AvisLoader auto.exe UAC bypass via ICMLuaUtil elevation moniker

Arnold Chan@slaz

•updated Sep 25, 2026•0•0•2

Detects execution of auto.exe (associated with AvisLoader) combined with a specific registry-based UAC bypass technique using the ICMLuaUtil COM elevation moniker (CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7). This pattern is characteristic of UACME method 41 to achieve privilege escalation.