Analysis
- user interaction
yes - max time kernel
570s - max time network
572s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
07/05/2026, 22:20
General
- Target lua/vehicle/powertrain/combustionEngine_rk.bat
- Size 110KB
- Sample260507-19lepsbt2x
- SHA256 f88edebe5400c2c26e37b979d5506a6884d2c915bec88320b4e55fae8f849dad
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 8 IoCs
- Drops file in Drivers directory 46 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Sets service image path in registry 3 TTPs 18 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Uses Session Manager for persistence 2 TTPs 10 IoCs
Creates Session Manager registry key to run executable early in system boot.
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Impair Defenses: Safe Mode Boot 1 TTPs 4 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks for any installed AV software in registry 1 TTPs 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 30 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 21 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 37 IoCs
- Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Access Token Manipulation: Create Process with Token 1 TTPs 4 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 14 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 10 IoCs
Inno Setup installer
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 44 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 14 IoCs
- Modifies Internet Explorer settings 1 TTPs 20 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 26 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 60 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lua\vehicle\powertrain\combustionEngine_rk.bat"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff8f6bec728,0x7ff8f6bec734,0x7ff8f6bec7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,9949952931106454573,15432427810476895138,262144 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2044 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,13608581539823374794,15141470042278757578,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,4126153251110992372,17958675994570101409,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2572 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,17899346668223949374,10516968397319543945,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3244 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,17090895632185741744,6663875873801407917,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,64042186760564629,17067092610227368290,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4428 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,13307822834149612032,11810030600346497177,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,16631732387963910396,7933082227729386987,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5416 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5728,i,12668197982935513611,16465600923619588879,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5656 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5852,i,10440131903785848556,4064298716793131528,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5640 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3388,i,3723066245915108567,16486158670102542950,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3340 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5652,i,7186051141847026060,9853069584644803741,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3280 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5836,i,14924277004470480095,8664930725999316485,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3308 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,3914361529980582723,421449371403386869,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5428 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,14535900183362062690,84286630303986784,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5748 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4664,i,17157562651545413885,10861466413663672107,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5908 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4448,i,6907061004882407305,1637890897849087305,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4844 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3256,i,10901369195607198441,8913974683781734109,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4688 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4816,i,12898470715558050400,83451770393118175,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3420 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4684,i,13336259204569857327,17788958773058510019,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5968,i,258288906841731563,5071550991633355243,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4824 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6056,i,2541502772081819002,5443880034759254355,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,14923959298943102730,6288714289221241487,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3316 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe"C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\asw.5c3b1531b7d17063\avg_antivirus_free_online_setup.exe"C:\Windows\Temp\asw.5c3b1531b7d17063\avg_antivirus_free_online_setup.exe" /cookie:mmm_bav_tst_007_823_a:dlid_FREEGSR /ga_clientid:43d66673-c87b-4b6e-8dba-18760db3e7de /edat_dir:C:\Windows\Temp\asw.5c3b1531b7d17063 /geo:GB3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\asw-43d66673-c87b-4b6e-8dba-18760db3e7de\common\icarus.exeC:\Windows\Temp\asw-43d66673-c87b-4b6e-8dba-18760db3e7de\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-43d66673-c87b-4b6e-8dba-18760db3e7de\icarus-info.xml /install /cookie:mmm_bav_tst_007_823_a:dlid_FREEGSR /edat_dir:C:\Windows\Temp\asw.5c3b1531b7d17063 /geo:GB /track-guid:43d66673-c87b-4b6e-8dba-18760db3e7de /sssid:38684⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\asw-43d66673-c87b-4b6e-8dba-18760db3e7de\common\icarus_ui.exeC:\Windows\Temp\asw-43d66673-c87b-4b6e-8dba-18760db3e7de\common\icarus_ui.exe /cookie:mmm_bav_tst_007_823_a:dlid_FREEGSR /edat_dir:C:\Windows\Temp\asw.5c3b1531b7d17063 /geo:GB /track-guid:43d66673-c87b-4b6e-8dba-18760db3e7de /sssid:3868 /er_master:master_ep_2696f78b-546a-4569-b25e-f1a316e95d12 /er_ui:ui_ep_832976a5-1db3-419f-8d92-36b4be5e479f5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Temp\asw-43d66673-c87b-4b6e-8dba-18760db3e7de\avg-av\icarus.exeC:\Windows\Temp\asw-43d66673-c87b-4b6e-8dba-18760db3e7de\avg-av\icarus.exe /cookie:mmm_bav_tst_007_823_a:dlid_FREEGSR /edat_dir:C:\Windows\Temp\asw.5c3b1531b7d17063 /geo:GB /track-guid:43d66673-c87b-4b6e-8dba-18760db3e7de /sssid:3868 /er_master:master_ep_2696f78b-546a-4569-b25e-f1a316e95d12 /er_ui:ui_ep_832976a5-1db3-419f-8d92-36b4be5e479f /er_slave:avg-av_slave_ep_ffca6764-8329-4680-871f-6977b2bfb115 /slave:avg-av5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Uses Session Manager for persistence
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer /reg6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\aswAMSI.dll"6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
- Modifies Internet Explorer settings
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /catinstall:"C:\Program Files\AVG\Antivirus\crts.cat" /basename:pkg_{af98c830-4af6-4eb6-ac37-02ebdd315ce2}.cat /crtid:BA50167A326BF266F7DF409760493D9727DA448A6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\wsc_proxy.exe"C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /svc /register /av_as_ppl6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\AVG\Antivirus\avDump.exe"C:\Program Files\AVG\Antivirus\avDump.exe" --pid 1512 --exception_ptr 0000002A673CEE30 --thread_id 2928 --dump_level 21 --dump_file "C:\ProgramData\AVG\Antivirus\log\unp312520801233857455i-manual.mdmp" --comment "Cause: VectoredExceptionHandler Reason: sd is not loaded Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of exception instantiation. Program version: 26.4.10932.983" --min_interval 607⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Common Files\AVG\Overseer\overseer.exe"C:\Program Files\Common Files\AVG\Overseer\overseer.exe" /skip_uptime /skip_remediations6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\Program Files\Common Files\AVG\Icarus\avg-av\aswOfferTool.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av\aswOfferTool.exe" /install_secure_browser /cmd:"/make_default /run_source=avg_install /language=en" /config_def:"C:\Windows\Temp\asw-43d66673-c87b-4b6e-8dba-18760db3e7de\avg-av\config.def"6⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files\Common Files\AVG\Icarus\avg-av\securebrowser_setup.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av\securebrowser_setup.exe" /s /make_default /run_source=avg_install /language=en7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\nsa9737.tmp\AVGBrowserInstaller.exe"C:\Users\Admin\AppData\Local\Temp\nsa9737.tmp\AVGBrowserInstaller.exe" "C:\Program Files\Common Files\AVG\Icarus\avg-av\securebrowser_setup.exe" /s /make_default /run_source=avg_install /language=en8⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\nsa9737.tmp\AVGBrowserUpdateSetup.exeAVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en&brand=7602&installargs= --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies"9⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\GUMB01D.tmp\AVGBrowserUpdate.exe"C:\Program Files (x86)\GUMB01D.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en&brand=7602&installargs= --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies"10⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc11⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver11⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserUpdateComRegisterShell64.exe"12⤵
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserUpdateComRegisterShell64.exe"12⤵
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserUpdateComRegisterShell64.exe"12⤵
- Modifies registry class
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTk5Ni42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTk5Ni42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0ie0M3OENFM0RDLTY5REMtNEMyQy04NEE5LTJDNTgxN0RGREQ2NX0iIHVzZXJpZD0iYjk3ZTlmOGE5YjU4NDNkNzk4OWVlN2Q1MTZiMzIwNjMiIG1hY2hpbmVpZD0iNDg4RENBNEMxNUY5QTFEMzMwQUQzMTJCMzkxQTgwNEVCRTUxQTYwMjIwMDYwQjYzMjQxQTJDRkNENDI2QzI2MCIgbWFjaGluZWlkX2RhdGU9IjIwMjYwNTA3IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHRlc3Rzb3VyY2U9ImF1dG8iIHJlcXVlc3RpZD0iezFFNjEwN0I5LURCQUItNDFBQy05NDQ3LTA2RjY0RkE2MDY4MH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDQuNDUyOSIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xOTk2LjYiIGxhbmc9ImVuIiBicmFuZD0iNzYwMiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iOTM3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en&brand=7602&installargs= --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dchrome --import-cookies" /installsource otherinstallcmd /sessionid "{C78CE3DC-69DC-4C2C-84A9-2C5817DFDD65}" /silent11⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --heartbeat --install --create-profile9⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=146.0.34394.179 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff8dfa4b1d0,0x7ff8dfa4b1dc,0x7ff8dfa4b1e810⤵
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --silent-launch9⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=146.0.34394.179 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff8dfa4b1d0,0x7ff8dfa4b1dc,0x7ff8dfa4b1e810⤵
-
-
-
C:\Program Files\AVG\Browser\Application\146.0.34394.179\Installer\setup.exesetup.exe /silent --create-shortcuts=0 --install-level=1 --system-level9⤵
- Drops file in Windows directory
-
C:\Program Files\AVG\Browser\Application\146.0.34394.179\Installer\setup.exe"C:\Program Files\AVG\Browser\Application\146.0.34394.179\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=146.0.34394.179 --attachment=C:\Windows\SystemTemp\AVGBrowser_installer.log --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff7477cc958,0x7ff7477cc964,0x7ff7477cc97010⤵
- Drops file in Windows directory
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"10⤵
- Checks computer location settings
- Checks for any installed AV software in registry
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /tn "AVGDefaultBrowserTask" /tr "\"C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe\" --runonce --force" /sc once /st "23:28" /F9⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /tn "AVGDefaultBrowserTask2" /tr "\"C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe\" --runonce --force" /sc once /st "23:32" /F9⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --check-run=src=installer--start-minimized9⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=146.0.34394.179 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff8dfa4b1d0,0x7ff8dfa4b1dc,0x7ff8dfa4b1e810⤵
-
-
-
-
-
-
C:\Program Files\AVG\Antivirus\defs\26050704\engsup.exe"C:\Program Files\AVG\Antivirus\defs\26050704\engsup.exe" /avg /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie6⤵
- Executes dropped EXE
-
-
-
C:\Windows\Temp\asw-43d66673-c87b-4b6e-8dba-18760db3e7de\avg-av-vps\icarus.exeC:\Windows\Temp\asw-43d66673-c87b-4b6e-8dba-18760db3e7de\avg-av-vps\icarus.exe /cookie:mmm_bav_tst_007_823_a:dlid_FREEGSR /edat_dir:C:\Windows\Temp\asw.5c3b1531b7d17063 /geo:GB /track-guid:43d66673-c87b-4b6e-8dba-18760db3e7de /sssid:3868 /er_master:master_ep_2696f78b-546a-4569-b25e-f1a316e95d12 /er_ui:ui_ep_832976a5-1db3-419f-8d92-36b4be5e479f /er_slave:avg-av-vps_slave_ep_0401a53e-0a53-4989-89a5-4cd2940ef1c1 /slave:avg-av-vps5⤵
- Uses Session Manager for persistence
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\AVG\Antivirus\defs\26050704\engsup.exe"C:\Program Files\AVG\Antivirus\defs\26050704\engsup.exe" /prepare_definitions_folder6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4796,i,5340705109963411796,14301704069202141779,262144 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5340 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5628,i,15375319582649490925,13612381820060110908,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4540 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3236,i,5885343121232477235,10482252277387854165,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6196,i,16205938702713935259,10107264490469716093,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6236 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6156,i,17762218092690071587,10176947495205898141,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6560,i,10050427816271353896,2904256843741321046,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6572 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6852,i,9964976912495824682,276910059785929968,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6840 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7176,i,2454291386759414547,4333617166423129640,2097152 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4688,i,5549722227707130924,16894331550152640845,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4540 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\avira_en_sptl1_2113372763-1778192706-1778192706-1__pavwws-spotlight-release.exe"C:\Users\Admin\Downloads\avira_en_sptl1_2113372763-1778192706-1778192706-1__pavwws-spotlight-release.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /Xml "C:\Users\Admin\AppData\Local\Temp\.CR.5707\Avira_Security_Installation.xml" /F /TN "Avira_Security_Installation"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.5241\Avira.Spotlight.Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\.CR.5241\Avira.Spotlight.Bootstrapper.exe" "C:\Users\Admin\AppData\Local\Temp\.CR.5241\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=avira_en_sptl1_2113372763-1778192706-1778192706-1__pavwws-spotlight-release.exe3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Checks for any installed AV software in registry
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\.CR.5241\ACSSignedIC.exe"C:\Users\Admin\AppData\Local\Temp\.CR.5241\ACSSignedIC.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.5241\14b01bff-be3b-4847-bb08-8a070795fe42\avira_spotlight_setup_pavwws.exe"C:\Users\Admin\AppData\Local\Temp\.CR.5241\14b01bff-be3b-4847-bb08-8a070795fe42\avira_spotlight_setup_pavwws.exe" /LOG="C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup_20260507232535373.log" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP /LANGUAGE=en-us /SYSTRAYAUTOSTARTENABLED=true /WITHSERVICESTOPPED=true /SKIPSERVICEREGISTRATION=true /CERTIFICATESVERSION=V44⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-849MT.tmp\avira_spotlight_setup_pavwws.tmp"C:\Users\Admin\AppData\Local\Temp\is-849MT.tmp\avira_spotlight_setup_pavwws.tmp" /SL5="$C014C,37772704,960512,C:\Users\Admin\AppData\Local\Temp\.CR.5241\14b01bff-be3b-4847-bb08-8a070795fe42\avira_spotlight_setup_pavwws.exe" /LOG="C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup_20260507232535373.log" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP /LANGUAGE=en-us /SYSTRAYAUTOSTARTENABLED=true /WITHSERVICESTOPPED=true /SKIPSERVICEREGISTRATION=true /CERTIFICATESVERSION=V45⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" create AviraSecurityUpdater DisplayName= "Avira Security Updater" binPath= "\"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe\"" start= delayed-auto6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" description AviraSecurityUpdater "Avira Security Updater"6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Update /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-7FGO1.tmp\UpdateFallbackTask.xml"6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Service_SCM_Watchdog /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-7FGO1.tmp\WatchdogServiceControlManagerTimeout.xml"6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Systray /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-7FGO1.tmp\SystrayAutostart.xml"6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Maintenance /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-7FGO1.tmp\MaintenanceTask.xml"6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.5241\dbe04729-64c8-4340-91fd-ad7c9f1b3371\avira_en_sptl1_2113372763-1778192706-1778192706-1__pavwws-spotlight-release.exe"C:\Users\Admin\AppData\Local\Temp\.CR.5241\dbe04729-64c8-4340-91fd-ad7c9f1b3371\avira_en_sptl1_2113372763-1778192706-1778192706-1__pavwws-spotlight-release.exe" Action=RegisterFallbackUpdater AllowMultipleInstances=true UnpackInCurrentDirectory=true4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\.CR.5241\dbe04729-64c8-4340-91fd-ad7c9f1b3371\.CR.16689\Avira.Spotlight.Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\.CR.5241\dbe04729-64c8-4340-91fd-ad7c9f1b3371\.CR.16689\Avira.Spotlight.Bootstrapper.exe" "C:\Users\Admin\AppData\Local\Temp\.CR.5241\dbe04729-64c8-4340-91fd-ad7c9f1b3371\.CR.16689\Avira.Spotlight.Bootstrapper.exe" Action=RegisterFallbackUpdater AllowMultipleInstances=true OriginalFileName=avira_en_sptl1_2113372763-1778192706-1778192706-1__pavwws-spotlight-release.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\.CR.5241\dbe04729-64c8-4340-91fd-ad7c9f1b3371\.CR.16689\ACSSignedIC.exe"C:\Users\Admin\AppData\Local\Temp\.CR.5241\dbe04729-64c8-4340-91fd-ad7c9f1b3371\.CR.16689\ACSSignedIC.exe"6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.5241\dbe04729-64c8-4340-91fd-ad7c9f1b3371\.CR.16689\Avira.Spotlight.Bootstrapper.ReportingTool.exe"C:\Users\Admin\AppData\Local\Temp\.CR.5241\dbe04729-64c8-4340-91fd-ad7c9f1b3371\.CR.16689\Avira.Spotlight.Bootstrapper.ReportingTool.exe" /TrackUnsentEvents5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.5241\dbe04729-64c8-4340-91fd-ad7c9f1b3371\.CR.16689\Avira.Spotlight.Bootstrapper.ReportingTool.exe"C:\Users\Admin\AppData\Local\Temp\.CR.5241\dbe04729-64c8-4340-91fd-ad7c9f1b3371\.CR.16689\Avira.Spotlight.Bootstrapper.ReportingTool.exe" /TrackPresetupEvents C:\Users\Admin\AppData\Local\Temp\.CR.5241\dbe04729-64c8-4340-91fd-ad7c9f1b3371\.CR.16689\ "Spotlight Presetup Start@134226663667754283:Process ID=5104;Os Language=en-US;Action=RegisterFallbackUpdater;Reboot Pending=true;Reboot Count Valid=true;$os=Windows;$os_version=10.0.19044;Bootstrapper Version=1.0.55.984;Os Platform=x64;RunMode=Default;Execute From Temp=false;" "Spotlight Presetup End@134226663700410506:$os_version=10.0.19044;ExitCode=0;$os=Windows;Process ID=5104;Os Language=en-US;Action=RegisterFallbackUpdater;Bootstrapper Version=1.0.55.984;Os Platform=x64;RunMode=Default;Execute From Temp=false;"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.5241\4edfb6b1-0c48-4a44-a432-12949f13fe04\avira_system_speedup.exe"C:\Users\Admin\AppData\Local\Temp\.CR.5241\4edfb6b1-0c48-4a44-a432-12949f13fe04\avira_system_speedup.exe" /install /OTC= /EMAIL= /LOG="C:\Users\Admin\AppData\Local\Temp\avira_system_speedup_setup_20260507232613150.log" /VERYSILENT /SUPPRESSMSGBOXES /LANGUAGE=en-us /NOSTART /NORESTART /bundle=sptl1 /download=pavwws /Spotlight4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-5922I.tmp\avira_system_speedup.tmp"C:\Users\Admin\AppData\Local\Temp\is-5922I.tmp\avira_system_speedup.tmp" /SL5="$D0206,35953336,916992,C:\Users\Admin\AppData\Local\Temp\.CR.5241\4edfb6b1-0c48-4a44-a432-12949f13fe04\avira_system_speedup.exe" /install /OTC= /EMAIL= /LOG="C:\Users\Admin\AppData\Local\Temp\avira_system_speedup_setup_20260507232613150.log" /VERYSILENT /SUPPRESSMSGBOXES /LANGUAGE=en-us /NOSTART /NORESTART /bundle=sptl1 /download=pavwws /Spotlight5⤵
- Checks computer location settings
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /F /TN AviraSystemSpeedupRemoval6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.dll" /codebase /silent /nologo6⤵
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.dll" /codebase /silent /nologo6⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe"C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe" -umh6⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\.CR.5241\4edfb6b1-0c48-4a44-a432-12949f13fe04\avira_system_speedup.exe" "C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /RU System /SC WEEKLY /TN AviraSystemSpeedupVerify /TR "\"C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe\" /VERIFY /VERYSILENT /NOSTART /NODOTNET /NORESTART" /RL HIGHEST6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe"C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe" -validatelicense6⤵
- Checks for any installed AV software in registry
-
-
C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe"C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe" -initbootoptimizer6⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\is-HABR5.tmp\Avira_Optimizer_Host.exe"C:\Users\Admin\AppData\Local\Temp\is-HABR5.tmp\Avira_Optimizer_Host.exe" /VERYSILENT6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-UIA5N.tmp\Avira_Optimizer_Host.tmp"C:\Users\Admin\AppData\Local\Temp\is-UIA5N.tmp\Avira_Optimizer_Host.tmp" /SL5="$2032E,1552217,832512,C:\Users\Admin\AppData\Local\Temp\is-HABR5.tmp\Avira_Optimizer_Host.exe" /VERYSILENT7⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe"C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe" /Install /Silent8⤵
- Sets service image path in registry
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,3529663594389957573,2772155714342702853,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6216 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7056,i,4636682448954455028,7234887281617769590,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7068 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1308,i,4762987239593974418,69140628154257775,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4688 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7200,i,16097202819314613015,10999695379881116947,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3460 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7196,i,12181856825695909680,7182632113479166588,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4736 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7000,i,17553852584923608634,5887666617766234474,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7024 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,13174118933037519535,4544594321444284449,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4540 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7328,i,15578536431220059635,15717482304765561761,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7348 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7336,i,16588352246061050132,14223228589447321961,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7504 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7512,i,8225292519268537310,3398915369652859715,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7544 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4812,i,14844547819581774806,15486717043907822743,524288 --field-trial-handle=2052,i,12443103095952640626,15523290200057150960,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7864 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\drivers\avgNetHub.sysC:\Windows\system32\drivers\avgNetHub.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\drivers\avgSP.sysC:\Windows\system32\drivers\avgSP.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\drivers\avgRdr2.sysC:\Windows\system32\drivers\avgRdr2.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\drivers\avgArPot.sysC:\Windows\system32\drivers\avgArPot.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\drivers\avgKbd.sysC:\Windows\system32\drivers\avgKbd.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\drivers\avgVmm.sysC:\Windows\system32\drivers\avgVmm.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\drivers\avgMonFlt.sysC:\Windows\system32\drivers\avgMonFlt.sys1⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Antivirus\aswidsagent.exe"C:\Program Files\AVG\Antivirus\aswidsagent.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\avgToolsSvc.exe"C:\Program Files\AVG\Antivirus\avgToolsSvc.exe" /runassvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
-
C:\Program Files\AVG\Antivirus\avgToolsSvc.exe"C:\Program Files\AVG\Antivirus\avgToolsSvc.exe" /runasapp /failsvcstart2⤵
- Executes dropped EXE
- Access Token Manipulation: Create Process with Token
-
-
C:\Windows\system32\drivers\avgStm.sysC:\Windows\system32\drivers\avgStm.sys1⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Antivirus\afwServ.exe"C:\Program Files\AVG\Antivirus\afwServ.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\AVGSvc.exe"C:\Program Files\AVG\Antivirus\AVGSvc.exe" /runassvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
-
C:\Program Files\AVG\Antivirus\AVGSvc.exe"C:\Program Files\AVG\Antivirus\AVGSvc.exe" /runasapp /failsvcstart2⤵
- Executes dropped EXE
- Access Token Manipulation: Create Process with Token
-
-
C:\Windows\system32\drivers\avgSnx.sysC:\Windows\system32\drivers\avgSnx.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\drivers\avgArDisk.sysC:\Windows\system32\drivers\avgArDisk.sys1⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\system32\drivers\avgElam.sysC:\Windows\system32\drivers\avgElam.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\drivers\avgRvrt.sysC:\Windows\system32\drivers\avgRvrt.sys1⤵
- Executes dropped EXE
-
C:\Program Files\AVG\Antivirus\afwServ.exe"C:\Program Files\AVG\Antivirus\afwServ.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\afwServ.exe"C:\Program Files\AVG\Antivirus\afwServ.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\afwServ.exe"C:\Program Files\AVG\Antivirus\afwServ.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus.exe" /repair:avg-av /silent /ii_reason:FwSvcRecovery1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\temp\asw-de605a45-7d1a-4147-82d8-a9f3a1a275a6\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\temp\asw-de605a45-7d1a-4147-82d8-a9f3a1a275a6\icarus.exe" /silent /ii_reason:FwSvcRecovery /er_master:master_ep_77386abd-9f7a-4ffc-a728-f8a01a57473a /er_slave:avg-av-vps_slave_ep_92fc4478-1aab-40c7-8ae0-e4529e82fed3 /slave:avg-av-vps2⤵
- Uses Session Manager for persistence
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\defs\26050704\engsup.exe"C:\Program Files\AVG\Antivirus\defs\26050704\engsup.exe" /prepare_definitions_folder3⤵
-
-
-
C:\Program Files\Common Files\AVG\Icarus\avg-av\temp\asw-de605a45-7d1a-4147-82d8-a9f3a1a275a6\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av\temp\asw-de605a45-7d1a-4147-82d8-a9f3a1a275a6\icarus.exe" /silent /ii_reason:FwSvcRecovery /er_master:master_ep_77386abd-9f7a-4ffc-a728-f8a01a57473a /er_slave:avg-av_slave_ep_cd568716-99e5-45c5-8e3b-b5cf7a841fc1 /slave:avg-av2⤵
- Sets service image path in registry
- Uses Session Manager for persistence
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer /reg3⤵
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer3⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" /U "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"3⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" /U "C:\Program Files\AVG\Antivirus\aswAMSI.dll"3⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"3⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\aswAMSI.dll"3⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /catinstall:"C:\Program Files\AVG\Antivirus\crts.cat" /basename:pkg_{af98c830-4af6-4eb6-ac37-02ebdd315ce2}.cat /crtid:BA50167A326BF266F7DF409760493D9727DA448A3⤵
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\wsc_proxy.exe"C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /svc /register /av_as_ppl3⤵
-
C:\Program Files\AVG\Antivirus\avDump.exe"C:\Program Files\AVG\Antivirus\avDump.exe" --pid 7116 --exception_ptr 000000D7322FEAF0 --thread_id 6228 --dump_level 21 --dump_file "C:\ProgramData\AVG\Antivirus\log\unp312520802464216050i-manual.mdmp" --comment "Cause: VectoredExceptionHandler Reason: sd is not loaded Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of exception instantiation. Program version: 26.4.10932.983" --min_interval 604⤵
-
-
-
C:\Program Files\Common Files\AVG\Overseer\overseer.exe"C:\Program Files\Common Files\AVG\Overseer\overseer.exe" /skip_uptime /skip_remediations3⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" /nogui3⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\Program Files\AVG\Antivirus\AvDump.exe"C:\Program Files\AVG\Antivirus\AvDump.exe" /unregister3⤵
-
-
-
C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus_ui.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus_ui.exe" /sbr /eid=4e926a18-ccca-41a9-9c3d-ee75401a4ed82⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.21970\Avira.Spotlight.Bootstrapper.Runner.exeC:\Users\Admin\AppData\Local\Temp\.CR.21970\Avira.Spotlight.Bootstrapper.Runner.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe"1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
C:\Windows\system32\net.exeC:\Windows\system32\net.exe1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net12⤵
-
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Systray.Application.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Systray.Application.exe"1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe1⤵
- Launches sc.exe
-
C:\Program Files (x86)\Avira\Fallback Updater\Avira.Spotlight.FallbackUpdater.exe"C:\Program Files (x86)\Avira\Fallback Updater\Avira.Spotlight.FallbackUpdater.exe" FallbackUpdater=true1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" /welcome1⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of SendNotifyMessage
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=gpu-process --field-trial-handle=10036,10151226137316361733,8626011799506986946,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously,WebRtcHideLocalIpsWithMdns --no-sandbox --disable-gpu-driver-bug-workarounds --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --force-device-scale-factor=1 --pack_loading_disabled=1 --gpu-preferences=SAAAAAAAAADgAABwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --mojo-platform-channel-handle=10052 /prefetch:22⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=10036,10151226137316361733,8626011799506986946,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously,WebRtcHideLocalIpsWithMdns --lang=en-US --service-sandbox-type=utility --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --force-device-scale-factor=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --mojo-platform-channel-handle=10224 /prefetch:82⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=10036,10151226137316361733,8626011799506986946,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously,WebRtcHideLocalIpsWithMdns --lang=en-US --service-sandbox-type=none --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --force-device-scale-factor=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --mojo-platform-channel-handle=10260 /prefetch:82⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --field-trial-handle=10036,10151226137316361733,8626011799506986946,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously,WebRtcHideLocalIpsWithMdns --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --force-device-scale-factor=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=10444 /prefetch:12⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\VisthAux.exe"C:\Program Files\AVG\Antivirus\VisthAux.exe" /runavservice2⤵
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\VisthAux.exe"C:\Program Files\AVG\Antivirus\VisthAux.exe" /runtoolsservice2⤵
- Checks processor information in registry
-
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files\AVG\Antivirus\AvLaunch.exe"C:\Program Files\AVG\Antivirus\AvLaunch.exe" /gui1⤵
- Executes dropped EXE
-
C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe"C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Downloads MZ/PE file
- Writes to the Master Boot Record (MBR)
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{E7BAF33D-733B-4B23-AAE6-19075AB09ECE}\AVGBrowserInstaller.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{E7BAF33D-733B-4B23-AAE6-19075AB09ECE}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --auto-pin-to-taskbar-on-run --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=chrome --import-cookies --system-level2⤵
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{E7BAF33D-733B-4B23-AAE6-19075AB09ECE}\CR_041D1.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{E7BAF33D-733B-4B23-AAE6-19075AB09ECE}\CR_041D1.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{E7BAF33D-733B-4B23-AAE6-19075AB09ECE}\CR_041D1.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --auto-pin-to-taskbar-on-run --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=chrome --import-cookies --system-level3⤵
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{E7BAF33D-733B-4B23-AAE6-19075AB09ECE}\CR_041D1.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{E7BAF33D-733B-4B23-AAE6-19075AB09ECE}\CR_041D1.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=146.0.34394.179 --attachment=C:\Windows\SystemTemp\AVGBrowser_installer.log --initial-client-data=0x258,0x280,0x284,0x27c,0x288,0x7ff687cac958,0x7ff687cac964,0x7ff687cac9704⤵
- Drops file in Windows directory
-
-
C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\icarus.exe" /update:avg-av-vps /silent /refresh /ii_reason:asb_update_refresh4⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\icarus.exe" /silent /refresh /ii_reason:asb_update_refresh /er_master:master_ep_ad6838dc-60db-4a19-af07-a843b3f33b29 /er_slave:avg-av-vps_slave_ep_dae1fd8d-d198-4534-acd5-c45bf3a4d632 /working_temp_dir:"C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\temp\asw-38fb6959-57e6-4c75-95bd-7ac2ebdfadbe" /slave:avg-av-vps5⤵
- Uses Session Manager for persistence
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\AVG\Antivirus\defs\26050704\engsup.exe"C:\Program Files\AVG\Antivirus\defs\26050704\engsup.exe" /prepare_definitions_folder6⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\AVG\Browser\Application\defs\26050704\engsup.exe"C:\Program Files\AVG\Browser\Application\defs\26050704\engsup.exe" /prepare_definitions_folder6⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Program Files\AVG\Browser\Application\vps_helper.exe"C:\Program Files\AVG\Browser\Application\vps_helper.exe" --install4⤵
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserCrashHandler.exe"2⤵
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserCrashHandler64.exe"2⤵
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /medsvc1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files\AVG\Antivirus\afwServ.exe"C:\Program Files\AVG\Antivirus\afwServ.exe"1⤵
- Checks processor information in registry
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files\AVG\Browser\Application\146.0.34394.179\elevation_service.exe"C:\Program Files\AVG\Browser\Application\146.0.34394.179\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=146.0.34394.179 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff8dfa4b1d0,0x7ff8dfa4b1dc,0x7ff8dfa4b1e82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,8460562213648410672,6221212744609244074,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2184 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1808,i,8885766021301513533,3367593579146812296,262144 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2112 /prefetch:22⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2472,i,17664767533706958724,6749248533929418494,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2568 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,16210977354900787632,16646037956170005893,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3604 /prefetch:22⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3624,i,5491544559312002101,11673229478671251332,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3656 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3992,i,7069677839359417344,494166978093011601,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4032 /prefetch:22⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=4248,i,8682967528282067682,6923668556539389562,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4260 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=4632,i,13089676116989388802,11480691895096438111,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3084 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,10960738121335779771,11980949094338701949,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5500 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,16305222968955293900,10046839377699264125,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5648 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,11872610911664659704,6157665514888821889,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5856 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,10951631372911772321,9594177561055695809,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5980 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6156,i,18183220537620138192,17413866921168541883,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6148 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6276,i,8846523524164478967,16478336124087972007,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6308 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6456,i,10080821432631458710,2245809454587058427,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6476 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6636,i,6111377488155523521,8599587600919331097,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6648 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6268,i,10803227821282021492,739844029264614292,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6816 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6944,i,17733466413547152524,5774994181582627603,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6956 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,17265836459940563407,6518155317293835446,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=5864 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6628,i,9158591601052261686,7761241370361523842,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7236 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7416,i,15015819283598577700,10792586976207291010,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7432 /prefetch:22⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7572,i,9012236118901357672,6779966917590842200,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7588 /prefetch:22⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7224,i,5379596523307569055,9067494300613918040,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7720 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7904,i,6554058865128219462,12602889381640439748,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7932 /prefetch:22⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7712,i,16102885940574069034,16953948187865004088,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=8052 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=8384,i,1999836316653237130,11865531798222665540,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=8388 /prefetch:22⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8540,i,9631306468452704849,16179583854017468059,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8504 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8692,i,4760147292538615837,11351945502352029316,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8708 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8552,i,2908214424096914188,8204601362362658571,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8868 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8684,i,1845062669015853918,8577102768459698755,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=9024 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9184,i,4577275372872837678,3054917831350605944,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=9168 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9328,i,13908638506700206037,15493511341595307298,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=9348 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9488,i,13679433228040334988,16904369185145803984,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=9500 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9644,i,14882741601352882776,13158200186004696889,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9660 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8884,i,337054379126888441,3297595408943612970,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9800 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9820,i,9801044010967134945,16548836071016532711,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9336 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9944,i,12902659658696525107,10218859621568842903,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=10080 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=10088,i,16081699770832630110,2056096899369542545,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=10244 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=10432,i,15411638844695437891,8965232162328929663,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=10456 /prefetch:22⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=4272,i,9323050195071042116,10994630091294020872,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=4668 /prefetch:22⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=4248,i,15324080832056217430,14681324392143298191,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=6128 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=5860,i,748594199127340818,4092136850762612393,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=5580 /prefetch:22⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=5996,i,18419675207817683300,7259660543866847729,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=6020 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6004,i,15280310829570803675,8283245289941758109,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=10460 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=6300,i,6451323375672234319,16997865101083146232,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=3280 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=6192,i,4021702272854677364,9027534176568853871,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=6188 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=6296,i,12202610199247219099,12055124862439995690,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=6184 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=11192,i,9305837062816922580,17996550144528950230,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=11212 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=11420,i,12495228024809848966,3982723220695571394,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=11436 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=11404,i,13424663616811648997,11871954589518078111,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=11372 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=11812,i,10807133738478754289,12605535365801023155,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=11832 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7212,i,6986731120102709158,1331997585678682984,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=3800 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=7140,i,10252444750856767298,4547832060233948813,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=7092 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=10848,i,15363434346458851014,8818670568289205025,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=6624 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=7756,i,6162709357705030634,7539863140495840771,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=7836 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=6804,i,13618355329423077772,10307732075815493821,2097152 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=6348 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,6081780625969750054,9706349376882921906,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=5700 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7800,i,8036467512624712231,9684478172386754098,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=248 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7824,i,2094219536467440655,11246626830527938729,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=6976 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6728,i,10528139626441443365,17072043792401633285,524288 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=6764 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2488,i,11239079327724495455,14926751268465136933,262144 --field-trial-handle=2116,i,845113377977693026,9878861014139293411,262144 --variations-seed-version --pseudonymization-salt-handle=2120,i,5401930484302689875,10156080510070406630,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=4536 /prefetch:22⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"2⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Browser\Application\146.0.34394.179\elevation_service.exe"C:\Program Files\AVG\Browser\Application\146.0.34394.179\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Browser\Application\vps_helper.exe"C:\Program Files\AVG\Browser\Application\vps_helper.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Program Files\AVG\Browser\Application\146.0.34394.179\elevation_service.exe"C:\Program Files\AVG\Browser\Application\146.0.34394.179\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Browser\Application\146.0.34394.179\elevation_service.exe"C:\Program Files\AVG\Browser\Application\146.0.34394.179\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --check-run=src=logon --auto-launch-at-startup --profile-directory="Default"1⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=146.0.34394.179 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff8dfa4b1d0,0x7ff8dfa4b1dc,0x7ff8dfa4b1e82⤵
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe"C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe" --runonce --force1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --make-default-browser2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=146.0.34394.179 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff8dfa4b1d0,0x7ff8dfa4b1dc,0x7ff8dfa4b1e83⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1924,i,16109184187920569564,15751472852766311640,524288 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2472 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,4357374930556670274,12697101290388319875,262144 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2432 /prefetch:23⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,11619925193641512108,10007625760816848915,524288 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2704 /prefetch:83⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3280,i,12881045717192410966,7218958757160182760,2097152 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3328 /prefetch:23⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,17303499832042968795,2023834391529968355,2097152 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3296 /prefetch:23⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=micro_av.mojom.MicroAVService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3416,i,10387864477584520365,11915966908673523071,524288 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3508 /prefetch:83⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3644,i,13816764285084457957,6856994741558063183,2097152 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4388 /prefetch:23⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3684,i,8756522861654509447,7185805628959215506,2097152 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4444 /prefetch:23⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3720,i,17488668993042670025,3531752092252526890,2097152 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4464 /prefetch:23⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3812,i,11666129632249552625,8922052285651555633,2097152 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4504 /prefetch:23⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3624,i,5277702147409592146,7926597896595790202,2097152 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4544 /prefetch:23⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3736,i,13791024712730267886,953942337612374123,2097152 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4484 /prefetch:23⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5624,i,10639490065346721694,3373376532390677074,2097152 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=3496 /prefetch:13⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,10015707173607336812,17185729793863631375,524288 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6040 /prefetch:83⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=4240,i,104286440151332122,17803423485364666988,524288 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=4172 /prefetch:83⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --enable-protect3⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=146.0.34394.179 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff8dfa4b1d0,0x7ff8dfa4b1dc,0x7ff8dfa4b1e84⤵
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,6935623550480428692,9127015317013541580,524288 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6116 /prefetch:83⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4184,i,8600096306083666924,15876279883496120144,2097152 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=4232 /prefetch:13⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=6408,i,17316460263145342349,17561968935572725452,524288 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7172 /prefetch:83⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=7312,i,11227459036687947601,1547736954415768515,524288 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7356 /prefetch:83⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=7324,i,6397128381017304317,456074152150404211,524288 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=3700 /prefetch:83⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --force-high-res-timeticks=disabled --metrics-shmem-handle=3612,i,7185679640303152785,5314285901493107508,524288 --field-trial-handle=2436,i,4084353125743617594,15053053329041144753,262144 --variations-seed-version --pseudonymization-salt-handle=2440,i,2055682181941255389,17992011402047374178,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7308 /prefetch:83⤵
-
-
-
C:\Program Files\AVG\Browser\Application\146.0.34394.179\elevation_service.exe"C:\Program Files\AVG\Browser\Application\146.0.34394.179\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --check-run=src=desktop1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=146.0.34394.179 --initial-client-data=0x14c,0x150,0x154,0x128,0x158,0x7ff8dfa4b1d0,0x7ff8dfa4b1dc,0x7ff8dfa4b1e82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1852,i,2067043649924996457,13461618662117793738,262144 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2040 /prefetch:22⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2192,i,6026250569109899259,1799732366187156289,524288 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2332 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,17012668319127011237,12926128628309891833,524288 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2508 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3412,i,3195810623687883885,1681063736507058286,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3420 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3452,i,8259162996205548972,15664963918854496763,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3464 /prefetch:22⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4024,i,16131316034103465320,9842195342020267269,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4044 /prefetch:22⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4084,i,884612517931512314,16796540003950183345,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4384 /prefetch:22⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4124,i,3639493144232602996,7294332391707545399,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4408 /prefetch:22⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4144,i,12921827650404746860,8847780063371025173,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4520 /prefetch:22⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4184,i,6852234267777046507,13259694228835729291,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4556 /prefetch:22⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4148,i,10725733386539825674,17675332213754122373,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4536 /prefetch:22⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=micro_av.mojom.MicroAVService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,2719490140391422163,4258660763069894636,524288 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5160 /prefetch:82⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4616,i,5991181404949087584,16408256924334456937,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5144 /prefetch:22⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3380,i,8307252074585848255,4556563313704646597,524288 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=6004 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3352,i,2621385231391311526,2768534108670837066,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=3860 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6232,i,16936743171896798216,6557045094690193900,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=4168 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6380,i,10774391786749517011,9456207586889840335,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6368 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6508,i,863590359142666883,750280671778590079,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=4200 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7352,i,16657575619175863418,11632790987095346399,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7376 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\146.0.34394.179\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\146.0.34394.179\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings2⤵
- Drops file in Windows directory
-
C:\Program Files\AVG\Browser\Application\146.0.34394.179\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\146.0.34394.179\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=146.0.34394.179 --attachment=C:\Windows\SystemTemp\AVGBrowser_installer.log --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff7210bc958,0x7ff7210bc964,0x7ff7210bc9703⤵
- Drops file in Windows directory
-
-
C:\Program Files\AVG\Browser\Application\146.0.34394.179\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\146.0.34394.179\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\AVG\Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=0 --no-pin-startmenu3⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Program Files\AVG\Browser\Application\146.0.34394.179\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\146.0.34394.179\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=146.0.34394.179 --attachment=C:\Windows\SystemTemp\AVGBrowser_installer.log --initial-client-data=0x224,0x220,0x264,0x240,0x268,0x7ff7210bc958,0x7ff7210bc964,0x7ff7210bc9704⤵
- Drops file in Windows directory
-
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7472,i,13694826293013634350,4373491773515256498,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7452 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7864,i,15518625751430403577,9817922132333170047,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7884 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=8044,i,2848567306859315517,6666808938960801326,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=8040 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"2⤵
- Checks computer location settings
- Checks processor information in registry
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --enable-protect2⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=146.0.34394.179 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x7ff8dfa4b1d0,0x7ff8dfa4b1dc,0x7ff8dfa4b1e83⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe"C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe" --registration reg-task --taskintr PT10M --runonce3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=8468,i,14361322435078834534,6161188852963124077,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=8484 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=8540,i,15030762492795655030,15493086116236647158,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=8648 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=8828,i,11985013064509870268,12819553992344656668,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=8464 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=9268,i,10793124162993805886,14979855609940641730,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=9220 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=9228,i,17168372625003040617,11023581183692266401,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=9300 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=7496,i,16225958867493015401,8799616941853201070,524288 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7448 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9016,i,508786554241280255,2945149146419900583,524288 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=9040 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8332,i,8823440024033455072,13996242202826995281,524288 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=9576 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=9708,i,7087812907258301733,4452224311979984309,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=3644 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=8428,i,7501402903150258825,2065130174743932370,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8420 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"2⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7744,i,2527357580239531601,962538967883408947,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=7788 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=8356,i,18189903594397227618,1764347976603009271,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=7348 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6316,i,1563369491340581132,15524923921036029302,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=7732 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=9876,i,6247319325875124735,1232868455932421264,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9916 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=10024,i,14271309411330746316,14802226408477611042,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=7368 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=8368,i,5673167735135348580,6575858611801085554,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=8420 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"2⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=9392,i,17851095874458011129,17800584270506812987,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=9308 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=8384,i,13595210177638622483,8772787486419823257,524288 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=8336 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=8400,i,13137263614199441417,10344185054669993561,524288 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=8140 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=8200,i,11152876696204380251,5424354194176837483,524288 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=9952 /prefetch:82⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=10116,i,14783992604612085862,16839737608574590155,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=9892 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7804,i,1397175378614959844,803949070731397325,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=7368 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=8816,i,9128287772841109404,5653026052015428886,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=9932 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=3352,i,8942259632361237464,12927485908788699121,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=8816 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7788,i,2557399368357238906,17629050732694085621,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=3532 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7364,i,10914333858888837039,18183593319090740810,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=7628 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=8260,i,15590787701211919316,543356277500814123,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=9356 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"2⤵
- Checks processor information in registry
- Modifies registry class
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=8000,i,7236378989360948840,5395804285555753316,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=9548 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=3460,i,6520894005749695336,2025805353118961839,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=7620 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=7956,i,13460100392446631592,11312926132896195886,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=9328 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=8496,i,15317469121717865127,713565242000203998,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=7936 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=8000,i,17004037220698905831,15059822808383472712,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=7516 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=10128,i,4295248372988119037,18088842738166545010,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=3444 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=7340,i,1519283041999079698,8141201133645475830,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=8352 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=7936,i,18068418170067458184,4803473091577683716,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=4016 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=7920,i,15046008006535627991,12769639804658060444,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709044408466132 --mojo-platform-channel-handle=7944 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=7984,i,9279531279963959143,11923018534765526286,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709045345507981 --mojo-platform-channel-handle=8320 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=4044,i,12094787410612712857,15620253796885884355,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709046282549830 --mojo-platform-channel-handle=8352 /prefetch:12⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=9256,i,5932900933950346969,17242179894815586624,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709047219591679 --mojo-platform-channel-handle=8864 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=9256,i,9518913311139561436,4894319983430157193,2097152 --field-trial-handle=2044,i,13517737046240464067,5871365451284972223,262144 --variations-seed-version --pseudonymization-salt-handle=2052,i,1850095729080082763,2849500240121918738,4 --trace-process-track-uuid=3190709048156633528 --mojo-platform-channel-handle=8608 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Program Files\AVG\Browser\Application\146.0.34394.179\elevation_service.exe"C:\Program Files\AVG\Browser\Application\146.0.34394.179\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
3Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Access Token Manipulation
1Create Process with Token
1Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
3Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Access Token Manipulation
1Create Process with Token
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
7Pre-OS Boot
1Bootkit
1Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
8Software Discovery
1Security Software Discovery
1System Information Discovery
8System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
Antivirus.ContextMenu.dll
SharpShell.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Threading.Tasks.Extensions.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Avira.Spotlight.UI.Application.exe
Service.Plugin.Antivirus.Legacy.dll
Avira.SystemSpeedup.Core.Common.Starter.exe
Avira.SystemSpeedup.Maintenance.exe
is-QJCH8.tmp
@PaxHeader
Base.dll
Boot.dll
aswClnTg.htm
aswClnTg.txt
aswInfTg.htm
aswInfTg.txt
uiLangRes.dll
AVGSvc.exe
AVGUI.exe
AavmRpch.dll
AvBugReport.exe
AvConsent.exe
AvDump.exe
AvEmUpdate.exe
AvLaunch.exe
BreachGuardSdk.dll
BrowserCleanup.ini
CommChannel.dll
CommonRes.dll
HTMLayout.dll
avgArDisk.sys
avgArPot.sys
avgBoot.exe
avgElam.sys
avgKbd.sys
avgMonFlt.sys
avgNetHub.sys
avgRdr2.sys
avgRvrt.sys
avgSP.sys
avgSnx.sys
avgStm.sys
avgVmm.sys
avgbidsdriver.sys
avgbidsh.sys
avgbuniv.sys
Boost.txt
Crypto++.txt
Detours.txt
GSL.txt
ICU.txt
JsonCpp.txt
LZMA.txt
OpenSSL.txt
PCRE.txt
Xerces.txt
brotli.txt
bsdiff.txt
bzip2.txt
c-ares.txt
cURL.txt
cef.txt
dnscrypt-proxy.txt
intel_asm.txt
jansson.txt
lexbor.txt.ipending.6c1d19fe
libPNG.txt
libevent.txt
libsodium.txt
lzfse.txt
mbedTLS.txt
mhook.txt
nanopb.txt
nghttp2.txt
protobuf.txt
pugixml.txt
rapidjson.txt
sqlite.txt
unrar.txt
vxWidgets.txt
xmlParser.txt
xxHash.txt
yara.txt
zlib.txt
OobeUtil.exe
RegSvr.exe
aswPEAntivirus.exe
aswPEBrowser.exe
aswPECommander.exe
aswPEShell.exe
aswRegLib.dll
aswShMin.exe
background-loading.png
background.png
waikamd64.mst
wxbase315u_vc.dll
wxmsw315u_core_vc.dll
SecurityProductInformation.ini
SetupInf.exe
SupportTool.exe
VisthAux.exe
afwCoreClient.dll
afwRpc.dll
afwServ.exe
anen.dll
ashBase.dll
ashQuick.exe
ashServ.dll
ashShell.dll
ashTask.dll
ashUpd.exe
aswAMSI.dll
aswAux.dll
aswAv.dll
aswAvBootTimeScanShMin.exe
aswBrowser.dll
aswChLic.exe
aswCmnBS.dll
aswCmnIS.dll
aswCmnOS.dll
aswDld.dll
aswEngLdr.dll
aswEngSrv.exe
aswIP.dll
aswLog.dll
aswProperty.dll
aswPropertyAv.dll
aswRunDll.exe
aswRvrt.dll
aswSqLt.dll
aswVmm.dll
aswW8ntf.dll
aswavdetection.dll
aswcomm.dll
aswdetallocator.dll
aswhook.dll
aswidpm.dll
aswidsagent.exe
aswntsqlite.dll
aswpsic.dll
aswremoval.dll
aswsecapi.dll
aswwinamapi.dll
avgToolsSvc.exe
browser_pass.dll
burger_client.dll
cef_renderer.dll
chrome_100_percent.pak
chrome_200_percent.pak
chrome_elf.dll
crts.cat
d3dcompiler_47.dll
engsup.ini
directml.dll
dll_loader.dll
dnd_helper.dll
driver_bridge.dll
event_manager.dll
event_manager_burger.dll
event_manager_er.dll
event_manager_ga.dll
event_routing.dll
event_routing_rpc.dll
ffl2.dll
firefox_pass.exe
gaming_hook.exe
about.js
antiRansomware.js
antiTrack.js
ask.ogg
done.ogg
notify.ogg
threat.ogg
breachGuard.js
browserDetection.js
browserDetectionWindow.html
browserExtensions.js
core.js
darkWebMonitor.js
dashboard.js
dataShredder.js
doNotDisturb.js
driverUpdater.js
dsMetadata.json
feedbackForm.js
firewall.js
help.js
i18n.js
kin.js
libs.js
locale-id.json.ipending.6c1d19fe
mainCss.css
mainCss_light.css
mainFont.css
mainLayout.js
mainLayoutCss.css
mainSprite.css
mainVars.json
mainVars_o2.json
mainWindow.html
myLicenses.js
napi.js
napiAdapter.js
napiExtensions.js
network.js
notifications.js
offline.htm
overlay.html
pap.js
passwordProtection.js
plugins.js
ras.js
rescueDisk.js
scans.js
search.js
secureDns.js
sensitiveData.js
settings.js
shields.js
smartScan.js
software.js
svelteComponents.js
svelteInternal.js
svgFlags.css
svgInline.svg
system.js
tray.js
tuneup.js
update.js
updatefile.json
virusChest.js
webCam.js
hns_tools.dll
icudtl.dat
jsbridge.dll
libEGL.dll
libGLESv2.dll
libcrypto-3-x64.dll
libssl-3-x64.dll
libwaapi.dll
libwaheap.dll
libwalocal.dll
libwaresource.dll
libwautils.dll
libwavmodapi.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-fibers-l1-1-1.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-kernel32-legacy-l1-1-1.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-sysinfo-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
local.crt.manifest
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_1.dll
vcruntime140_threads.dll
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
vi.pak
zh-CN.pak
zh-TW.pak
log.dll
mfc140.dll
mfc140u.dll
mfcm140.dll
mfcm140u.dll
module_lifetime.dll
nos.dll
ntp_time.dll
onnxruntime.dll
onnxruntime_providers_openvino.dll
onnxruntime_providers_shared.dll
openvino.dll
openvino_auto_batch_plugin.dll
openvino_auto_plugin.dll
openvino_hetero_plugin.dll
openvino_intel_npu_plugin.dll
openvino_onnx_frontend.dll
overseer.exe
perfstats.dll
process_monitor.dll
protobuf.dll
resources.pak
sched.exe
serialization.dll
005c9e7a-8610-4cce-82fb-ee09530a9de3.ini
1ccb734f-665b-4ebd-a456-67196b48cf78.ini
36c7e95c-b720-48d1-a629-cd9bfeb3c968.xml
22F2E66C0423AC5B0735C03C4C3C74A3.rmt
64791D5D5DC548B943CC955ED7682776CF4A64DF2A978531EEBBB6900750F0D8
update.xml
config.def
config.def
09046B0A53CA2084A6182145A265743F838F115883E74A06CD36BFD8F63B3002
EAF231256D8BEC8D46E02B6AEDB80EB2.rmt
update.xml
update.xml
shepherdsync.dll
shred.exe
snapshot_blob.bin
snxhk.dll
streamback.dll
su_adapter.dll
su_common.dll
su_controller.dll
su_worker.exe
libEGL.dll
libGLESv2.dll
task_performance_logger.dll
tasks_core.dll
tbb12.dll
uet_client.dll
v8_context_snapshot.bin
vaarclient.dll
wa_3rd_party_host_32.exe
wa_3rd_party_host_64.exe
wsc.dll
wsc_proxy.exe
wsc_proxy.exe.manifest
AavmRpch.dll
AvDump.exe
RegSvr.exe
ashShell.dll
aswAMSI.dll
aswBrowser.dll
aswCmnBS.dll
aswCmnIS.dll
aswCmnOS.dll
aswProperty.dll
aswPropertyAv.dll
aswRunDll.exe
aswhook.dll
dll_loader.dll
dnd_helper.dll
firefox_pass.exe
gaming_hook.exe
API-MS-Win-core-xstate-l2-1-0.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-fibers-l1-1-1.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-kernel32-legacy-l1-1-1.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-sysinfo-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
local.crt.manifest
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_threads.dll
snxhk.dll
ArPot.dll
ArPotEx32.dll
ArPotEx64.dll
BCUEngine.dll
PushPin.dll
Sf2.dll
algo64.dll
aswAR.dll
aswArray.dll
aswBoot64.dll
aswCleanerDLL.dll
aswCmnBS.dll
aswCmnIS64.dll
aswCmnOS.dll
aswEngin.dll
aswFiDb.dll
aswHds.dll
aswJsFlt.dll
aswJsFlt64.dll
aswQcr.dll
aswRawFS264.dll
aswRawFS64.dll
aswRep.dll
aswScan.dll
certs.map
db_agdx.dat
db_ap2.dat
db_array.dat
db_as.dat
db_bank.dat
db_cf.dat
db_cmd.nmp
db_cmd.sig
db_conb.dat
db_dex.nmp
db_dex.sig
db_dh.dat
db_dns.nmp
db_dns.sig
db_dsign.dat
db_dyna.nmp
db_dyna.sig
db_el.dat
db_elf.nmp
db_elf.sig
db_elfa.nmp
db_elfa.sig
db_evoapk.dat
db_evope.dat
db_ext.dat
db_fn.nmp
db_fn.sig
db_java.nmp
db_java.sig
db_js.nmp
db_js.sig
db_med.nmp
db_med.sig
db_mu.dat
db_mx4.nmp
db_mx4.sig
db_mx95.nmp
db_mx95.sig
db_o7.nmp
db_o7.sig
db_o7c.dat
db_o7c.map
db_ob2.dat
db_pay.dat
db_pdf.mml
db_pe.nmp
db_pe.sig
db_pe3.dat
db_pph.dat
db_qcr.dat
db_sl.nmp
db_sl.sig
db_sn.nmp
db_sn.sig
db_snh.dat
db_sp.dat
db_str.nmp
db_str.sig
db_swf.nmp
db_swf.sig
db_symtrnl.dat
db_tlsh.dat
db_tx.dat
db_w6.nmp
db_w6.sig
db_w6c.dat
db_w6c.map
db_wat.nmp
db_wat.sig
db_wh2.dat
db_xtn.map
def.ini
engsup.exe
exts.dll
fwAux.dll
gvma64.dat
idp.dat
list_d.txt
list_i.txt
swhealthex2.dll
uiext.dll
7028c6b7-d671-4c1b-9a78-27d6aec62167.tmp
securebrowser_setup.exe
OpenSans-Bold.ttf
OpenSans-Italic.ttf
OpenSans-Light.ttf
OpenSans-Regular.ttf
RobotoCondensed-Bold.ttf
RobotoCondensed-Regular.ttf
proximanova-bold.otf
proximanova-light.otf
proximanova-regular.otf
Blocked.htm
image001.png
consent_profile.wprp
config.xml.ipending.6c1d19fe
macaddr.db.ipending.6c1d19fe
networks.xml.ipending.6c1d19fe
ports.xml.ipending.6c1d19fe
rules.xml.ipending.6c1d19fe
templates.xml.ipending.6c1d19fe
dnddetection.dat
dnddetection.dat.ver
dndrules.dat
dndrules.dat.ver
overseer_unattend.xml
profile.wprp
settings-26.4.10932.3597.ori
snx_gconfig.xml
event_manager.log
icarus.log
icarus.log
icarus.log
icarus.log
icarus.log
sfx.log
sui.log
sui.log
icarus.ini
icarus.ini
icarus.ini
icarus.ini
icarus.ini
icarus.ini
temporary_proxy.ini
AvEmUpdate.log
AvEmUpdate.log
AvEmUpdate.log
settings.dat
277806e6-a112-4b69-870a-6759e40c1c82.tmp
6a13b51f-de92-459d-b9c6-43781c79ebc1.tmp
Bookmarks
f_000033
f_00004e
f_000083
f_00009d
f_0000a1
f_0000a2
f_0000a3
f_0000a4
f_0000a5
f_0000ba
f_0000bc
f_0000c0
f_0000c1
f_0000c2
f_0000c7
5899c7a0f3d43b04_0
b9121e9f833b482d_0
the-real-index
the-real-index~RFe5eab90.TMP
data_0
data_1
data_2
data_3
index
messages.json
arrow-up.svg
down-arrow.svg
threat-icon.svg
antiPhishingManagerCS.js
serviceWorker.js
content.css
messages.json
verified_contents.json
icon19.png
background.js
contentScript.js
data_0
MANIFEST-000001
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences~RFe5d3fea.TMP
Secure Preferences
Secure Preferences
Secure Preferences~RFe5d66fa.TMP
the-real-index
the-real-index~RFe604d0b.TMP
the-real-index
the-real-index~RFe606da2.TMP
index.txt
index.txt
index.txt
index.txt~RFe5ffefa.TMP
index
index.txt
index.txt~RFe5d7439.TMP
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5d95da.TMP
4c8c60a7af065345_0
the-real-index
000001.dbtmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe5d3fda.TMP
92ac4503d850d61341c2b89b0ca25ae45a875f85e7ab7018354cef9a0b37bba7
metadata.json
e4ac9853-0831-4232-ba9a-e4dde876f8ae.tmp
54529753-0052-42d8-9bef-95157aee1568.tmp
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
temp-index
the-real-index
the-real-index
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe591c48.TMP
the-real-index
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
avira_spotlight_setup_pavwws.exe
VpnInstaller.exe
avira_system_speedup.exe
17d195fa-d4a1-4059-9ccf-f9d944d2e5b0.tmp
app3050a4f5e072dae2.tmp
appd22c39b0155fb024.tmp
Avira.Optimizer.Common.Native.Library.dll
Avira_Optimizer_Host.exe
1-logo.png
6-icon-get-started.png
index.js
content-inject.js
iframe_content.js
messages.json
messages.json
content.css
search.css
KievitWebPro-Bold.woff
KievitWebPro-Light.woff
KievitWebPro.woff
trackerNotification.css
ExtPermNotification.js
common.js
content.js
jquery.js
landingPage.js
external-splashoffer.js
contentScript.js
fonts.css
aarSiteScript.js
background.html
background.js
background.js.LICENSE.txt
contentScript.js
contentScript.js.LICENSE.txt
fonts.css
popover.html
siteScript.js
messages.json
content.bundle.js
popup.bundle.js
icon16.png
icon48.png
icon.png
icon.svg
webstore.js
messages.json
messages.json
allowed.png
blocked.png
icon_close.png
logger_icon.png
logger_table_icon.jpg
pro.png
table_list_icon.png
table_regex_icon.png
warning.png
logger.bundle.js.LICENSE.txt
16x.png
32x.png
48x.png
EulaPopupCS.js.LICENSE.txt
alert.svg
alert.svg
audio.svg
camera.svg
no-video-illustration.svg
status_ok.svg
tooltip.svg
ic-24-checkbox-checked.svg
info.svg
disabled-checkbox.svg
no-video-illustration.svg
plain-cross.svg
tooltip.svg
logo.svg
status_info.svg
status_ok.svg
iframePopupCS.js
offscreen.js.LICENSE.txt
videoDownloaderCS.js
the-real-index
the-real-index
Network Persistent State
Network Persistent State
default.dic
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
c5dd212223b118d4.customDestinations-ms
c5dd212223b118d4.customDestinations-ms
c5dd212223b118d4.customDestinations-ms
desktop.ini
Unconfirmed 410969.crdownload
avg_antivirus_free_setup.exe
config.def
icarus_product.dll
product-def.xml
product-info.xml
aswOfferTool.exe
config.def
config.def.edat
edition.edat
icarus_product.dll
icarus_rvrt.exe
bug_report.exe
dump_process.exe
icarus.exe
icarus_mod.dll
icarus_ui.exe
product-def.xml
product-info.xml
setupui.cont
icarus-info.xml
avg_antivirus_free_online_setup.exe
ecoo.edat
eref.edat
memory/972-9688-0x0000025CC9B60000-0x0000025CC9CFF000-memory.dmp
memory/976-8476-0x0000018DA6800000-0x0000018DA6C6E000-memory.dmp
memory/976-661-0x0000018DA6800000-0x0000018DA6C6E000-memory.dmp
memory/976-5488-0x0000018DA6800000-0x0000018DA6C6E000-memory.dmp
memory/1572-8679-0x00000208F2E10000-0x00000208F2E20000-memory.dmp
memory/1572-8680-0x00000208F3260000-0x00000208F3288000-memory.dmp
memory/1572-8681-0x00000208F52E0000-0x00000208F5354000-memory.dmp
memory/1572-8682-0x00000208F54A0000-0x00000208F54EA000-memory.dmp
memory/1572-8684-0x00000208F31B0000-0x00000208F31B8000-memory.dmp
memory/1572-8685-0x00000208F3200000-0x00000208F320C000-memory.dmp
memory/2224-13269-0x0000000007390000-0x0000000007836000-memory.dmp
memory/2224-11119-0x0000000007390000-0x0000000007836000-memory.dmp
memory/2224-12503-0x0000000007390000-0x0000000007836000-memory.dmp
memory/2504-8799-0x0000000003DF0000-0x0000000003E2B000-memory.dmp
memory/2504-8798-0x0000000000400000-0x000000000071B000-memory.dmp
memory/2944-8314-0x0000000006370000-0x000000000637A000-memory.dmp
memory/2944-8316-0x0000000006930000-0x0000000006952000-memory.dmp
memory/2944-8302-0x0000000006050000-0x000000000605A000-memory.dmp
memory/2944-8286-0x0000000005E90000-0x0000000005E9A000-memory.dmp
memory/2944-8287-0x0000000005EA0000-0x0000000005EAA000-memory.dmp
memory/2944-8288-0x0000000005EF0000-0x0000000005F22000-memory.dmp
memory/2944-8271-0x00000000055C0000-0x000000000567C000-memory.dmp
memory/2944-8311-0x0000000006210000-0x000000000622A000-memory.dmp
memory/2944-8310-0x00000000064A0000-0x0000000006608000-memory.dmp
memory/2944-8277-0x0000000005700000-0x0000000005716000-memory.dmp
memory/2944-8312-0x0000000006250000-0x0000000006262000-memory.dmp
memory/2944-8315-0x00000000063A0000-0x00000000063B4000-memory.dmp
memory/2944-8282-0x0000000005720000-0x000000000572E000-memory.dmp
memory/2944-8309-0x0000000006270000-0x0000000006322000-memory.dmp
memory/2944-8283-0x00000000058D0000-0x0000000005966000-memory.dmp
memory/2944-8322-0x00000000074D0000-0x0000000007AE8000-memory.dmp
memory/2944-8267-0x0000000000750000-0x000000000079C000-memory.dmp
memory/2944-8273-0x0000000005530000-0x0000000005558000-memory.dmp
memory/2944-8307-0x00000000060D0000-0x00000000060E2000-memory.dmp
memory/2944-8276-0x0000000005590000-0x000000000559E000-memory.dmp
memory/2944-8275-0x0000000005580000-0x0000000005590000-memory.dmp
memory/2944-8303-0x0000000006090000-0x000000000609C000-memory.dmp
memory/2944-8308-0x00000000060C0000-0x00000000060CC000-memory.dmp
memory/2944-8319-0x0000000006AA0000-0x0000000006DF7000-memory.dmp
memory/2944-8304-0x00000000060F0000-0x000000000613A000-memory.dmp
memory/2944-8274-0x0000000005560000-0x0000000005576000-memory.dmp
memory/2944-8284-0x00000000057A0000-0x00000000057AA000-memory.dmp
memory/2944-8278-0x0000000005760000-0x0000000005796000-memory.dmp
memory/2944-8272-0x0000000005680000-0x00000000056F2000-memory.dmp
memory/2944-8313-0x00000000063C0000-0x0000000006418000-memory.dmp
memory/2984-8320-0x00000000076A0000-0x00000000076BA000-memory.dmp
memory/2984-8321-0x0000000007820000-0x0000000007876000-memory.dmp
memory/2984-5903-0x0000018AF8C20000-0x0000018AF8C4F000-memory.dmp
memory/3888-4816-0x0000020297330000-0x000002029779E000-memory.dmp
memory/3888-662-0x0000020297330000-0x000002029779E000-memory.dmp
memory/4392-8757-0x0000000005660000-0x000000000568E000-memory.dmp
memory/4392-8776-0x00000000072B0000-0x00000000072BA000-memory.dmp
memory/4392-8777-0x0000000007390000-0x00000000073E8000-memory.dmp
memory/4392-8767-0x0000000005920000-0x0000000005982000-memory.dmp
memory/4392-8761-0x00000000057B0000-0x000000000584A000-memory.dmp
memory/4392-8759-0x0000000005420000-0x0000000005428000-memory.dmp
memory/4392-8778-0x00000000073F0000-0x000000000741A000-memory.dmp
memory/4392-8779-0x0000000007460000-0x0000000007494000-memory.dmp
memory/4392-8760-0x00000000056E0000-0x000000000570A000-memory.dmp
memory/4392-8764-0x0000000005730000-0x000000000573E000-memory.dmp
memory/4392-8769-0x00000000058D0000-0x000000000591C000-memory.dmp
memory/4392-8773-0x00000000060F0000-0x0000000006111000-memory.dmp
memory/4392-8781-0x0000000007550000-0x00000000075FA000-memory.dmp
memory/4392-8780-0x00000000072F0000-0x00000000072F8000-memory.dmp
memory/4392-8763-0x0000000005710000-0x000000000571A000-memory.dmp
memory/4392-8758-0x0000000005690000-0x00000000056A8000-memory.dmp
memory/4392-8756-0x0000000005630000-0x0000000005652000-memory.dmp
memory/4392-8765-0x0000000005760000-0x000000000576E000-memory.dmp
memory/4392-8768-0x0000000005990000-0x0000000005CE7000-memory.dmp
memory/4392-8730-0x00000000007E0000-0x000000000083A000-memory.dmp
memory/4392-8766-0x0000000005780000-0x000000000578C000-memory.dmp
memory/4392-8772-0x0000000006D40000-0x0000000006D7C000-memory.dmp
memory/4392-8774-0x00000000072A0000-0x00000000072AC000-memory.dmp
memory/4592-655-0x00000124776D0000-0x0000012477B3E000-memory.dmp
memory/5060-8699-0x00000000057B0000-0x00000000057C4000-memory.dmp
memory/5060-8700-0x0000000005860000-0x00000000058BE000-memory.dmp
memory/5060-8698-0x0000000000FA0000-0x0000000000FF4000-memory.dmp
memory/5088-9715-0x00007FF9126F0000-0x00007FF9126F1000-memory.dmp
memory/5088-9714-0x00007FF9126B0000-0x00007FF9126B1000-memory.dmp
memory/5092-8268-0x00000000009B0000-0x00000000009F2000-memory.dmp
memory/5092-8306-0x00000000059B0000-0x00000000059BC000-memory.dmp
memory/5092-8305-0x0000000005990000-0x0000000005998000-memory.dmp
memory/5384-9713-0x00007FF913BC0000-0x00007FF913BC1000-memory.dmp
memory/5384-13750-0x000001517BFD0000-0x000001517BFDC000-memory.dmp
memory/5500-8674-0x0000000000670000-0x0000000000682000-memory.dmp
memory/5500-8675-0x0000000005030000-0x0000000005058000-memory.dmp
memory/5500-8676-0x00000000050E0000-0x0000000005154000-memory.dmp
memory/5500-8678-0x00000000007A0000-0x00000000007DB000-memory.dmp
memory/5608-9009-0x0000021017290000-0x00000210176FE000-memory.dmp
memory/5608-6065-0x0000021017290000-0x00000210176FE000-memory.dmp
memory/5952-9056-0x0000000000400000-0x00000000006E1000-memory.dmp
memory/6420-9686-0x000001694C200000-0x000001694C66E000-memory.dmp
memory/6488-6066-0x000002BE805F0000-0x000002BE80A5E000-memory.dmp
memory/6488-9045-0x000002BE805F0000-0x000002BE80A5E000-memory.dmp
memory/6748-9810-0x0000017059150000-0x00000170592EF000-memory.dmp
memory/6860-13617-0x00007FF911BB0000-0x00007FF911BC0000-memory.dmp
memory/6860-13618-0x00007FF911BB0000-0x00007FF911BC0000-memory.dmp
memory/6860-13732-0x0000021023D30000-0x0000021023E8E000-memory.dmp
memory/6860-13731-0x0000021006540000-0x00000210066DF000-memory.dmp
memory/6924-8800-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/6924-8755-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/7028-13416-0x000001F770660000-0x000001F7707FF000-memory.dmp
memory/7028-8969-0x000001F770660000-0x000001F7707FF000-memory.dmp
memory/7028-13748-0x000001F770660000-0x000001F7707FF000-memory.dmp
memory/7052-6002-0x000001A76D740000-0x000001A76DBAE000-memory.dmp
memory/7112-6770-0x0000000000B70000-0x0000000000C6A000-memory.dmp
memory/7112-8285-0x0000000000B70000-0x0000000000C6A000-memory.dmp
memory/7112-7553-0x0000000000B70000-0x0000000000C6A000-memory.dmp
memory/7260-11323-0x0000024AC9880000-0x0000024AC9CEE000-memory.dmp
memory/7448-9002-0x0000000001F80000-0x0000000001FBB000-memory.dmp
memory/7448-13827-0x0000000001F80000-0x0000000001FBB000-memory.dmp
memory/7452-8255-0x0000000000860000-0x0000000000BE6000-memory.dmp
memory/7452-8280-0x0000000003D10000-0x0000000003D4B000-memory.dmp
memory/7452-8279-0x0000000000860000-0x0000000000BE6000-memory.dmp
memory/7452-7554-0x0000000000860000-0x0000000000BE6000-memory.dmp
memory/7452-7555-0x0000000003D10000-0x0000000003D4B000-memory.dmp
memory/7572-8793-0x0000000000400000-0x00000000006E1000-memory.dmp
memory/7588-8341-0x0000000004A60000-0x0000000004F06000-memory.dmp
memory/7588-8350-0x00000000077B0000-0x00000000078D2000-memory.dmp
memory/7588-8963-0x0000000000400000-0x0000000000728000-memory.dmp
memory/7588-8964-0x0000000004A60000-0x0000000004F06000-memory.dmp
memory/7588-8965-0x0000000007630000-0x000000000766B000-memory.dmp
memory/7588-8966-0x00000000077B0000-0x00000000078D2000-memory.dmp
memory/7632-11117-0x0000013D8E760000-0x0000013D8EBCE000-memory.dmp
memory/7672-8328-0x0000000000DD0000-0x0000000000E00000-memory.dmp
memory/7792-8333-0x0000000000400000-0x00000000004ED000-memory.dmp
memory/7792-8962-0x0000000000400000-0x00000000004ED000-memory.dmp
memory/8084-9039-0x0000029C17BE0000-0x0000029C1804E000-memory.dmp
memory/8204-6296-0x0000000007FE0000-0x0000000007FE8000-memory.dmp
memory/8204-6291-0x0000000005AF0000-0x0000000005B02000-memory.dmp
memory/8204-6273-0x00000000007F0000-0x0000000000982000-memory.dmp
memory/8204-6794-0x000000000A310000-0x000000000A3A5000-memory.dmp
memory/8204-6791-0x000000000A030000-0x000000000A06B000-memory.dmp
memory/8204-6309-0x000000000BFB0000-0x000000000C016000-memory.dmp
memory/8204-6300-0x000000000BB90000-0x000000000BC22000-memory.dmp
memory/8204-6299-0x000000000B4A0000-0x000000000B4B0000-memory.dmp
memory/8204-6298-0x000000000B480000-0x000000000B48E000-memory.dmp
memory/8204-6297-0x000000000B4B0000-0x000000000B4E8000-memory.dmp
memory/8204-6274-0x0000000005310000-0x0000000005380000-memory.dmp
memory/8204-6295-0x00000000075A0000-0x00000000075DC000-memory.dmp
memory/8204-6294-0x0000000007550000-0x00000000075A0000-memory.dmp
memory/8204-6293-0x0000000005C30000-0x0000000005C3C000-memory.dmp
memory/8204-6292-0x0000000005B10000-0x0000000005B18000-memory.dmp
memory/8204-6275-0x00000000052E0000-0x000000000530C000-memory.dmp
memory/8204-6290-0x0000000005AA0000-0x0000000005AC2000-memory.dmp
memory/8204-6289-0x00000000059F0000-0x00000000059FA000-memory.dmp
memory/8204-6288-0x0000000005A50000-0x0000000005A64000-memory.dmp
memory/8204-6286-0x0000000005A10000-0x0000000005A46000-memory.dmp
memory/8204-6285-0x00000000059A0000-0x00000000059CC000-memory.dmp
memory/8204-6284-0x0000000005F10000-0x00000000064B6000-memory.dmp
memory/8204-6283-0x0000000005910000-0x0000000005954000-memory.dmp
memory/8204-6282-0x0000000005890000-0x00000000058C0000-memory.dmp
memory/8204-6281-0x0000000005850000-0x000000000585C000-memory.dmp
memory/8204-6280-0x0000000005740000-0x0000000005756000-memory.dmp
memory/8204-6279-0x00000000057E0000-0x0000000005840000-memory.dmp
memory/8204-6278-0x0000000005770000-0x00000000057DE000-memory.dmp
memory/8632-9057-0x0000000004890000-0x00000000048CB000-memory.dmp
memory/8632-13467-0x0000000004890000-0x00000000048CB000-memory.dmp
memory/9028-13447-0x00000000018C0000-0x000000000195F000-memory.dmp
memory/9180-6276-0x0000000000AC0000-0x0000000000AF0000-memory.dmp