Analysis
- user interaction
yes - max time kernel
788s - max time network
962s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
09/10/2026, 13:51
General
- Target battery.hta
- Size 2KB
- Sample261009-q6b2rays8p
- SHA256 e27754f14c2583d18e2a26a3056ccc643d16cd9e75c5c74dfdef918a6c1f35f7
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 TTPs 1 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 3 IoCs
- Drops file in Drivers directory 48 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Sets service image path in registry 3 TTPs 18 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Uses Session Manager for persistence 2 TTPs 4 IoCs
Creates Session Manager registry key to run executable early in system boot.
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Impair Defenses: Safe Mode Boot 1 TTPs 4 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 6 IoCs
- Checks for any installed AV software in registry 1 TTPs 45 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 31 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 10 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 19 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 49 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 60 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies Internet Explorer settings 1 TTPs 21 IoCs
- Modifies data under HKEY_USERS 18 IoCs
- Modifies registry class 64 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 60 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\battery.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa001ec728,0x7ffa001ec734,0x7ffa001ec7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,17435274684076778205,12990174895556551792,262144 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2132,i,7036982484466035711,15725089416355449448,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,15775819376075380982,17577475151241694380,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,10616454595958906001,5919033263442925635,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,7980484297355631418,1243750603077179706,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4736,i,16197447332310333172,16234926524555005765,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,1079656170816890809,8847188163072674462,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3960,i,1494961800989199725,14992943126646872402,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5044,i,7681767142398848544,14956585075603874182,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,6256928527388421865,4096730826714920458,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5512,i,12227956180844300094,3080024442352322206,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5532,i,9280710148486078640,7758016607283036272,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5460,i,5747259320036056959,13253143530399564567,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,14593430374763332530,6724925605897208996,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5888,i,332832530967041311,3295942395669494941,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6252,i,5268773888397930685,14083078771163930670,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,1544268077560699175,14824169327173956904,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6204,i,16363305466547544728,5744855834930980612,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5816,i,13701518186385015011,1555537132852708551,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,3734988087730027165,2215034607793568872,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5540,i,4478888366263931155,16977355147658781163,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4736,i,5912097370036745009,2664791540696748263,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5048,i,4755633837192877179,15484397704325477377,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5636,i,5678518120920549084,16868732662144079372,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6252,i,1502437183265249801,10244341955182144600,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4744,i,1813769732839477959,13964250166157296622,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3272,i,11003546200426175172,14230438651721082284,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6384,i,9108358481952213441,14590383286736311535,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=3432,i,2971830996575479232,6179957878709675413,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3508,i,7873378841332092418,12981780383506378204,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6580,i,9625306132864082967,15333103951661108773,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6544,i,6942058639107156453,6576731176590404119,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6816,i,7571487383631594154,11102164797143381166,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6828,i,16970893504124938508,9394526277061129890,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6844,i,3409906086651835721,13201542579988229336,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7076,i,12516149780643431340,1853714335636234730,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=3692,i,6099525325323913910,17426331265545526010,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=4848,i,17743291640148914125,16206840175596620679,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=3060,i,927563550739394239,13838712213829061804,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6196,i,1778528158553034811,13576014159388696890,262144 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=5632,i,18246616289668779920,11756917534001054262,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=6360,i,258672320360256695,2527210683254202723,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=6996,i,1255069636375197284,6991510694404116775,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7496,i,8397942988678709752,15595665280410975119,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7320,i,2596767341245751032,2905241905374085307,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8024,i,4688227103729387249,6729441845951088144,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7728,i,2936999050405873155,4885022653114552242,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=8420,i,11980553196924770615,6420434407189477132,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=8452,i,5373280204189253260,8414798550959838105,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=8528 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=8544,i,8741718406482123366,12902383350847769437,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=8576 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=8464,i,885932853077561656,4267884855169291929,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=8732,i,16200491698247653018,2576581801622830781,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=8760 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8844,i,14455188660368450607,6946282218459778926,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=8832 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=8832,i,17393599359597444295,12978878821395736799,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=8888 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9036,i,542471179036413751,4128186567664077949,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9024 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8908,i,12152862764883603353,10434456878234456780,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=8944 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8968,i,8894079113604221599,5257701383979654383,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=8544 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3304,i,17696279833093868310,18379620207291566069,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=6504,i,11377277758680189045,4748875586651838579,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=6692,i,9048731760599214307,17819565937891485157,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9348 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=9248,i,3617286293380420622,742411776546542677,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9228 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=9564,i,6581023664174879734,12548258012730017065,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=9484,i,851173234528599571,17105581545728223597,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6564,i,6654163191044492500,14848429572340251936,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8936,i,214537733578817090,3723232084101839550,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9232 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9644,i,16843864079716030083,11548784893601137392,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=8012 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9260,i,14693398090170322907,17623446652176015763,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9664 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7952,i,12119772694509547017,12254634187072735475,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9632 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=9296,i,13160184385741840048,9074755170974495538,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=6516,i,2691942345614719120,8544859487945297445,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9632 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=6696,i,15628563493539441156,12576633872407117868,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,2007212160126919354,18320540395604110864,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9492 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=9464,i,1011503524677019735,6012951034372542239,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9252 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6648,i,5566383439661672690,17078996882166758308,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9620 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9012,i,7915754874484261851,12741741753469166559,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9156 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9464,i,10086833819603768365,10372877659551426721,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9604 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=6624,i,16881126215718259496,297246973893683723,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9632 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --metrics-shmem-handle=9640,i,10756429555468787971,12115828127915535626,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=8544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=9864,i,4478088321401143066,6373589115617764574,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9952 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6648,i,14207093528918986265,17468970626238615249,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9460 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6648,i,4502315491777151222,1451631891407916490,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9012 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8852,i,9918582629221452896,5206616745368406270,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9760 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9460,i,3129341970731709892,12218543053843752433,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9652 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9708,i,12544532244984335615,3919141567893900387,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --metrics-shmem-handle=6600,i,3019124256900961159,5825136388425043398,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9532 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --metrics-shmem-handle=9644,i,10732405998888822601,13426076269535035467,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9200 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --metrics-shmem-handle=3304,i,3772931891265409153,11113172860567047364,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9736 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --metrics-shmem-handle=9808,i,12064016169686409915,5407592461973617361,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=10112 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --metrics-shmem-handle=10224,i,1336247206249241466,13310058385532299271,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=10180 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --metrics-shmem-handle=9620,i,9155841752821301492,17112349662430144925,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9748 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --metrics-shmem-handle=3988,i,5957328978311570972,17331019175411428567,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9652 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --metrics-shmem-handle=8808,i,3655211582804423969,16283471792070968296,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9908 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --metrics-shmem-handle=10700,i,12689793582619141040,5326257112731725151,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=10664 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --metrics-shmem-handle=10856,i,14459193108318395504,7098637952351160053,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=10480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --metrics-shmem-handle=10448,i,14951939336087774537,6765184003673491288,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=10472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --metrics-shmem-handle=10920,i,10493955038635582133,9002298619022223213,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=10924 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --metrics-shmem-handle=11272,i,8029085456808424464,17460621581215173013,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11212 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --metrics-shmem-handle=11064,i,3373514132757179314,10749123167839125205,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11260 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --metrics-shmem-handle=10864,i,17881968855632696423,7596412778965920353,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11016 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --metrics-shmem-handle=4984,i,17322906163230832626,4855123385138869767,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11112 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --metrics-shmem-handle=10908,i,1284698810475755015,13370335963047696212,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --metrics-shmem-handle=10920,i,14348694442028285156,16839656780357641078,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11452 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --metrics-shmem-handle=11392,i,7865293939857544102,17120916435474632966,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11116 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --metrics-shmem-handle=11568,i,7498848448012551844,9309830782745958876,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11596 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --metrics-shmem-handle=11776,i,2199513534553185949,9750661141852803958,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11608 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --metrics-shmem-handle=11760,i,4217717919956465812,14948197823602362486,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11752 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --metrics-shmem-handle=11792,i,162280345404404485,18419168720217124429,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11620 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --metrics-shmem-handle=11872,i,8764432206858182971,6982666227198713363,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=10972 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --metrics-shmem-handle=11668,i,9707140262235512172,1086800755324894585,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=12016 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=11616,i,7753860055904501836,15752127704285555406,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=12088 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe"C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\asw.8752028e7971fc7a\avg_antivirus_free_online_setup.exe"C:\Windows\Temp\asw.8752028e7971fc7a\avg_antivirus_free_online_setup.exe" /cookie:mmm_bav_013_999_raj_m:dlid_FREEGSR /ga_clientid:a5ab3cdf-7463-4106-be83-b9e59b40a047 /edat_dir:C:\Windows\Temp\asw.8752028e7971fc7a /geo:GB3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\asw-a5ab3cdf-7463-4106-be83-b9e59b40a047\common\icarus.exeC:\Windows\Temp\asw-a5ab3cdf-7463-4106-be83-b9e59b40a047\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-a5ab3cdf-7463-4106-be83-b9e59b40a047\icarus-info.xml /install /cookie:mmm_bav_013_999_raj_m:dlid_FREEGSR /edat_dir:C:\Windows\Temp\asw.8752028e7971fc7a /geo:GB /track-guid:a5ab3cdf-7463-4106-be83-b9e59b40a047 /sssid:74284⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
C:\Windows\Temp\asw-a5ab3cdf-7463-4106-be83-b9e59b40a047\common\icarus_ui.exeC:\Windows\Temp\asw-a5ab3cdf-7463-4106-be83-b9e59b40a047\common\icarus_ui.exe /cookie:mmm_bav_013_999_raj_m:dlid_FREEGSR /edat_dir:C:\Windows\Temp\asw.8752028e7971fc7a /geo:GB /track-guid:a5ab3cdf-7463-4106-be83-b9e59b40a047 /sssid:7428 /er_master:master_ep_c60580ff-150d-46f3-b398-831eae2438aa /er_ui:ui_ep_f14eb2b9-f4de-4726-9ba3-bcf8b78f0fba5⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Temp\asw-a5ab3cdf-7463-4106-be83-b9e59b40a047\avg-av\icarus.exeC:\Windows\Temp\asw-a5ab3cdf-7463-4106-be83-b9e59b40a047\avg-av\icarus.exe /cookie:mmm_bav_013_999_raj_m:dlid_FREEGSR /edat_dir:C:\Windows\Temp\asw.8752028e7971fc7a /geo:GB /track-guid:a5ab3cdf-7463-4106-be83-b9e59b40a047 /sssid:7428 /er_master:master_ep_c60580ff-150d-46f3-b398-831eae2438aa /er_ui:ui_ep_f14eb2b9-f4de-4726-9ba3-bcf8b78f0fba /er_slave:avg-av_slave_ep_56647fa6-4baf-45ea-aba7-ec050f4c071d /slave:avg-av5⤵
- Downloads MZ/PE file
- Drops file in Drivers directory
- Sets service image path in registry
- Uses Session Manager for persistence
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer /reg6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\aswAMSI.dll"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
- Modifies Internet Explorer settings
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /catinstall:"C:\Program Files\AVG\Antivirus\crts.cat" /basename:pkg_{af98c830-4af6-4eb6-ac37-02ebdd315ce2}.cat /crtid:BA50167A326BF266F7DF409760493D9727DA448A6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\wsc_proxy.exe"C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /svc /register /av_as_ppl6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\avDump.exe"C:\Program Files\AVG\Antivirus\avDump.exe" --pid 9460 --exception_ptr 000000D24455EB00 --thread_id 9468 --dump_level 21 --dump_file "C:\ProgramData\AVG\Antivirus\log\unp312831903935981639i-manual.mdmp" --comment "Cause: VectoredExceptionHandler Reason: sd is not loaded Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of exception instantiation. Program version: 26.9.11171.0" --min_interval 607⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Common Files\AVG\Overseer\overseer.exe"C:\Program Files\Common Files\AVG\Overseer\overseer.exe" /skip_uptime /skip_remediations6⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
-
C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\icarus.exe" /checkforupdates:avg-av-vps /silent7⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
-
-
C:\Program Files\AVG\Antivirus\securebrowser_setup.exe"C:\Program Files\AVG\Antivirus\securebrowser_setup.exe" /s /run_source=avg_install /language=en /make_default6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\nsp5F7C.tmp\AVGBrowserInstaller.exe"C:\Users\Admin\AppData\Local\Temp\nsp5F7C.tmp\AVGBrowserInstaller.exe" "C:\Program Files\AVG\Antivirus\securebrowser_setup.exe" /s /run_source=avg_install /language=en /make_default7⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\nsp5F7C.tmp\AVGBrowserUpdateSetup.exeAVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en&brand=7602&installargs= --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\GUM7034.tmp\AVGBrowserUpdate.exe"C:\Program Files (x86)\GUM7034.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en&brand=7602&installargs= --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies"9⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc10⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver10⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserUpdateComRegisterShell64.exe"11⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserUpdateComRegisterShell64.exe"11⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserUpdateComRegisterShell64.exe"11⤵
- Executes dropped EXE
- Modifies registry class
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTk5Ni42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTk5Ni42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezlENEYyMjRDLUM3MzctNDI1MS1CNjE2LThDRDY4QkQzQTY4NX0iIHVzZXJpZD0iY2ZjZDgwOGJhMTBjNDJkZThjNjVkYjU0YmI2YjAyOTIiIG1hY2hpbmVpZD0iNDg4RENBNEMxNUY5QTFEMzMwQUQzMTJCMzkxQTgwNEVCRTUxQTYwMjIwMDYwQjYzMjQxQTJDRkNENDI2QzI2MCIgbWFjaGluZWlkX2RhdGU9IjIwMjYxMDA5IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHRlc3Rzb3VyY2U9ImF1dG8iIHJlcXVlc3RpZD0iezE1M0Q2MTI1LUYzODctNEYxRS04QkVGLUVEREI3M0ZBRkM0RX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xOTk2LjYiIGxhbmc9ImVuIiBicmFuZD0iNzYwMiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iOTA2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg10⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en&brand=7602&installargs= --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies" /installsource otherinstallcmd /sessionid "{9D4F224C-C737-4251-B616-8CD68BD3A685}" /silent10⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --heartbeat --install --create-profile8⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=153.0.35454.54 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9ec7a04e0,0x7ff9ec7a04f0,0x7ff9ec7a05009⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1772,i,375292448342809001,13866843660673476720,262144 --field-trial-handle=2068,i,13789308743281590647,6647859133610393094,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,16281525235642954598,11353090514770902067,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2064 /prefetch:29⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,17359595008615367629,7345122392777539679,524288 --field-trial-handle=2068,i,13789308743281590647,6647859133610393094,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,16281525235642954598,11353090514770902067,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2328 /prefetch:119⤵
- Reads the TCP/IP host and domain name from the registry
- System Time Discovery
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2688,i,10224618335714747763,5512575016367685781,524288 --field-trial-handle=2068,i,13789308743281590647,6647859133610393094,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,16281525235642954598,11353090514770902067,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2700 /prefetch:139⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3700,i,12084265302001441984,6222548862511539322,1572864 --field-trial-handle=2068,i,13789308743281590647,6647859133610393094,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,16281525235642954598,11353090514770902067,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3748 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3792,i,2229236966115014859,13009352839945740970,1572864 --field-trial-handle=2068,i,13789308743281590647,6647859133610393094,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,16281525235642954598,11353090514770902067,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3924 /prefetch:19⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4268,i,15291054564929680310,16270327459296623834,1572864 --field-trial-handle=2068,i,13789308743281590647,6647859133610393094,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,16281525235642954598,11353090514770902067,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4284 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4468,i,12077074279547088657,13501657755606601599,524288 --field-trial-handle=2068,i,13789308743281590647,6647859133610393094,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,16281525235642954598,11353090514770902067,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4484 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=user_data_importer.mojom.BookmarkHtmlParser --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4476,i,1207828856857485921,12646993999990036716,524288 --field-trial-handle=2068,i,13789308743281590647,6647859133610393094,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,16281525235642954598,11353090514770902067,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4496 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,8050000720151119460,9676556665885516595,524288 --field-trial-handle=2068,i,13789308743281590647,6647859133610393094,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,16281525235642954598,11353090514770902067,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4924 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=user_data_importer.mojom.BookmarkHtmlParser --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4928,i,14484044986761807924,17618535135391849320,524288 --field-trial-handle=2068,i,13789308743281590647,6647859133610393094,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,16281525235642954598,11353090514770902067,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4972 /prefetch:149⤵
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --silent-launch8⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=153.0.35454.54 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9ec7a04e0,0x7ff9ec7a04f0,0x7ff9ec7a05009⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,7924032580846027118,2536812583104340780,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2288 /prefetch:119⤵
- Reads the TCP/IP host and domain name from the registry
- System Time Discovery
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1732,i,8806923748124942456,14223231963576343785,262144 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2252 /prefetch:29⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2656,i,10839190869506296480,18401836699806530260,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2724 /prefetch:139⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=micro_av.mojom.MicroAVService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3420,i,1022980559200968577,11575850376708524077,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3464 /prefetch:149⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3404,i,5700331575080893153,2690624079668298064,1572864 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3440 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4532,i,10369645175294936241,9948134855113918161,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4540 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4552,i,930684734495239387,16622561245337591008,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4624 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4660,i,5940766812948067040,12966826020105467854,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4600 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4544,i,7868510156270713130,3010656301664813515,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4624 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4532,i,4324681131076313518,10774364836552532840,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4664 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4956,i,15531024708177528781,14885799750616261983,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4960 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5112,i,963403529124075406,6021580324752225459,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5128 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5104,i,12836614271392172800,18366877492240127263,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5260 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5428,i,821299903603180896,4240905912794164572,1572864 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5396 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,2936790963994214834,1538037329217497417,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=4836 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,5036126700927010894,2673471649293119361,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=4716 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,17165690678574166786,3998845394112615223,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5864 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6044,i,16223003139708558657,12563938679497624121,1572864 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6072 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5088,i,5628832751934462827,3193938427805245517,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6212 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6196,i,2152604630777819832,16932531963646714314,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6364 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6500,i,17892185147807033890,1540156916765981056,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6504 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6652,i,17864306649647100767,2633179408443911469,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=5576 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6824,i,4205167802030230477,308181315723592708,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=6828 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6980,i,9308222854390415727,14925757991285409040,1572864 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7004 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7144,i,12516901213708235321,2354595112838268569,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=6000 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,5717704369070292002,12398856119914627935,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6496 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7128,i,3801057701730960931,863140891755114140,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=6816 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7420,i,16241809290448943623,8984508409868616427,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=6792 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6028,i,15638894922575273160,8114337613379995893,1572864 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=4752 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4776,i,13328366688231242762,10460710250544122342,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=4772 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7160,i,208168175432874752,480935922481267893,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=7720 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6636,i,14410791794943472242,6356050293255227003,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=7868 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6976,i,15944854085971671126,7581836770631704158,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8160 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=8096,i,16708911072311523491,16389140387471686364,1572864 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=8216 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8448,i,15747984316626930230,1452240400944549040,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=8136 /prefetch:149⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=8708,i,10233770518146341184,6943365495816182105,1572864 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=8732 /prefetch:99⤵
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8164,i,3129454694273123222,18410954605651470541,524288 --field-trial-handle=2256,i,13071173567624307193,1779345834847883168,262144 --variations-seed-version --pseudonymization-salt-handle=2260,i,5411890053543328083,8915014659207259214,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=8704 /prefetch:149⤵
-
-
-
C:\Program Files\AVG\Browser\Application\153.0.35454.54\Installer\setup.exesetup.exe /silent --create-shortcuts=0 --install-level=1 --system-level8⤵
- Drops file in Windows directory
-
C:\Program Files\AVG\Browser\Application\153.0.35454.54\Installer\setup.exe"C:\Program Files\AVG\Browser\Application\153.0.35454.54\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=153.0.35454.54 --attachment=C:\Windows\SystemTemp\AVGBrowser_installer.log "--attachment=C:\Program Files (x86)\AVG\AVGBrowserUpdater\updater.log" "--attachment=C:\Program Files (x86)\AVG\AVGBrowserUpdater\updater_history.jsonl" --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff678ed91c8,0x7ff678ed91d8,0x7ff678ed91e89⤵
- Drops file in Windows directory
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"9⤵
- Checks processor information in registry
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /tn "AVGDefaultBrowserTask" /tr "\"C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe\" --runonce --force" /sc once /st "15:06" /F8⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /tn "AVGDefaultBrowserTask2" /tr "\"C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe\" --runonce --force" /sc once /st "15:10" /F8⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Program Files\AVG\Antivirus\defs\26100902\engsup.exe"C:\Program Files\AVG\Antivirus\defs\26100902\engsup.exe" /avg /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
-
-
-
C:\Windows\Temp\asw-a5ab3cdf-7463-4106-be83-b9e59b40a047\avg-av-vps\icarus.exeC:\Windows\Temp\asw-a5ab3cdf-7463-4106-be83-b9e59b40a047\avg-av-vps\icarus.exe /cookie:mmm_bav_013_999_raj_m:dlid_FREEGSR /edat_dir:C:\Windows\Temp\asw.8752028e7971fc7a /geo:GB /track-guid:a5ab3cdf-7463-4106-be83-b9e59b40a047 /sssid:7428 /er_master:master_ep_c60580ff-150d-46f3-b398-831eae2438aa /er_ui:ui_ep_f14eb2b9-f4de-4726-9ba3-bcf8b78f0fba /er_slave:avg-av-vps_slave_ep_4df1a551-8086-448a-b4cb-b615629c2c4f /slave:avg-av-vps5⤵
- Uses Session Manager for persistence
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
-
C:\Program Files\AVG\Antivirus\defs\26100902\engsup.exe"C:\Program Files\AVG\Antivirus\defs\26100902\engsup.exe" /prepare_definitions_folder6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Checks processor information in registry
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --metrics-shmem-handle=10424,i,15427938578309654734,10538252669899404489,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=10696 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --metrics-shmem-handle=10928,i,3679006202869420639,3063903007535822151,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11320 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=10484,i,1332150712222757235,16739247327276814308,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=12268 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --metrics-shmem-handle=6672,i,10892416764443577812,18100876619204677000,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11408 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=12068,i,14761087077777171700,519933794107106852,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=12224 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=10496,i,3865858235326473381,10306146381098183646,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=10764,i,937273821980441403,6365570872808319140,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3304,i,2291779207088695379,8215134708301646309,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=10484 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=12260,i,15398335052146408937,9487910856722264545,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11764 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=11356,i,12433286892526649508,14656239395493014942,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9736 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=10764,i,5608660412609843911,17435964762438807817,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9736 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=10788,i,16312975359873403483,2502460000827334595,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9316 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=11588,i,4431596231981571086,9973962850044833995,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9736 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=12076,i,6114406755929552302,2655891839557004501,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=10700 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --metrics-shmem-handle=9712,i,5124797426728752247,8314669813333644024,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9624 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --metrics-shmem-handle=9468,i,5101475544674197818,9059391613373795747,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --metrics-shmem-handle=9488,i,13312751253419626593,13206776554120452334,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --metrics-shmem-handle=11336,i,5392654775980126709,3609537524288684808,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --metrics-shmem-handle=3304,i,4311035280022651870,12822245586333773060,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=12260 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --metrics-shmem-handle=9640,i,1248633874101287964,1898624501506930776,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11828 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --metrics-shmem-handle=10772,i,16145070806303411078,8427474457829710352,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=10740 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --metrics-shmem-handle=12436,i,9293227834788810813,5463391003966799522,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=12364 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --metrics-shmem-handle=12076,i,14283149345006873870,3576049435037071225,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=12400 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --metrics-shmem-handle=12696,i,6238659351353794280,12993471078008427463,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=12472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9244,i,1885472123269575588,3592393233095099687,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=12632 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=12604,i,7150310219427368096,5879957464081985256,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=12596 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=12652,i,3788229433783139381,17468802652243000127,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=12744 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=12400,i,15584625885789328618,11421006837560173871,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=12340,i,13467831563125962106,6872218176447472246,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11584 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=12816,i,9786545259435869361,14490623550777099307,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=11324 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --metrics-shmem-handle=12952,i,1580666911230261674,4457708115653215642,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9712 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=12948,i,4697350998072551460,7112724848684743595,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=12836 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=9776,i,11202075355405540589,832504551130723820,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=12892 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=12856,i,13730814650290591518,13698748994080074024,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=12800 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=12832,i,3565859627772976691,6873662229905267964,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=10708 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=148 --metrics-shmem-handle=12880,i,3496618812945868917,7861804495394969443,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=13124 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=12980,i,15643747037347471877,11633003699186164893,524288 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=13008 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=150 --metrics-shmem-handle=13308,i,7486919271771141461,10168140161476939509,2097152 --field-trial-handle=1904,i,14269361761135287111,1801149554717752930,262144 --variations-seed-version --mojo-platform-channel-handle=9228 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\aaf19256-00fa-4c64-b77d-ccc90f39442f_Wave.zip.42f\Wave\Wave.exe"C:\Users\Admin\AppData\Local\Temp\aaf19256-00fa-4c64-b77d-ccc90f39442f_Wave.zip.42f\Wave\Wave.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" /welcome3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=gpu-process --field-trial-handle=10100,8940069886918045920,5982097290593658424,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously,UIPumpImprovementsWin,WebRtcHideLocalIpsWithMdns --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --force-device-scale-factor=1 --pack_loading_disabled=1 --renderer-type=cef --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --mojo-platform-channel-handle=10060 /prefetch:24⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=10100,8940069886918045920,5982097290593658424,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously,UIPumpImprovementsWin,WebRtcHideLocalIpsWithMdns --lang=en-US --service-sandbox-type=utility --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --force-device-scale-factor=1 --pack_loading_disabled=1 --renderer-type=cef --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --mojo-platform-channel-handle=10768 /prefetch:84⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=10100,8940069886918045920,5982097290593658424,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously,UIPumpImprovementsWin,WebRtcHideLocalIpsWithMdns --lang=en-US --service-sandbox-type=none --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --force-device-scale-factor=1 --pack_loading_disabled=1 --renderer-type=cef --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --mojo-platform-channel-handle=10796 /prefetch:84⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --force-device-scale-factor=1 --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --field-trial-handle=10100,8940069886918045920,5982097290593658424,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously,UIPumpImprovementsWin,WebRtcHideLocalIpsWithMdns --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\AVG\Antivirus\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --force-device-scale-factor=1 --pack_loading_disabled=1 --renderer-type=cef --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=10952 /prefetch:14⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe"3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe"3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\AVG\Antivirus\afwServ.exe"C:\Program Files\AVG\Antivirus\afwServ.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\afwServ.exe"C:\Program Files\AVG\Antivirus\afwServ.exe"1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{75EA702C-E762-4061-8E88-9CF8A3899FA7}\AVGBrowserInstaller.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{75EA702C-E762-4061-8E88-9CF8A3899FA7}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --auto-pin-to-taskbar-on-run --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=msedge --import-cookies --system-level2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{75EA702C-E762-4061-8E88-9CF8A3899FA7}\CR_53469.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{75EA702C-E762-4061-8E88-9CF8A3899FA7}\CR_53469.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{75EA702C-E762-4061-8E88-9CF8A3899FA7}\CR_53469.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --auto-pin-to-taskbar-on-run --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data=msedge --import-cookies --system-level3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
-
C:\Program Files (x86)\AVG\Browser\Update\Install\{75EA702C-E762-4061-8E88-9CF8A3899FA7}\CR_53469.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{75EA702C-E762-4061-8E88-9CF8A3899FA7}\CR_53469.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=153.0.35454.54 --attachment=C:\Windows\SystemTemp\AVGBrowser_installer.log "--attachment=C:\Program Files (x86)\AVG\AVGBrowserUpdater\updater.log" "--attachment=C:\Program Files (x86)\AVG\AVGBrowserUpdater\updater_history.jsonl" --initial-client-data=0x288,0x28c,0x290,0x220,0x294,0x7ff6c30291c8,0x7ff6c30291d8,0x7ff6c30291e84⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\icarus.exe" /update:avg-av-vps /silent /refresh /ii_reason:asb_update_refresh4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\icarus.exe" /silent /refresh /ii_reason:asb_update_refresh /er_master:master_ep_43428ff4-e42d-4a3b-9036-65ee917a07bc /er_slave:avg-av-vps_slave_ep_98bef92b-e1b0-4400-967e-04047b670a33 /working_temp_dir:"C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\temp\asw-e3ce3a14-2729-4688-81ae-1927c0b154fe" /slave:avg-av-vps5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\defs\26100902\engsup.exe"C:\Program Files\AVG\Antivirus\defs\26100902\engsup.exe" /prepare_definitions_folder6⤵
- Checks for any installed AV software in registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Browser\Application\defs\26100902\engsup.exe"C:\Program Files\AVG\Browser\Application\defs\26100902\engsup.exe" /prepare_definitions_folder6⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
-
-
-
-
C:\Program Files\AVG\Browser\Application\vps_helper.exe"C:\Program Files\AVG\Browser\Application\vps_helper.exe" --install4⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserCrashHandler.exe"2⤵
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1996.6\AVGBrowserCrashHandler64.exe"2⤵
-
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Program Files\AVG\Antivirus\afwServ.exe"C:\Program Files\AVG\Antivirus\afwServ.exe"1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
-
C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus.exe" /repair:avg-av /silent /ii_reason:FwSvcRecovery1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\temp\asw-6580d392-4ec0-4d31-acb1-0c4a7721ebf6\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\temp\asw-6580d392-4ec0-4d31-acb1-0c4a7721ebf6\icarus.exe" /silent /ii_reason:FwSvcRecovery /er_master:master_ep_faef7b94-1afe-482a-a848-fac272c4aa35 /er_slave:avg-av-vps_slave_ep_fed6e641-ee94-4d45-bcca-220cbcfba96e /slave:avg-av-vps2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\defs\26100902\engsup.exe"C:\Program Files\AVG\Antivirus\defs\26100902\engsup.exe" /prepare_definitions_folder3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
-
-
-
C:\Program Files\Common Files\AVG\Icarus\avg-av\temp\asw-6580d392-4ec0-4d31-acb1-0c4a7721ebf6\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av\temp\asw-6580d392-4ec0-4d31-acb1-0c4a7721ebf6\icarus.exe" /silent /ii_reason:FwSvcRecovery /er_master:master_ep_faef7b94-1afe-482a-a848-fac272c4aa35 /er_slave:avg-av_slave_ep_9737b39b-ef95-4518-98c7-7b86dc09b542 /slave:avg-av2⤵
- Sets service image path in registry
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer /reg3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\AvEmUpdate.exe"C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" /U "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" /U "C:\Program Files\AVG\Antivirus\aswAMSI.dll"3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Program Files\AVG\Antivirus\x86\RegSvr.exe"C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
-
-
C:\Program Files\AVG\Antivirus\RegSvr.exe"C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\aswAMSI.dll"3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
- Modifies Internet Explorer settings
-
-
C:\Program Files\AVG\Antivirus\SetupInf.exe"C:\Program Files\AVG\Antivirus\SetupInf.exe" /catinstall:"C:\Program Files\AVG\Antivirus\crts.cat" /basename:pkg_{af98c830-4af6-4eb6-ac37-02ebdd315ce2}.cat /crtid:BA50167A326BF266F7DF409760493D9727DA448A3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
-
-
C:\Program Files\AVG\Antivirus\wsc_proxy.exe"C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /svc /register /av_as_ppl3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
-
C:\Program Files\AVG\Antivirus\avDump.exe"C:\Program Files\AVG\Antivirus\avDump.exe" --pid 3028 --exception_ptr 000000D6380FEE10 --thread_id 10912 --dump_level 21 --dump_file "C:\ProgramData\AVG\Antivirus\log\unp31283191239908429i-manual.mdmp" --comment "Cause: VectoredExceptionHandler Reason: sd is not loaded Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of exception instantiation. Program version: 26.9.11171.0" --min_interval 604⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Common Files\AVG\Overseer\overseer.exe"C:\Program Files\Common Files\AVG\Overseer\overseer.exe" /skip_uptime /skip_remediations3⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
-
C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus.exe" /checkforupdates:avg-av /silent4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
-
C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\icarus.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\icarus.exe" /checkforupdates:avg-av-vps /silent4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
-
-
C:\Program Files\AVG\Antivirus\AVGUI.exe"C:\Program Files\AVG\Antivirus\AVGUI.exe" /nogui3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
-
-
C:\Program Files\AVG\Antivirus\AvDump.exe"C:\Program Files\AVG\Antivirus\AvDump.exe" /unregister3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus_ui.exe"C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus_ui.exe" /sbr /eid=d6e7d9e3-54b6-4da2-8afb-1e54c564e9ab2⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
-
-
C:\Program Files\AVG\Antivirus\afwServ.exe"C:\Program Files\AVG\Antivirus\afwServ.exe"1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Direct Volume Access: Opens a physical disk for reading
- Checks processor information in registry
-
C:\Program Files\AVG\Browser\Application\153.0.35454.54\elevation_service.exe"C:\Program Files\AVG\Browser\Application\153.0.35454.54\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Program Files\AVG\Browser\Application\153.0.35454.54\elevation_service.exe"C:\Program Files\AVG\Browser\Application\153.0.35454.54\elevation_service.exe"1⤵
-
C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe"C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe" --runonce --force1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Direct Volume Access
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
6Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
8Software Discovery
1Security Software Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
setup.exe
@PaxHeader
@PaxHeader
@PaxHeader
Base.dll
Boot.dll
aswClnTg.htm
aswClnTg.txt
aswInfTg.htm
aswInfTg.txt
uiLangRes.dll
AVGSvc.exe
AVGUI.exe
AavmRpch.dll
AvBugReport.exe
AvConsent.exe
AvDump.exe
AvEmUpdate.exe
AvLaunch.exe
BreachGuardSdk.dll
BrowserCleanup.ini
CommChannel.dll
CommonRes.dll
HTMLayout.dll
avgArDisk.sys
avgArPot.sys
avgBoot.exe
avgDrvBrg.sys
avgElam.sys
avgKbd.sys
avgMonFlt.sys
avgNetHub.sys
avgRdr2.sys
avgRvrt.sys
avgSP.sys
avgSnx.sys
avgStm.sys
avgVmm.sys
avgbidsdriver.sys
avgbidsh.sys
avgbuniv.sys
Boost.txt
Crypto++.txt
Detours.txt
GSL.txt
ICU.txt.ipending.fe642fb0
JsonCpp.txt
LUA.txt.ipending.fe642fb0
LZMA.txt
OpenSSL.txt
PCRE.txt
Xerces.txt
brotli.txt
bsdiff.txt
bzip2.txt
c-ares.txt
cURL.txt
cef.txt
dnscrypt-proxy.txt
intel_asm.txt
jansson.txt
libPNG.txt
libevent.txt
libsodium.txt
lzfse.txt
mbedTLS.txt
mhook.txt
nanopb.txt
nghttp2.txt
protobuf.txt
pugixml.txt
rapidjson.txt
sqlite.txt
unrar.txt
vxWidgets.txt
xmlParser.txt
xxHash.txt
yara.txt
zlib.txt
OobeUtil.exe
RegSvr.exe
aswPEAntivirus.exe
aswPEBrowser.exe
aswPEBrowserExp.exe
aswPECommander.exe
aswPEShell.exe
aswRegLib.dll
aswShMin.exe
background-loading.png
background.png
waikamd64.mst
wxbase32u_vc_x64.dll.ipending.fe642fb0
wxmsw32u_core_vc_x64.dll
SecurityProductInformation.ini
SetupInf.exe
SupportTool.exe
VisthAux.exe
afwCoreClient.dll
afwRpc.dll
afwServ.exe
anen.dll
ashBase.dll
ashQuick.exe
ashServ.dll
ashShell.dll
ashTask.dll
ashUpd.exe
aswAMSI.dll
aswAux.dll
aswAv.dll
aswAvBootTimeScanShMin.exe
aswBrowser.dll
aswChLic.exe
aswCmnBS.dll
aswCmnIS.dll
aswCmnOS.dll
aswDld.dll
aswEngLdr.dll
aswEngSrv.exe
aswIP.dll
aswLog.dll
aswProperty.dll
aswPropertyAv.dll
aswRunDll.exe
aswRvrt.dll
aswSqLt.dll
aswVmm.dll
aswW8ntf.dll
aswavdetection.dll
aswcomm.dll
aswdetallocator.dll
aswhook.dll
aswidpm.dll
aswidsagent.exe
aswntsqlite.dll
aswpsic.dll
aswremoval.dll
aswsecapi.dll
aswwinamapi.dll
avgToolsSvc.exe
browser_pass.dll
burger_client.dll
cef_renderer.dll
chrome_100_percent.pak
chrome_200_percent.pak
chrome_elf.dll
crts.cat
d3dcompiler_47.dll
engsup.ini
directml.dll
dll_loader.dll
dnd_helper.dll
driver_bridge.dll
edge_renderer.dll
event_manager.dll
event_manager_burger.dll
event_manager_er.dll
event_manager_ga.dll
event_routing.dll
event_routing_rpc.dll
ffl2.dll
firefox_pass.exe
gaming_hook.exe
about.js
antiRansomware.js
antiTrack.js
ask.ogg
done.ogg
notify.ogg
threat.ogg
breachGuard.js
browserDetection.js
browserDetectionWindow.html
browserExtensions.js
core.js
darkWebMonitor.js
dashboard.js
dataShredder.js
doNotDisturb.js
driverUpdater.js
dsMetadata.json
feedbackForm.js
firewall.js
help.js
i18n.js
kin.js
libs.js
locale-en_GB.json.ipending.fe642fb0
mainCss.css
mainCss_light.css
mainFont.css
mainLayout.js
mainLayoutCss.css
mainSprite.css
mainVars.json
mainVars_o2.json
mainWindow.html
myLicenses.js
napi.js
napiAdapter.js
napiExtensions.js
network.js
notifications.js
offline.htm
overlay.html
pap.js
passwordProtection.js
plugins.js
ras.js
rescueDisk.js
scans.js
search.js
secureDns.js
sensitiveData.js
settings.js
shields.js
smartScan.js
software.js
svelteComponents.js
svelteInternal.js
svgFlags.css
svgInline.svg
system.js
tray.js
tuneup.js
update.js
updatefile.json
virusChest.js
webCam.js
hns_tools.dll
icudtl.dat
jsbridge.dll
libEGL.dll
libGLESv2.dll
libcrypto-3-x64.dll
libssl-3-x64.dll
libwaapi.dll
libwaheap.dll
libwalocal.dll
libwaresource.dll
libwautils.dll
libwavmodapi.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-fibers-l1-1-1.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-kernel32-legacy-l1-1-1.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-sysinfo-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
local.crt.manifest
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_1.dll
vcruntime140_threads.dll
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
vi.pak
zh-CN.pak
zh-TW.pak
log.dll
mfc140.dll
mfc140u.dll
mfcm140.dll
mfcm140u.dll
module_lifetime.dll
nos.dll
ntp_time.dll
onnxruntime.dll
onnxruntime_providers_openvino.dll
onnxruntime_providers_shared.dll
openvino.dll
openvino_auto_batch_plugin.dll
openvino_auto_plugin.dll
openvino_hetero_plugin.dll
openvino_intel_npu_plugin.dll
openvino_onnx_frontend.dll
overseer.exe
perfstats.dll
process_monitor.dll
protobuf.dll
resources.pak
sched.exe
securebrowser_setup.exe
serialization.dll
59da6616-b519-4a70-ab1b-eb30ba7c638b.ini
6c2ddd46-98c3-4bad-a686-69607fee932a.xml
cf934a21-33b2-41f3-bd80-e79559fb1e73.ini
config.def
config.def
config.ini
config.ini
shepherdsync.dll
shred.exe
snapshot_blob.bin
snxhk.dll
streamback.dll
su_adapter.dll
su_common.dll
su_controller.dll
su_worker.exe
libEGL.dll
libGLESv2.dll
task_performance_logger.dll
tasks_core.dll
tbb12.dll
uet_client.dll
v8_context_snapshot.bin
vaarclient.dll
wa_3rd_party_host_32.exe
wa_3rd_party_host_64.exe
wsc.dll
wsc_proxy.exe
wsc_proxy.exe.manifest
AavmRpch.dll
AvDump.exe
RegSvr.exe
ashShell.dll.ipending.fe642fb0
aswAMSI.dll
aswBrowser.dll
aswCmnBS.dll
aswCmnIS.dll
aswCmnOS.dll
aswProperty.dll
aswPropertyAv.dll
aswRunDll.exe
aswhook.dll
dll_loader.dll
dnd_helper.dll
firefox_pass.exe
gaming_hook.exe
API-MS-Win-core-xstate-l2-1-0.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-fibers-l1-1-1.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-kernel32-legacy-l1-1-1.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-sysinfo-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
local.crt.manifest
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
ucrtbase.dll
vccorlib140.dll
vcruntime140.dll
vcruntime140_threads.dll
snxhk.dll
ArPot.dll
ArPotEx32.dll
ArPotEx64.dll.ipending.6b880958
BCUEngine.dll
PushPin.dll
Sf2.dll
algo64.dll
aswAR.dll
aswArray.dll
aswBoot64.dll
aswCleanerDLL.dll
aswCmnBS.dll
aswCmnIS64.dll
aswCmnOS.dll
aswEngin.dll
aswFiDb.dll
aswFrrr.dll
aswHds.dll
aswJsFlt.dll
aswJsFlt64.dll
aswOnnxr.dll
aswQcr.dll
aswRawFS264.dll
aswRep.dll
aswScan.dll
certs.map
db_agdx.dat
db_ap2.dat
db_array.dat
db_as.dat
db_bank.dat
db_cf.dat
db_cmd.nmp
db_cmd.sig
db_conb.dat
db_dex.nmp
db_dex.sig
db_dh.dat
db_dns.nmp
db_dns.sig
db_dsign.dat
db_dyna.nmp
db_dyna.sig
db_el.dat
db_elf.nmp
db_elf.sig
db_elfa.nmp
db_elfa.sig
db_evoapk.dat
db_evope.dat.ipending.6b880958
db_ext.dat
db_fn.nmp
db_fn.sig
db_frrr.dat
db_java.nmp
db_java.sig
db_js.nmp
db_js.sig
db_med.nmp
db_med.sig
db_mu.dat
db_mx4.nmp
db_mx4.sig
db_mx95.nmp
db_mx95.sig
db_o7.nmp
db_o7.sig
db_ob2.dat
db_pay.dat
db_pdf.mml
db_pe.nmp
db_pe.sig
db_pe3.dat
db_pph.dat
db_qcr.dat
db_sf.dat
db_sn.nmp
db_sn.sig
db_snh.dat
db_sp.dat
db_str.nmp
db_str.sig
db_swf.nmp
db_swf.sig
db_symtrnl.dat
db_tlsh.dat
db_tx.dat
db_w6.nmp
db_w6.sig
db_wat.nmp
db_wat.sig
db_wh2.dat
db_xtn.map
def.ini
engsup.exe
exts.dll
fwAux.dll
gvma64.dat
idp.dat
list_d.txt
list_i.txt
onnxruntime.dll
swhealthex2.dll
uiext.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
AVGBrowser.exe
browser_proxy.exe
db_cmd.map
db_dex.map
db_dns.map
db_dyna.map
db_elf.map
db_elfa.map
db_fn.map
db_java.map
db_js.map
db_med.map
db_mx4.map
db_mx95.map
db_o7.map
db_pe.map
db_sn.map
db_str.map
db_swf.map
db_w6.map
db_wat.map
AVGBrowserProtect.exe
initial_preferences
vps_helper.exe
config.def
product-info.xml
config.def
product-info.xml
overseer.def
OpenSans-Bold.ttf
OpenSans-Italic.ttf
OpenSans-Light.ttf
OpenSans-Regular.ttf
RobotoCondensed-Bold.ttf
RobotoCondensed-Regular.ttf
proximanova-bold.otf
proximanova-light.otf
proximanova-regular.otf
Blocked.htm
image001.png
consent_profile.wprp
config.xml.ipending.fe642fb0
macaddr.ori.ipending.fe642fb0
networks.xml.ipending.fe642fb0
ports.xml.ipending.fe642fb0
rules.ori.ipending.fe642fb0
templates.ori.ipending.fe642fb0
dnddetection.dat
dnddetection.dat.ver
dndrules.dat
dndrules.dat.ver
event_manager.log
overseer_unattend.xml
profile.wprp
settings-26.9.11171.3833.ori
snx_gconfig.xml
event_manager.log
icarus.log
icarus.ini
icarus.ini
icarus.ini
icarus.ini
icarus.ini
icarus.ini
icarus.ini
icarus.ini
icarus.ini
AvEmUpdate.log
AvEmUpdate.log
AvEmUpdate.log
AVG Secure Browser Profile.ico74520b5d-ce05-4493-81e7-ae3fc0cc08bc.tmp
data_1
data_1
temp-index
temp-index
the-real-index
contentScript.js
48x.png
messages.json
ThemeProvider-DDRvr63X.css
content-script.js-BgBXVCYJ.js
games-DQHT73Kz.svg
manifest.json
service-worker-loader.js
popup.html
home.html
Network Persistent Statec3cf0323-eddd-490e-b9a1-f1f18220cce6.tmp
Preferences
Preferences3680cbe4-3e8f-4b53-8ad5-844a7221b046.tmp
Preferencesfb9c0bfa-c0e0-4140-832d-52bd06f35d5f.tmp
Secure Preferencesfaaca8e4-aef5-464d-97ec-29a65ee2da97.tmp
Secure Preferencesfb8488b4-efa3-4245-8b17-ab204d6a5c45.tmp
temp-index
temp-index
the-real-index
Local State
Local State1474d301-ed8c-4010-87f5-55d9b14e94d4.tmp
Local State44af9416-c9ff-4e50-b5b1-de41b7493db2.tmp
Local Stateff152285-1894-4404-a343-1d02a60c16f1.tmp
VariationsSafeSeedV2fbc0d48c-e16f-48b6-979b-f3d7f23c7ca4.tmp
metadata.json8da587f6-aebf-49b3-b773-77aefc1687ab.tmp
148cd90b-65eb-4373-9840-0b1ef6d1880e.tmp
15110162-5654-45af-b6d8-ee8cfa25e214.tmp
1e5d0cdb-08f0-4fa2-a991-46340b2cdc44.tmp
206f6057-1a1d-4671-8c9f-3f8388e8853f.tmp
20d3b23c-d3cd-45f7-b356-c654d4eb0760.tmp
3007559d-9a96-4030-b5ec-ca869ed9fcb3.tmp
30611c32-47fd-494d-aba4-113c710f0a37.tmp
34a66106-d383-45de-b7a8-43a55b22bc96.tmp
4826330a-8270-4ba9-82c1-cff0039260cf.tmp
4a71c76c-d595-4b14-9180-9241e7e83b8a.tmp
58645c3a-14cd-491f-b784-71bed09f9703.tmp
75b7dde3-439b-4684-873a-38ae800b36f0.tmp
7b76cad4-569a-41b1-b208-258926a9b345.tmp
9dbe4f17-e659-468f-b761-fa4dc1b3586e.tmp
0521e85f-c366-4f0b-8283-dcb126b52268.tmp
0af88428-9180-42f1-bd66-b468097a18fb.tmp
0f3af3fa-a6a2-4b76-9a89-956902ab3b1c.tmp
18077507-c5c6-4234-a8da-f6d408b3f7c2.tmp
2761d7a6-c46f-4b60-b6cf-e01d4a11acc9.tmp
2e1c32c1-b58e-4a44-a88e-d480ceaa4852.tmp
43ffeed5-46af-4f2a-ac72-51c6ada88444.tmp
473057c6-f4c1-407d-b320-4e08764c6376.tmp
5587dffd-d280-43fa-8144-622339e0013a.tmp
55a1a4b0-9256-4840-a8e8-7ac067cdf8a0.tmp
5d9837bb-bcfe-4dfd-9fc5-12e4c685cb0a.tmp
690a0da6-0ff6-40b6-9908-671436599af4.tmp
730c8773-064e-4974-8e7d-2be7c2ba29f7.tmp
7483e14c-7847-4112-b153-1beaadc745d7.tmp
7556adf4-79a7-48b7-a837-b18de666be39.tmp
8b371fcf-448a-4e85-9a4b-71adb11cdc72.tmp
9b08676d-a5a4-4d76-b539-0991c179e550.tmp
9c755337-7625-40a3-859e-a8b25d00ff3c.tmp
f_000016
f_000017
f_000018
f_000019
f_00001a
f_00001b
f_00001c
f_00001d
f_00001e
f_00001f
f_000024
f_000025
f_000027
f_000028
f_000029
f_00002a
f_00002c
f_000031
f_000032
f_000033
f_000034
f_000035
f_000036
f_000037
f_000038
f_000039
f_00003b
f_000049
f_00004a
f_00004b
f_00004c
f_00004d
f_00004e
f_00004f
f_000051
f_000053
f_000054
f_000055
f_000056
f_000057
f_000059
f_000083
f_000085
f_00008b
f_00008d
f_0000a7
f_0000a8
f_0000b1
f_0000b5
f_0000b6
f_0000b7
f_0000b8
f_0000b9
f_0000ba
f_0000bb
f_0000bc
f_0000bd
f_0000be
f_0000bf
f_0000c0
f_0000c1
f_0000c2
f_0000c3
f_0000c4
f_0000c5
f_0000c6
f_0000c7
f_0000c8
f_0000c9
f_0000ca
f_0000cb
f_0000da
f_0000f2
f_0000f3
f_0000f4
f_0000f5
f_0000f6
f_0000f7
f_0000f8
f_000121
f_000124
f_000128
f_000129
f_00012a
f_00012b
f_000146
f_000147
f_000158
f_00015c
f_00015d
f_00015e
f_00015f
f_000160
f_000162
f_000164
f_000165
f_000166
f_000167
f_000168
f_00016a
f_00016b
f_00016c
f_00016e
f_00016f
f_000170
f_000171
f_000172
f_000176
f_00017b
f_000187
f_00018d
f_00018e
f_00018f
f_000190
f_000193
f_000194
f_000195
f_000196
f_00019a
f_00019f
f_0001a0
f_0001a1
f_0001a2
f_0001a3
f_0001a4
f_0001a5
f_0001a6
f_0001a7
f_0001aa
f_0001ab
f_0001ac
f_0001ad
f_0001af
f_0001b0
f_0001b3
f_0001b5
f_0001c0
f_0001c4
f_00021d
f_00022b
f_00023d
04c10bda53aa27e1_0
1811e494e29f05e7_0
355a12f162c049d5_0
36213079ad47726e_0
399d0cb97e9e2cd1_0
3b1a33e9085489d8_0
3c7357fbb5287120_0
3fa0bc6884c25b76_0
4fb946a0b56685a0_0
56f317d57ffd050a_0
5ff1defc4831c5d8_0
6c9aee7d6e2e8a45_0
77c99f90540ea147_0
83848e6ac8a25b41_0
83d0183d6ba87620_0
93bb761fb9673218_0
94ff9c3700ed061e_0
9953f16ae57ae526_0
ad4496aace93ec63_0
b220e0ca028847b2_0
b41b7722eeb3a901_0
b6804ad5aafb21be_0
d024c83a6e4df438_0
d21b66421f711e8e_0
d3dd03ef64a8b30c_0
de0db92bde3b8cf4_0
df53bad28ea1e322_0
e3947e5765b5ba43_0
temp-index
temp-index
temp-index
temp-index
temp-index
temp-index
the-real-index
the-real-index
rules.fbs
rules.json
messages.json
craw_background.js
CURRENT
MANIFEST-000001
MANIFEST-000001
000005.ldb
LOG.old
MANIFEST-000001
11439ecf-708f-491c-9500-37330c4437a6.tmp
31e7d515-5d52-4783-9b6f-9b231c728f1d.tmp
7503e4a9-06a7-4b44-be5a-2439586b4f6a.tmp
855ce15b-fa25-4a19-9489-a4715f7ab192.tmp
fa352d2e-fb61-4244-be17-a744f5e81a6e.tmp
fc1c665e-398f-4c72-afb1-65ba111b29ba.tmp
index
index.txt
index.txt.tmp
index.txt
index.txt.tmp
08b99d499107ba17_0
653e56b4b6556a9e_0
ba23d8ecda68de77_0
f3ab1e1292e135fa_0
temp-index
temp-index
temp-index
temp-index
temp-index
temp-index
Session_13436028444957623
eb595a0ac5b50199_0
f3896191a0498703_0
temp-index
temp-index
temp-index
temp-index
the-real-index
data_0
data_1
data_2
data_3
a1251932-ae7a-4a52-b4cd-a012c1597d2f.tmp
a6f79594-f004-4a87-b706-a968214fcd08.tmp
ad1d635d-1f9d-4155-9839-a67c78e73a9a.tmp
ad256f07-569a-4834-97ce-c942275da4cf.tmp
b3781ad4-ca82-4a6d-94e8-17c83fce1340.tmp
bf5494a0-6086-4374-8d51-99e45057c406.tmp
c33424ed-de27-41ca-9cc8-b57dd4270f53.tmp
c9cd6a84-2092-4646-825a-cd4470191dcd.tmp
dda0b128-64f1-49af-9145-79cb6927aa78.tmp
e15cc3a5-8867-4311-bb18-aa8a91e5d576.tmp
e24d74b2-9249-458d-8c64-7bdaef2603d1.tmp
e4bc88f3-d527-4ef0-aff1-ee6df77d2471.tmp
e7a9994a-dcee-4221-92cb-adb75ecb62ff.tmp
fbcdc8d9-3cc6-4515-acd1-98f6cd8e53c2.tmp
bgcknjicjaalgonkmpjidokpmfpfcgfe_62446.crx
cnheomalllffeijbicglppnklodakahj_15149.crx
eckionmoiajpjncecfebdmmbcboblkja_28105.crx
fbgcedjacmlbgleddnoacbnijgmiolem_60608.crx
golnhmmbkgmbbkbpgommbpngbeehmepc_48237.crx
ldhlapfekgpknjhffocedpflhipfpjbi_58758.crx
mncljonpafkimgngjkhgilbbmgapllno_40448.crx
olldjcoidgojgheennokeojekgepgnhg_19529.crx
ae71d0ea-0fea-406a-8ed4-6a5e0395393e.tmp
b16e6537-5823-45c7-8813-4fe81a01fc20.tmp
b314eef1-027e-4dc0-8948-e842ecb1ff93.tmp
c82b9d7d-a595-4ff6-bc50-0f09fdfbc270.tmp
d5f068df-a614-46ef-b0e8-b79617237132.tmp
f377fa2e-910f-458c-a8d1-f5068511916c.tmp
f82b7b3f-3a64-493f-aff6-3915a40f079f.tmp
iconcache_idx.db
iconcache_idx.db
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
4590434b-0ee2-4498-8632-43b8d446dd17.tmp
app4d71c56f94690bff.tmp
appffef18e9fea699f0.tmp
d32af9a0-f9b0-48a2-bdce-a65d7b40f382.tmp
AVGBrowserInstaller.exe
messages.json
128x.png
16x.png
32x.png
48x.png
messages.json
background.js
icon16.png
icon48.png
icon.png
icon.svg
manifest.json
webstore.js
messages.json
background.js
contentScript.css
contentScript.js
fonts.css
debugPage.css
debugPage.js.LICENSE.txt
manifest.json
messages.json
messages.json
background.bundle.js
content.bundle.js
options.bundle.js
manifest.json
options.html
popup.html
EulaPopupCS.js.LICENSE.txt
messages.json
alert.474be14797d7e695bcaf.svg
alert.bcb86b4c2f4c2b1da9cd.svg
enabled-checkbox.svg
ic-16-close.svg
ic-24-checkbox-unchecked.svg
ic-40-eula-info.svg
info.56a5f71fdc727a40de66.svg
logo.d1d5a0b776e710da9bf9.svg
menu-audio.svg
menu-camera.svg
no-video-illustration.319bd3f600c239b14382.svg
no-video-illustration.56c2d608d73de31d2e45.svg
status_ok.90f98be2a1cdcb583c19.svg
status_ok.d443655b70d223250fa8.svg
tooltip.50ab4baeb9ac63633068.svg
tooltip.e5ee59ba4cf836fe189b.svg
botguardCS.js.LICENSE.txt
iframePopupCS.js
manifest.json
videoDownloaderBG.js
videoDownloaderCS.js
messages.json
messages.json
messages.json
popup.html
icon48.png
messages.json
antiPhishingManagerCS.js
dbd3538b1156b7e72f803ebafa910cc3.svg
e1ea737a660bdee28b836f9923b87295.svg
e37aad4c5220edaeeb9e6544071aaeb3.svg
manifest.json
serviceWorker.js
content.css
messages.json
messages.json
app.html
allowed.png
blocked.png
icon_close.png
logger_icon.png
logger_table_icon.jpg
pro.png
table_list_icon.png
table_regex_icon.png
warning.png
background.bundle.js
logger.bundle.js.LICENSE.txt
manifest.json
options.html
messages.json
chat-128.png
chat-16.png
chat-32.png
chat-48.png
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
128x128.png
16x16.png
32x32.png
48x48.png
rootServiceWorker.js
background.js
content.js
glyph.png
icon128.png
icon16.png
icon48.png
popup.html
background.js
content.css
content.js
icon128.png
icon16.png
icon48.png
popup.html
settings.html
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
16.png
32.png
48.png
64.png
bg-worker.js
manifest.json
options.html
popup.html
messages.json
icon128.png
icon16.png
icon32.png
icon48.png
popup.html
index.html
manifest.json
worker.js
background.js
contentScript.js
index.html
pageScript.js
0d5634a7-8c89-45cd-be8e-be6afc262bef.tmp
49677506-43d0-4662-8a4d-deed07ee170d.tmp
temp-index
the-real-index
NCcacheIpm.dat
default.exc
Unconfirmed 105688.crdownload
Wave.zip.crdownload
icarus.exe
icarus_mod.dll
memory/2212-4316-0x000001F081DF0000-0x000001F081EF0000-memory.dmp
memory/2212-4341-0x000001F081C70000-0x000001F081C90000-memory.dmp
memory/2212-4315-0x000001F081C30000-0x000001F081C50000-memory.dmp
memory/2212-4307-0x000001F0801E0000-0x000001F0802E0000-memory.dmp
memory/2212-4355-0x000001F094230000-0x000001F094250000-memory.dmp
memory/8380-16888-0x00007FFA1C840000-0x00007FFA1C850000-memory.dmp
memory/8380-16889-0x00007FFA1C840000-0x00007FFA1C850000-memory.dmp
memory/8380-16894-0x0000029542750000-0x00000295428C6000-memory.dmp
memory/13368-13203-0x000002B44E4E0000-0x000002B44E679000-memory.dmp
memory/13368-12873-0x00007FFA1E260000-0x00007FFA1E261000-memory.dmp
memory/15288-16883-0x0000029196670000-0x0000029196809000-memory.dmp