgtNDQ5Qi1CNUQzLTk0M0UzN0U1QTc4MH0iIHVzZXJpZD0iMzc4MmU1YjMwMmFjNGE3M2JmMjQ3ZGFiMjkyYzQyNWQiIG1hY2hpbmVpZD0iNDg4RENBNEMxNUY5QTFEMzMwQUQzMTJCMzkxQTgwNEVCRTUxQTYwMjIwMDYwQjYzMjQxQTJDRkNENDI2QzI2MCIgbWFjaGluZWlkX2RhdGU9IjIwMjYwNTA0IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHRlc3Rzb3VyY2U9ImF1dG8iIHJlcXVlc3RpZD0iezZFMUQyRkRGLTdBNzItNDREMi1CMzQ5LTBGQzY4RDIzMUFGQX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDQuNDUyOSIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezZEMzdDNzYwLThGRUQtNDhBNS1BNEE0LUNFQzA5NUIyRDhERH0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xOTk1LjYiIGxhbmc9ImVuIiBicmFuZD0iNjQwNiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNTE0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /handoff "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en&brand=6406&installargs= --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies" /installsource otherinstallcmd /sessionid "{D6F102F1-ECD8-449B-B5D3-943E37E5A780}" /silent6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exeAvastBrowser.exe --heartbeat --install --create-profile4⤵
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=146.0.34394.179 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffefe00b1d0,0x7ffefe00b1dc,0x7ffefe00b1e85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1856,i,17082661972124363318,6039840151213040870,262144 --field-trial-handle=2064,i,556004385719461089,15739088878624419412,262144 --variations-seed-version --pseudonymization-salt-handle=2068,i,12413764047755999689,2211985181520248794,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2060 /prefetch:25⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2100,i,17301695627811019643,15318596939855421049,524288 --field-trial-handle=2064,i,556004385719461089,15739088878624419412,262144 --variations-seed-version --pseudonymization-salt-handle=2068,i,12413764047755999689,2211985181520248794,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2200 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2464,i,14960766859699664528,17817234987850201917,524288 --field-trial-handle=2064,i,556004385719461089,15739088878624419412,262144 --variations-seed-version --pseudonymization-salt-handle=2068,i,12413764047755999689,2211985181520248794,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2312 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2988,i,16502035245177638070,16148910277455564635,2097152 --field-trial-handle=2064,i,556004385719461089,15739088878624419412,262144 --variations-seed-version --pseudonymization-salt-handle=2068,i,12413764047755999689,2211985181520248794,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3024 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=4120,i,6337363360315653122,9342672928771220954,2097152 --field-trial-handle=2064,i,556004385719461089,15739088878624419412,262144 --variations-seed-version --pseudonymization-salt-handle=2068,i,12413764047755999689,2211985181520248794,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4152 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4328,i,3348760334008620699,8142835415950895022,2097152 --field-trial-handle=2064,i,556004385719461089,15739088878624419412,262144 --variations-seed-version --pseudonymization-salt-handle=2068,i,12413764047755999689,2211985181520248794,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4436 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4356,i,15063297497301220868,698682319380457761,2097152 --field-trial-handle=2064,i,556004385719461089,15739088878624419412,262144 --variations-seed-version --pseudonymization-salt-handle=2068,i,12413764047755999689,2211985181520248794,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4456 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4396,i,1549700102571639061,9442275777232562122,2097152 --field-trial-handle=2064,i,556004385719461089,15739088878624419412,262144 --variations-seed-version --pseudonymization-salt-handle=2068,i,12413764047755999689,2211985181520248794,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4476 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=4680,i,13847960712156525579,7018168469347238490,524288 --field-trial-handle=2064,i,556004385719461089,15739088878624419412,262144 --variations-seed-version --pseudonymization-salt-handle=2068,i,12413764047755999689,2211985181520248794,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4800 /prefetch:85⤵
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exeAvastBrowser.exe --silent-launch4⤵
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=146.0.34394.179 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffefe00b1d0,0x7ffefe00b1dc,0x7ffefe00b1e85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1876,i,9181949804635669380,4354173647513030330,262144 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2032 /prefetch:25⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2072,i,10209131091403507780,4541510243424038386,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2204 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,7944223044439993798,9435264274071068580,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2540 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2956,i,1611620400520635738,15328731087380318745,2097152 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3692 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=micro_av.mojom.MicroAVService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=3696,i,12597936337104441778,4277871845892331444,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3844 /prefetch:85⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3956,i,5156090494992205803,5946727571810823418,2097152 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3916 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4000,i,16042817869467835813,5024746593011894625,2097152 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4088 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4064,i,5021502199093136978,2083281566871248108,2097152 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4100 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4020,i,4729602235970393023,4611430893368989772,2097152 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3888 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=4940,i,2819291285842163388,11052889784161928253,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4932 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=4952,i,13475948014978348258,2645709129256785393,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5112 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,18311933847601786322,3802511520928716319,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5732 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,13108165636690328028,10688642112651889605,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5724 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,11297874232596829349,17004095356499470761,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5824 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,16212593477180137266,11235592928505285646,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=3152 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=3212,i,8517327905098241258,17258211648891963742,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5880 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6028,i,16602928681684060702,417185672149460177,2097152 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6136 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,14776000053586134046,15902048697168922546,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6244 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,11251454232778254209,7773366589002889324,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6256 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=6232,i,7749198943836833249,4699828811572869004,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6584 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=6400,i,6300326847974121358,5990696456352260283,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6736 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6956,i,11597941458563566695,233549664724470649,2097152 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7040 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6996,i,18236525789513330295,1384812616144677240,2097152 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7060 /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=7276,i,9683105125719159050,12488963374775910855,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7296 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=6420,i,9467672689473782339,13102542752655303622,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7448 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=6576,i,1196868132247665221,4143665716761426463,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7600 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=7772,i,11287164703484400785,5689436510144690303,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=7752 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=7440,i,9196842395933841113,7703152936182125428,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7924 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=7932,i,5463944173664025333,7624517436138595739,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7944 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=7592,i,12111408303071219053,9806085359740031909,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8196 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=8404,i,4241142115235578561,17282091358992354715,2097152 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=8440 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=8564,i,17038069842402425061,17873724961146905717,524288 --field-trial-handle=2036,i,5698605752656921596,17469668423800733547,262144 --variations-seed-version --pseudonymization-salt-handle=2040,i,17330461534615245303,418502528615276907,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=6724 /prefetch:85⤵
-
-
-
C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\Installer\setup.exesetup.exe /silent --create-shortcuts=0 --install-level=1 --system-level4⤵
- Drops file in Windows directory
-
C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\Installer\setup.exe"C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=146.0.34394.179 --attachment=C:\Windows\SystemTemp\AvastBrowser_installer.log --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff7308cd958,0x7ff7308cd964,0x7ff7308cd9705⤵
- Drops file in Windows directory
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk"5⤵
- Checks computer location settings
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /tn "AvastDefaultBrowserTask" /tr "\"C:\Program Files\AVAST Software\Browser\Application\AvastBrowserProtect.exe\" --runonce --force" /sc once /st "17:08" /F4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /tn "AvastDefaultBrowserTask2" /tr "\"C:\Program Files\AVAST Software\Browser\Application\AvastBrowserProtect.exe\" --runonce --force" /sc once /st "17:12" /F4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exeAvastBrowser.exe --check-run=src=installer --start-maximized4⤵
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=146.0.34394.179 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffefe00b1d0,0x7ffefe00b1dc,0x7ffefe00b1e85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1856,i,2430324361479181353,17465743004417754818,524288 --field-trial-handle=2124,i,3174335402500898147,15396512370408781276,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,14475822129116121723,15680374703333009120,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2156 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,2704487690607413622,13663967387438288002,262144 --field-trial-handle=2124,i,3174335402500898147,15396512370408781276,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,14475822129116121723,15680374703333009120,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2120 /prefetch:25⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2472,i,13448735717547102258,5141868101771563915,524288 --field-trial-handle=2124,i,3174335402500898147,15396512370408781276,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,14475822129116121723,15680374703333009120,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2592 /prefetch:85⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3404,i,1367177341411407626,9791561034712244820,2097152 --field-trial-handle=2124,i,3174335402500898147,15396512370408781276,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,14475822129116121723,15680374703333009120,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3400 /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3416,i,10231750522931912503,16763109019402117531,2097152 --field-trial-handle=2124,i,3174335402500898147,15396512370408781276,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,14475822129116121723,15680374703333009120,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3508 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4020,i,15160112867398450696,12490458137893739194,2097152 --field-trial-handle=2124,i,3174335402500898147,15396512370408781276,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,14475822129116121723,15680374703333009120,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4064 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=micro_av.mojom.MicroAVService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4672,i,17745169484718309143,12956147464500708682,524288 --field-trial-handle=2124,i,3174335402500898147,15396512370408781276,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,14475822129116121723,15680374703333009120,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4784 /prefetch:85⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4552,i,2891846900438359782,12484066192384792494,2097152 --field-trial-handle=2124,i,3174335402500898147,15396512370408781276,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,14475822129116121723,15680374703333009120,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4764 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4716,i,17735010849116531380,8146568225880431731,2097152 --field-trial-handle=2124,i,3174335402500898147,15396512370408781276,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,14475822129116121723,15680374703333009120,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4676 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5204,i,9261865257897235085,13943138303761372465,2097152 --field-trial-handle=2124,i,3174335402500898147,15396512370408781276,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,14475822129116121723,15680374703333009120,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5388 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5356,i,4714253574852706075,17573950059371414752,2097152 --field-trial-handle=2124,i,3174335402500898147,15396512370408781276,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,14475822129116121723,15680374703333009120,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5456 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5320,i,1776017872697277718,18021139643013925287,2097152 --field-trial-handle=2124,i,3174335402500898147,15396512370408781276,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,14475822129116121723,15680374703333009120,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5428 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5500,i,1316237013576000074,6568209524225470601,2097152 --field-trial-handle=2124,i,3174335402500898147,15396512370408781276,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,14475822129116121723,15680374703333009120,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5568 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5496,i,5673572239667096495,885927433672023790,2097152 --field-trial-handle=2124,i,3174335402500898147,15396512370408781276,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,14475822129116121723,15680374703333009120,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5888 /prefetch:25⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,15427921156487611869,3883498805288193032,524288 --field-trial-handle=2124,i,3174335402500898147,15396512370408781276,262144 --variations-seed-version --pseudonymization-salt-handle=2128,i,14475822129116121723,15680374703333009120,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=4704 /prefetch:85⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=6616,i,7770489872003905386,17664000746839574404,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8504 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=3452,i,1767725089880399403,5944278887534877541,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=3708,i,16666878586220586343,3870829441530520904,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=6916,i,945725751873945468,6247166702505329437,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8364 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=6576,i,9002919729230629357,6757639243638046786,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=9248,i,1894313202878716313,5396037684365343696,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=9256 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=9396,i,10414635329132442087,270574415056216966,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=9412 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=9540,i,16349913147176399066,2214098339882536245,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=9548 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=9688,i,1614955151715355615,17919160060599288187,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=9704 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=9924,i,2302624232237403381,15693112311067360698,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=9952 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=10084,i,13568488677548090620,13757835670189907429,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10100 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=10232,i,6138080005194858610,5171777600176096868,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10248 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=10384,i,8854332264339475947,13612741668036577015,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10396 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=10560,i,14810512779038635985,11947053335996535921,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10564 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=10680,i,18278787665545022381,7901825724153574804,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10696 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=10908,i,2402911145483255057,8149498643810290168,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10892 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=11072,i,17456226129225288883,12241246875618597115,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=11204,i,17702126557791154239,5019089271532972683,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=11220 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=11364,i,14769239725016910699,2356803611250817149,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=11380 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=11512,i,14174045958439148202,1181999242490538696,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=11528 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=11684,i,5210238199027018313,16369848697164337028,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8944 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=10256,i,13539522361033380646,8388997137399325772,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=11720 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=9240,i,8427405133735147200,3556393572945995514,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10084 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9404,i,10278685885347984853,16579872883641912792,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=9916 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9404,i,10278685885347984853,16579872883641912792,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=9916 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=7628,i,12539669540331542804,17746124605676087661,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=11396 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=10224,i,15549031131714631387,14874377384396507807,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10256 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=10048,i,5528879670858095083,15708530342216135978,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10056 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=9980,i,12340308700101136160,2686155206671665891,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=6964,i,1847884147809580535,16089260013642993807,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=9576,i,7352487455619723559,7886890580379148264,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=9588 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=10472,i,9434291271011827422,5142028798604653366,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10512 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=10524,i,9699460995321422819,9133609965779070396,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=9136 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10912,i,10246849141605937281,1693227156766003196,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10040 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3380,i,7180332316735195779,3766170807587824984,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10704 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3380,i,7180332316735195779,3766170807587824984,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10704 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=8480,i,4458070018654519272,10397709423217265879,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=11044 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,4001012991066922036,4660418536396864162,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,4001012991066922036,4660418536396864162,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --metrics-shmem-handle=9120,i,14314192278682500861,13041857181981045280,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10044 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,14389645520335616743,23396745488338638,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,14389645520335616743,23396745488338638,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --always-read-main-dll --metrics-shmem-handle=7852,i,15735091952707712997,767610565141013082,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --always-read-main-dll --metrics-shmem-handle=10460,i,10208048157861435238,1894218845893364060,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --always-read-main-dll --metrics-shmem-handle=9992,i,7889031116115755208,14979418278727505774,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=9544 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --always-read-main-dll --metrics-shmem-handle=1344,i,4576514976845514011,12972904552343347130,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10388 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,7489728976956020976,9473981063482065216,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --always-read-main-dll --metrics-shmem-handle=10520,i,7990423031238527268,3158371662198991733,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --always-read-main-dll --metrics-shmem-handle=11832,i,15751661232678590609,16493995014073027605,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --always-read-main-dll --metrics-shmem-handle=11788,i,5570508790430693938,12966142088707164700,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --always-read-main-dll --metrics-shmem-handle=9240,i,9683717078012246876,12284779785119712512,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=11860 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --always-read-main-dll --metrics-shmem-handle=9400,i,4860315056459590154,10010555518427860876,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8264 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --always-read-main-dll --metrics-shmem-handle=7484,i,11114361773663121079,14802699956046251821,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --always-read-main-dll --metrics-shmem-handle=10040,i,9159061383649608356,1104351431696042636,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --always-read-main-dll --metrics-shmem-handle=4976,i,16102071994924758874,7961245824122405600,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --always-read-main-dll --metrics-shmem-handle=9316,i,18144847553107692754,6303617234648632389,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8264 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=144 --always-read-main-dll --metrics-shmem-handle=6452,i,14505437556686828395,5965832984203370391,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=11664 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=145 --always-read-main-dll --metrics-shmem-handle=10004,i,2699658868067447592,363738421645490764,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=146 --always-read-main-dll --metrics-shmem-handle=6280,i,7302192988497223902,4637751928980548002,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=147 --always-read-main-dll --metrics-shmem-handle=7964,i,6388992049828227612,5495163049058192584,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10848,i,16748047476625912125,11725061326388791344,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8916 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=149 --always-read-main-dll --metrics-shmem-handle=8932,i,3588726607861538672,2324338154135826177,2097152 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=11804 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,11112664301151182288,2816984844647446978,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=8228 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10484,i,17514523774307974585,13138246128410032678,524288 --field-trial-handle=2288,i,3818717687352661348,7202165697528525771,262144 --variations-seed-version --mojo-platform-channel-handle=10444 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /svc1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{B6DCFED5-B202-4B00-83DB-65AEFFBCF63F}\AvastBrowserInstaller.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{B6DCFED5-B202-4B00-83DB-65AEFFBCF63F}\AvastBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=msedge --import-cookies --system-level2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{B6DCFED5-B202-4B00-83DB-65AEFFBCF63F}\CR_DA6C5.tmp\setup.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{B6DCFED5-B202-4B00-83DB-65AEFFBCF63F}\CR_DA6C5.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{B6DCFED5-B202-4B00-83DB-65AEFFBCF63F}\CR_DA6C5.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=msedge --import-cookies --system-level3⤵
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
-
C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{B6DCFED5-B202-4B00-83DB-65AEFFBCF63F}\CR_DA6C5.tmp\setup.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\Install\{B6DCFED5-B202-4B00-83DB-65AEFFBCF63F}\CR_DA6C5.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=146.0.34394.179 --attachment=C:\Windows\SystemTemp\AvastBrowser_installer.log --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff609f5d958,0x7ff609f5d964,0x7ff609f5d9704⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Program Files\AVAST Software\Browser\Temp\source7024_281791705\Safer-bin\micro_av_vps_online_setup.exe"C:\Program Files\AVAST Software\Browser\Temp\source7024_281791705\Safer-bin\micro_av_vps_online_setup.exe" /silent4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw-adab80d8-0634-472e-863b-f1ca377974a3\common\icarus.exeC:\Windows\Temp\asw-adab80d8-0634-472e-863b-f1ca377974a3\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-adab80d8-0634-472e-863b-f1ca377974a3\icarus-info.xml /install /silent5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Temp\asw-adab80d8-0634-472e-863b-f1ca377974a3\avast-av-vps\icarus.exeC:\Windows\Temp\asw-adab80d8-0634-472e-863b-f1ca377974a3\avast-av-vps\icarus.exe /silent /er_master:master_ep_c0e7ce3c-45fd-42f2-90aa-881452c62b6b /er_slave:avast-av-vps_slave_ep_28afb31e-4bf0-4de4-b9e9-9c77901edc2e /slave:avast-av-vps6⤵
- Uses Session Manager for persistence
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\AVAST Software\Browser\Application\defs\26050404\engsup.exe"C:\Program Files\AVAST Software\Browser\Application\defs\26050404\engsup.exe" /prepare_definitions_folder7⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Program Files\AVAST Software\Browser\Application\vps_helper.exe"C:\Program Files\AVAST Software\Browser\Application\vps_helper.exe" --install4⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserCrashHandler.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserCrashHandler.exe"2⤵
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserCrashHandler64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserCrashHandler64.exe"2⤵
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=146.0.34394.179 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffefe00b1d0,0x7ffefe00b1dc,0x7ffefe00b1e82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,4010964176613582368,8610415111232156183,524288 --field-trial-handle=2024,i,14481286594676330175,7408901557517743044,262144 --variations-seed-version --pseudonymization-salt-handle=2144,i,8342498344145647335,8397806559113091972,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1856,i,3067997401437896929,5498289118003010184,262144 --field-trial-handle=2024,i,14481286594676330175,7408901557517743044,262144 --variations-seed-version --pseudonymization-salt-handle=2144,i,8342498344145647335,8397806559113091972,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2020 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2488,i,6550404554814969391,10476536477476468872,524288 --field-trial-handle=2024,i,14481286594676330175,7408901557517743044,262144 --variations-seed-version --pseudonymization-salt-handle=2144,i,8342498344145647335,8397806559113091972,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2596 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3304,i,11028861063655128648,8571853937979455505,2097152 --field-trial-handle=2024,i,14481286594676330175,7408901557517743044,262144 --variations-seed-version --pseudonymization-salt-handle=2144,i,8342498344145647335,8397806559113091972,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3616 /prefetch:22⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3632,i,4002222335901299496,13143007382925150171,2097152 --field-trial-handle=2024,i,14481286594676330175,7408901557517743044,262144 --variations-seed-version --pseudonymization-salt-handle=2144,i,8342498344145647335,8397806559113091972,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3652 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4004,i,4952368319353878675,2425271343088808669,2097152 --field-trial-handle=2024,i,14481286594676330175,7408901557517743044,262144 --variations-seed-version --pseudonymization-salt-handle=2144,i,8342498344145647335,8397806559113091972,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4024 /prefetch:22⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=4488,i,11090082293472050161,7248200485522776113,524288 --field-trial-handle=2024,i,14481286594676330175,7408901557517743044,262144 --variations-seed-version --pseudonymization-salt-handle=2144,i,8342498344145647335,8397806559113091972,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4500 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=4604,i,15347403599699966299,4234690000333538292,524288 --field-trial-handle=2024,i,14481286594676330175,7408901557517743044,262144 --variations-seed-version --pseudonymization-salt-handle=2144,i,8342498344145647335,8397806559113091972,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4608 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,10168423131017988734,11465782922487476399,524288 --field-trial-handle=2024,i,14481286594676330175,7408901557517743044,262144 --variations-seed-version --pseudonymization-salt-handle=2144,i,8342498344145647335,8397806559113091972,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4496 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4724,i,12955416896185619744,853572091505484986,524288 --field-trial-handle=2024,i,14481286594676330175,7408901557517743044,262144 --variations-seed-version --pseudonymization-salt-handle=2144,i,8342498344145647335,8397806559113091972,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4692 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\vps_helper.exe"C:\Program Files\AVAST Software\Browser\Application\vps_helper.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --check-run=src=logon --auto-launch-at-startup --profile-directory="Default"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=146.0.34394.179 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffefe00b1d0,0x7ffefe00b1dc,0x7ffefe00b1e82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,6837016699129873188,8283498534666299369,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Executes dropped EXE
- System Time Discovery
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,11478297961953588789,3052724975583932885,262144 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2128 /prefetch:22⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2484,i,4862023036266174910,8862219152586211631,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2576 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3356,i,4329435788882312715,3317993352119770944,2097152 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3400 /prefetch:12⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3364,i,10832846937668590690,3611764129955871933,2097152 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3432 /prefetch:22⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=micro_av.mojom.MicroAVService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3988,i,13443599697632472569,14864123356776461043,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4112 /prefetch:82⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4748,i,7098698470284955763,3119691654216056853,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4756 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4956,i,7026077784385976057,2346163387470169299,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4968 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5132,i,607886040610147035,14858913914674478533,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5144 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4948,i,50976811720136379,2014281153641106255,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5172 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,6407026676657750306,12403113964092080619,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5544 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,11229201163475076816,1726082584894843737,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6072 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6400,i,1302957835941500805,4153176158583050443,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6376 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6664,i,17959350977245083005,14954019801853062096,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6692 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6676,i,5713397788900720773,16641705527078406442,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6712 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6716,i,9213891498411582158,11461502104399358433,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6992 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6392,i,15000277742820794706,15655635533852623569,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=7388 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,6769703910729752704,9922118826571547652,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=7528 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4224,i,16665849824275967947,879643277960171813,2097152 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=7700 /prefetch:22⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,12636613155594923631,1201097418332320891,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=5152 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6984,i,13926540381687043434,15167942267346004340,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=5804 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7380,i,7994533643737649388,4945806230264773726,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=3100 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7852,i,7545610630790828463,8872700017555698807,2097152 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7880 /prefetch:22⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3228,i,8170852778115943759,2933443228939232805,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=8020 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3832,i,5763058611440814165,8469307142159360404,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=8040 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8284,i,10216719103403857741,1413033403026767181,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=8308 /prefetch:82⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=8476,i,3637953274849599100,4771593497457922590,2097152 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=8504 /prefetch:22⤵
- Checks computer location settings
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3120,i,6223718125077927572,3476774884810476714,524288 --field-trial-handle=2132,i,13252695553947117584,3968278557844301441,262144 --variations-seed-version --pseudonymization-salt-handle=2136,i,17658088970538652198,9486111332860775469,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=3932 /prefetch:82⤵
-
-
C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\elevation_service.exe"1⤵
-
C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\elevation_service.exe"1⤵
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowserProtect.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowserProtect.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\elevation_service.exe"C:\Program Files\AVAST Software\Browser\Application\146.0.34394.179\elevation_service.exe"1⤵
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowserProtect.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowserProtect.exe" --runonce --force1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7c23fc1b-4cf0-4648-9175-efdde974ed67_100SavegamebyLazicNikola.zip.d67\ReadMe!.txt1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SecurityHealthHost.exeC:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exeC:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exeC:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /ua /installsource scheduler1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /registermsihelper2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /c1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /cr2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserCrashHandler.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserCrashHandler.exe"2⤵
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserCrashHandler64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1995.6\AvastBrowserCrashHandler64.exe"2⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /svc1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"1⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
5Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
8Software Discovery
1Security Software Discovery
1System Information Discovery
8System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e617409.rbs
@PaxHeader
@PaxHeader
ArPot.dll
ArPotEx32.dll
ArPotEx64.dll
BCUEngine.dll
PushPin.dll
Sf2.dll
algo64.dll
aswAR.dll
aswArray.dll
aswBoot64.dll
aswCleanerDLL.dll
aswCmnBS.dll
aswCmnIS64.dll
aswCmnOS.dll
aswEngin.dll
aswFiDb.dll
aswHds.dll
aswJsFlt.dll
aswJsFlt64.dll
aswQcr.dll
aswRawFS264.dll
aswRawFS64.dll
aswRep.dll
aswScan.dll
certs.map
db_agdx.dat
db_ap2.dat
db_array.dat
db_as.dat
db_bank.dat
db_cf.dat
db_cmd.nmp
db_cmd.sig
db_conb.dat
db_dex.nmp
db_dex.sig
db_dh.dat
db_dns.nmp
db_dns.sig
db_dsign.dat
db_dyna.nmp
db_dyna.sig
db_el.dat
db_elf.nmp
db_elf.sig
db_elfa.nmp
db_elfa.sig
db_evoapk.dat
db_evope.dat
db_ext.dat
db_fn.nmp
db_fn.sig
db_java.nmp
db_java.sig
db_js.nmp
db_js.sig
db_med.nmp
db_med.sig
db_mu.dat
db_mx4.nmp
db_mx4.sig
db_mx95.nmp
db_mx95.sig
db_o7.nmp
db_o7.sig
db_o7c.dat
db_o7c.map
db_ob2.dat
db_pay.dat
db_pdf.mml
db_pe.nmp
db_pe.sig
db_pe3.dat
db_pph.dat
db_qcr.dat
db_sl.nmp
db_sl.sig
db_sn.nmp
db_sn.sig
db_snh.dat
db_sp.dat
db_str.nmp
db_str.sig
db_swf.nmp
db_swf.sig
db_symtrnl.dat
db_tlsh.dat
db_tx.dat
db_w6.nmp
db_w6.sig
db_w6c.dat
db_w6c.map
db_wat.nmp
db_wat.sig
db_wh2.dat
db_xtn.map
def.ini
engsup.exe
exts.dll
fwAux.dll
gvma64.dat
idp.dat
list_d.txt
list_i.txt
swhealthex2.dll
uiext.dll
micro_av_vps_online_setup.exe
icarus.log
icarus.ini
icarus.ini
settings.dat
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
data_0
data_1
data_2
data_3
verified_contents.json
icon16.png
webstore.js
messages.json
options.html
popup.html
background.js
manifest.json
messages.json
background.bundle.js
options.bundle.js.LICENSE.txt
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe5d982c.TMP
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences~RFe5d7e99.TMP
Secure Preferences
Secure Preferences
Secure Preferences
Secure Preferences
Secure Preferences~RFe5d9202.TMP
index.txt
index.txt~RFe5d9202.TMP
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5d9202.TMP
a308131d-161d-4693-b1cc-846388970d1c.tmp
000003.log
Last Version
Local State
Local State
Local State
Local State
Local State~RFe5d7e7a.TMP
Variations
Variations
settings.dat
settings.dat
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_0000c0
f_0000d6
f_0000d8
f_0000d9
f_0000da
f_0000db
f_000131
f_000132
f_000133
f_000134
f_000135
f_000136
f_000171
f_000172
f_000174
f_000179
f_000182
f_000196
f_0001ba
f_0001c5
f_0001c9
f_0001d2
f_0001e2
f_0001e3
f_0001e4
f_0001ec
f_00026d
0c7a1f77610f8fd4_0
11164e41198b99b0_0
14ff8116b518ca2d_0
18c35b252ffa1dd1_0
1f974568b3b7eb41_0
22de86f3811d6c9d_0
22fdddfc706f20b8_0
2522b2aec3402da2_0
25c90b4fb1c6ef85_0
2692617678c042d9_0
2aab43fa7314a885_0
2e7c1637321ce6d7_0
2f4680e8f8f8a14f_0
39604e74e0d73218_0
39a5e623cac641bd_0
3a4259a0181983ba_0
3c8b7cdee06d04e4_0
3f1ba1f10af202d4_0
430b4920c5628de1_0
45a16ff6d0d9ab5f_0
46896cb801a23b9d_0
4e9b18b0f66a7183_0
4ff4b179c1c05fed_0
53ac5abc87e80789_0
61ca0fdf11877794_0
62630ccb9735e330_0
635e64b37935c888_0
67dd344f589cdacc_0
69a25a89e58d653c_0
6adaaccfc08d2f50_0
704d49ab495ef63d_0
73d0ace21c5229c3_0
7428ad41cfa01d12_0
7577df33ecf99632_0
763b7215f85fe6ca_0
7d95978cc7e511bb_0
8497e357335b0a87_0
8baa13f7b32fb253_0
8e5987d08f7b6e11_0
90d7d7591a1b39bb_0
92ea216a4e512cc9_0
96bc766215a93e35_0
9baee1276a791cac_0
9dbb949d27873cbc_0
9edf030ba80cedb8_0
aa88896a694d6ae7_0
af2cfcaf6d9b18bc_0
cd8d54fb899d0922_0
d0fa80d4db2d38ea_0
d45aae6d8d9c9ff2_0
d79e0a2891fc014a_0
de8842b625efa9e1_0
df5c6eb4ec43d19c_0
e3631bbaf3cd3cc0_0
e6e93144ebbfec47_0
e8c8218aef51a783_0
e9c7e700cc3e33cf_0
ed2bce91487b3a82_0
ed712d4b652882fb_0
f2a9811701c7f2ef_0
f2e4bbad99a372cc_0
f5345f974401453e_0
f865bc326ea943ec_0
fba70601e366e640_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58aab2.TMP
SiteList-Enterprise.json
HubApps
000003.log
LOG
MANIFEST-000001
000003.log
LOG
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5a4b72.TMP
index
index.txt
index.txt
index.txt
index.txt~RFe59d8e2.TMP
the-real-index
the-real-index~RFe595431.TMP
the-real-index
the-real-index~RFe593a11.TMP
4f2277ea2139c475_0
the-real-index
the-real-index
the-real-index~RFe59477f.TMP
index.txt
index.txt
the-real-index
the-real-index
the-real-index
the-real-index~RFe594fdb.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
the-real-index
the-real-index~RFe59e44b.TMP
index.txt
index.txt
index.txt
index.txt
domain_actions.dll
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe584949.TMP
Ruleset Data
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
64bd07ec-f5a8-47d9-95c1-da80ec880acc.tmp
ad610009-1e7e-4232-b857-f9ea44a18240.tmp
ad724c37-fd3a-4c94-a257-ebf002bc8aaf.tmp
c5a37923-e211-490d-a71b-ecae8c227d68.tmp
cd7a8172-d53b-4ad2-951c-52ddad15f53e.tmp
d41dc80d-cf8d-4d33-abcd-f5ea53aebf87.tmp
messages.json
messages.json
messages.json
antiPhishingManagerCS.js
dbd3538b1156b7e72f803ebafa910cc3.svg
e1ea737a660bdee28b836f9923b87295.svg
e37aad4c5220edaeeb9e6544071aaeb3.svg
content.css
icon16.png
contentScript.js
fonts.css
uk.svg
MyButton-D9TMEXXB.css
content-script.js-a8PnzBQ-.js
games-DQHT73Kz.svg
messages.json
content.bundle.js
popup.bundle.js
contentScript.js
16x.png
32x.png
48x.png
popup.css
messages.json
content.css
black_disabled_16.png
black_disabled_32.png
icon128.png
icon16.png
content.js
EulaPopupCS.js.LICENSE.txt
alert.svg
alert.svg
audio.svg
camera.svg
no-video-illustration.svg
status_ok.svg
tooltip.svg
ic-24-checkbox-checked.svg
info.svg
disabled-checkbox.svg
no-video-illustration.svg
plain-cross.svg
tooltip.svg
logo.svg
status_info.svg
status_ok.svg
iframePopupCS.js
sandbox.js.LICENSE.txt
videoDownloaderCS.js
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
100SavegamebyLazicNikola.zip.crdownload
avast_secure_browser_setup.exe.crdownload
e617406.msi
miniwallet.bundle.js.LICENSE.txt
notification.bundle.js.LICENSE.txt
strings.json
edge_checkout_page_validator.js
memory/1268-5183-0x0000026609490000-0x00000266094E5000-memory.dmp
memory/1452-5238-0x00007FFF31170000-0x00007FFF31171000-memory.dmp
memory/1452-5239-0x00007FFF300B0000-0x00007FFF300B1000-memory.dmp
memory/1884-4589-0x0000000002DA0000-0x0000000002DFF000-memory.dmp
memory/2136-5740-0x000001D3E0F30000-0x000001D3E0F3C000-memory.dmp
memory/2136-5738-0x000001D3E0F50000-0x000001D3E10EF000-memory.dmp
memory/2136-5221-0x00007FFF30F60000-0x00007FFF30F61000-memory.dmp
memory/2180-4585-0x0000000003090000-0x00000000030EF000-memory.dmp
memory/2572-4622-0x0000000000CA0000-0x0000000000CFF000-memory.dmp
memory/2632-5698-0x0000026EA9060000-0x0000026EA9110000-memory.dmp
memory/2736-4588-0x000001A490C20000-0x000001A490C75000-memory.dmp
memory/3496-4591-0x00000000022F0000-0x000000000234F000-memory.dmp
memory/3620-8485-0x000001AB64C40000-0x000001AB64C4C000-memory.dmp
memory/3764-5309-0x00000214378D0000-0x0000021437925000-memory.dmp
memory/3844-363-0x000002A111340000-0x000002A111395000-memory.dmp
memory/3852-8605-0x00000000022B0000-0x000000000230F000-memory.dmp
memory/3852-4628-0x00000000022B0000-0x000000000230F000-memory.dmp
memory/4040-5921-0x0000025B0A470000-0x0000025B0A47C000-memory.dmp
memory/4264-4621-0x0000000002090000-0x00000000020EF000-memory.dmp
memory/4840-5196-0x000001EA91BD0000-0x000001EA91C25000-memory.dmp
memory/5084-4586-0x00000175782E0000-0x0000017578335000-memory.dmp
memory/5316-6831-0x0000000003760000-0x00000000037DD000-memory.dmp
memory/5316-5611-0x0000000000DE0000-0x0000000000DE8000-memory.dmp
memory/5316-5614-0x00000000037F0000-0x0000000003818000-memory.dmp
memory/5316-5613-0x00000000037E0000-0x00000000037F0000-memory.dmp
memory/5316-5612-0x0000000003760000-0x00000000037DD000-memory.dmp
memory/5316-6829-0x0000000002F20000-0x0000000002F7F000-memory.dmp
memory/5316-5610-0x0000000002F20000-0x0000000002F7F000-memory.dmp
memory/5316-6832-0x00000000037E0000-0x00000000037F0000-memory.dmp
memory/5316-6833-0x00000000037F0000-0x0000000003818000-memory.dmp
memory/5320-4593-0x0000000002B90000-0x0000000002BEF000-memory.dmp
memory/5392-4627-0x0000000002D40000-0x0000000002D9F000-memory.dmp
memory/5392-8611-0x0000000002D40000-0x0000000002D9F000-memory.dmp
memory/5460-8609-0x00000000024E0000-0x0000000002508000-memory.dmp
memory/5460-8606-0x0000000001BF0000-0x0000000001C4F000-memory.dmp
memory/5460-4630-0x00000000023F0000-0x000000000246D000-memory.dmp
memory/5460-4629-0x0000000001BF0000-0x0000000001C4F000-memory.dmp
memory/5460-4782-0x00000000023C0000-0x00000000023C8000-memory.dmp
memory/5460-8608-0x00000000023A0000-0x00000000023B0000-memory.dmp
memory/5460-8607-0x00000000023F0000-0x000000000246D000-memory.dmp
memory/5460-4631-0x00000000023A0000-0x00000000023B0000-memory.dmp
memory/5460-4632-0x00000000024E0000-0x0000000002508000-memory.dmp
memory/5576-6158-0x0000024B4DC20000-0x0000024B4DC2C000-memory.dmp
memory/5624-4590-0x0000000002A70000-0x0000000002ACF000-memory.dmp
memory/5776-4587-0x00000185BE760000-0x00000185BE7B5000-memory.dmp
memory/5944-8534-0x000001CB63DA0000-0x000001CB63DF5000-memory.dmp
memory/5944-6825-0x000001CB63DA0000-0x000001CB63DF5000-memory.dmp
memory/6056-4626-0x0000000000CB0000-0x0000000000D0F000-memory.dmp
memory/6056-8613-0x0000000000CB0000-0x0000000000D0F000-memory.dmp
memory/6364-6816-0x0000021059360000-0x0000021059410000-memory.dmp
memory/6800-5187-0x000001FDBB600000-0x000001FDBB655000-memory.dmp
memory/6812-5615-0x000002C7ADFC0000-0x000002C7AE015000-memory.dmp
memory/6812-6812-0x000002C7ADFC0000-0x000002C7AE015000-memory.dmp
memory/6812-6824-0x000002C7ADFC0000-0x000002C7AE015000-memory.dmp
memory/7024-5148-0x000002598B900000-0x000002598B955000-memory.dmp
memory/7040-5149-0x00000184D49C0000-0x00000184D4A15000-memory.dmp
memory/7104-5150-0x0000013609F40000-0x0000013609F95000-memory.dmp
memory/7148-5341-0x0000017738740000-0x0000017738795000-memory.dmp
memory/7728-8531-0x00000198591D0000-0x00000198591DC000-memory.dmp
memory/8084-8524-0x000001775D450000-0x000001775D5EF000-memory.dmp
memory/8084-8525-0x000001775C680000-0x000001775C68C000-memory.dmp
memory/8172-6841-0x0000025700B80000-0x0000025700BD5000-memory.dmp
memory/8532-8533-0x000001B5833D0000-0x000001B5833DC000-memory.dmp
memory/8568-8532-0x0000024052FA0000-0x0000024052FAC000-memory.dmp