Serious Discussion Trojan:Win64/Lazy.PGLI!MTB recurring after reboot — ParallelRegi.exe, scheduled-task persistence and com_lib_engine

[Achdad]

Hi everyone,

I’m sharing this case because I recently dealt with a recurring Trojan:Win64/Lazy.PGLI!MTB detection on Windows 11, and the technical details may help someone who encounters the same or a similar infection.

The incident appears to have started after I ran a program downloaded from the internet that I initially believed was legitimate. The original downloaded executable was later deleted, so I cannot prove the initial infection vector with certainty.

Microsoft Defender repeatedly detected:

Trojan:Win64/Lazy.PGLI!MTB<br>Threat ID: 2147952503
The detections occurred multiple times with different process IDs, including after reboots.

The recurring process was:

%LOCALAPPDATA%\Temp\ParallelRegi.exe
SHA-256:

F3FA49863B0512E7065F9B3B4353F8D7840213EDB47A92BDFC32BA61592251D1
During the investigation, I found two suspicious scheduled tasks:

dispatcherhost_arm_releasSPKVWorker<br>heaphost_v3
Both launched:

C:\ProgramData\com_lib_engine\Info-Injector.exe
The com_lib_engine directory contained a collection of Autodesk Identity Manager-related files, including:

Info-Injector.exe<br>audio_ext.dat<br>task.ini<br>AdIDSDKLog.dll<br>AdpSDKWrapper.dll<br>AdskProxyManager.dll<br>AdSSOServices.dll<br>IdIPCServer.dll<br>IdServicesCore.dll<br>sqlite3.dll<br>WebView2Loader.dll
Info-Injector.exe had a valid Autodesk Authenticode signature.

Its version information showed:

FileDescription : Autodesk Identity Manager<br>ProductName : Autodesk SSO<br>OriginalFilename : AdskIdentityManager.exe<br>CompanyName : Autodesk, Inc.<br>FileVersion : 1.11.9.11
SHA-256:

D15EBC1C55781E891AAB66B1E7AD34373FE26ECED64194121A0F7803A604C042
This suggests that Info-Injector.exe was a legitimate Autodesk binary renamed from AdskIdentityManager.exe.

Two files in the same directory were especially unusual:

audio_ext.dat<br>task.ini
SHA-256:

audio_ext.dat<br>7E009715B7270037274FEC145DD99E9E7DD33913AB6EA49AACAAB089C6B1111F<br><br>task.ini<br>F08AEC4DE0384B1509E651E0202FEEF63FF67739BB3D2B920DB3B75A487C54A1
task.ini did not contain normal INI-style configuration data and appeared to contain obfuscated or binary content.

audio_ext.dat had an entropy of approximately:

7.9217 bits/byte
which is consistent with highly compressed, encrypted or heavily obfuscated data, although this alone does not prove that the file is malicious.

I also found multiple temporary directories created during the same time window. Each contained identical copies of:

Info-Injector.exe<br>audio_ext.dat<br>task.ini
The copies had identical SHA-256 hashes.

One important caveat: I had attempted to launch the original suspicious program several times while temporarily disabling antivirus protection, so the repeated temporary-directory extraction may have been caused by my own repeated execution attempts rather than autonomous malware replication.

During the live investigation, ParallelRegi.exe was observed holding an open handle to:

C:\ProgramData\com_lib_engine\Info-Injector.exe
This established a direct interaction between the two components, although it did not prove the exact direction of execution or causality.

Remediation performed​

I first disabled and then removed the two scheduled tasks.

I then removed:

C:\ProgramData\com_lib_engine
the identified temporary copies of the staged bundle, and:

%LOCALAPPDATA%\Temp\ParallelRegi.exe
After removal, I rebooted the system and verified that:

ParallelRegi.exe = not present<br>ParallelRegi process = not running<br>com_lib_engine = not present<br>scheduled tasks = not present
I then ran:

• Microsoft Defender Quick Scan
• Microsoft Defender Offline Scan
• another reboot
• another persistence check

No new detections appeared.

The most recent Defender detection remained the pre-remediation event, and none of the removed files or scheduled tasks reappeared after the subsequent reboots.

Current status​

At the time of writing, the system has remained clean after reboot, Quick Scan and Defender Offline Scan.

Microsoft Defender is now the primary antivirus, with real-time protection, behavior monitoring and the main antimalware services enabled.

Important limitation​

Because the original downloaded executable was deleted before the full investigation, I cannot prove that it was the initial dropper, although the timing strongly suggests that it was related.

I’m sharing these indicators mainly so that anyone searching for:

ParallelRegi.exe<br>com_lib_engine<br>Info-Injector.exe<br>dispatcherhost_arm_releasSPKVWorker<br>heaphost_v3<br>Trojan:Win64/Lazy.PGLI!MTB
can compare them with their own system.

If anyone has seen the same combination of artifacts, especially the Autodesk Identity Manager bundle together with audio_ext.dat and task.ini, I would be interested to know whether it matches a known malware family, loader or persistence technique.

 

[Bot AI]

I removed the two suspicious scheduled tasks, ParallelRegi.exe, com_lib_engine and the temporary copies. After reboots, Defender Quick and Offline scans, none returned. Does this combination of a renamed Autodesk Identity Manager binary, audio_ext.dat and task.ini match a known malware family, loade […]

Hi Achdad, the cleanup outcome is encouraging, but the available artifacts are not enough to assign a reliable malware-family name. What they do support is a staged payload with scheduled-task persistence and likely abuse of a signed Autodesk component; the signature on Info-Injector.exe does not make the surrounding bundle trustworthy.

What the evidence supports​

The two tasks launching `C:\ProgramData\com_lib_engine\Info-Injector.exe` are strong evidence of scheduled-task persistence. Their unusual names and the nonstandard ProgramData location make the arrangement especially suspicious.

A valid Autodesk signature establishes that the signed executable was produced and signed by Autodesk and remained intact after signing. It does not establish that:

• the filename or installation location is legitimate;
• the task that launches it is legitimate;
• `audio_ext.dat` or `task.ini` is safe;
• the signed program cannot be induced to load or process attacker-controlled content.

That pattern is consistent with living-off-trusted-content or signed-binary proxy abuse: malware packages a legitimate executable with hostile or repurposed companion data and DLLs. However, proving DLL side-loading or identifying which companion file supplied code would require execution telemetry or static/dynamic analysis. The open handle from `ParallelRegi.exe` proves interaction, not execution direction.

Likewise, entropy near 7.92 bits per byte supports packing, encryption or compression, but it is not a malware verdict. Your interpretation there is appropriately cautious.

What the successful cleanup means​

The absence of the executable, directory and tasks across subsequent reboots—combined with no further Defender detections—strongly suggests that the persistence mechanism you found was removed. It does not provide an absolute clean bill of health, but it is substantially better evidence than a single clean scan.

There is no value in recreating the infection to settle the family name. Re-running the suspected installer with protection disabled would add risk while producing little reliable attribution. The repeated extraction directories may indeed reflect your repeated launches, as you noted; that observation cannot distinguish self-replication from repeated installation attempts.

Prudent follow-up​

Because the unknown program was deliberately executed while antivirus protection was disabled, this case merits individualized review even though it currently appears resolved. The safest next step is to open a thread with the MalwareTips Malware Removal Assistance team and include the artifact names, hashes, task names, timeline and the remediation already performed. Do not post passwords, licence keys or authentication tokens.

Also consider account protection from a separate trusted device if you logged into important services while the suspected payload was active:

1. Change passwords for accounts used during that window, prioritizing email, banking and password-manager accounts.
2. Revoke existing sessions and unknown connected applications; a password change does not always invalidate sessions.
3. Verify recovery email addresses, phone numbers and mail-forwarding rules.
4. Enable MFA and replace any password reused elsewhere.

Those account steps are precautionary because the payload's capabilities are unknown, not evidence that credentials were stolen. Without the deleted original installer or deeper analysis of `audio_ext.dat` and `task.ini`, attaching a specific family label would be guesswork wearing a lab coat.

 

[Parkinsond]

C:\ProgramData\com_lib_engine\Info-Injector.exe
The com_lib_engine directory contained a collection of Autodesk Identity Manager-related files, including:

Info-Injector.exe<br>audio_ext.dat<br>task.ini<br>AdIDSDKLog.dll<br>AdpSDKWrapper.dll<br>AdskProxyManager.dll<br>AdSSOServices.dll<br>IdIPCServer.dll<br>IdServicesCore.dll<br>sqlite3.dll<br>WebView2Loader.dll
Info-Injector.exe had a valid Autodesk Authenticode signature.

Looks like an activator.

 

[Achdad]

Hi Achdad, the cleanup outcome is encouraging, but the available artifacts are not enough to assign a reliable malware-family name. What they do support is a staged payload with scheduled-task persistence and likely abuse of a signed Autodesk component; the signature on Info-Injector.exe does not make the surrounding bundle trustworthy.

What the evidence supports​

The two tasks launching `C:\ProgramData\com_lib_engine\Info-Injector.exe` are strong evidence of scheduled-task persistence. Their unusual names and the nonstandard ProgramData location make the arrangement especially suspicious.

A valid Autodesk signature establishes that the signed executable was produced and signed by Autodesk and remained intact after signing. It does not establish that:

• the filename or installation location is legitimate;
• the task that launches it is legitimate;
• `audio_ext.dat` or `task.ini` is safe;
• the signed program cannot be induced to load or process attacker-controlled content.

That pattern is consistent with living-off-trusted-content or signed-binary proxy abuse: malware packages a legitimate executable with hostile or repurposed companion data and DLLs. However, proving DLL side-loading or identifying which companion file supplied code would require execution telemetry or static/dynamic analysis. The open handle from `ParallelRegi.exe` proves interaction, not execution direction.

Likewise, entropy near 7.92 bits per byte supports packing, encryption or compression, but it is not a malware verdict. Your interpretation there is appropriately cautious.

What the successful cleanup means​

The absence of the executable, directory and tasks across subsequent reboots—combined with no further Defender detections—strongly suggests that the persistence mechanism you found was removed. It does not provide an absolute clean bill of health, but it is substantially better evidence than a single clean scan.

There is no value in recreating the infection to settle the family name. Re-running the suspected installer with protection disabled would add risk while producing little reliable attribution. The repeated extraction directories may indeed reflect your repeated launches, as you noted; that observation cannot distinguish self-replication from repeated installation attempts.

Prudent follow-up​

Because the unknown program was deliberately executed while antivirus protection was disabled, this case merits individualized review even though it currently appears resolved. The safest next step is to open a thread with the MalwareTips Malware Removal Assistance team and include the artifact names, hashes, task names, timeline and the remediation already performed. Do not post passwords, licence keys or authentication tokens.

Also consider account protection from a separate trusted device if you logged into important services while the suspected payload was active:

1. Change passwords for accounts used during that window, prioritizing email, banking and password-manager accounts.
2. Revoke existing sessions and unknown connected applications; a password change does not always invalidate sessions.
3. Verify recovery email addresses, phone numbers and mail-forwarding rules.
4. Enable MFA and replace any password reused elsewhere.

Those account steps are precautionary because the payload's capabilities are unknown, not evidence that credentials were stolen. Without the deleted original installer or deeper analysis of `audio_ext.dat` and `task.ini`, attaching a specific family label would be guesswork wearing a lab coat.

Thanks for the detailed feedback — that matches very closely with what I found during the investigation.

The account-security steps have already been completed from a separate trusted device. I changed the passwords for the important accounts, revoked suspicious/old sessions where possible, reviewed recovery options, and enabled MFA on the main services.

I agree that there is no benefit in trying to reproduce the infection just to obtain a malware-family name. My main concern now is simply making sure there are no remaining persistence mechanisms or artifacts that I missed.

I’ll open a separate thread in the Malware Removal Assistance section and include the relevant hashes, task names, timeline, and the remediation already performed, together with a link back to this discussion.

Thanks again for the clarification and for confirming that the current cleanup results are encouraging.

 

[Bot AI]

I have completed the account-security steps from a trusted device. My remaining concern is whether any persistence or artifacts were missed, so I will open a Malware Removal Assistance thread with the hashes, task names, timeline and remediation details.

That is the right next step. Since the account-security work is already complete, there is no reason to repeat it or to run the suspected program again.

For the removal thread​

Include the facts already collected:

• The two scheduled-task names and their exact command lines
• Paths and SHA-256 hashes for `ParallelRegi.exe`, `Info-Injector.exe`, `audio_ext.dat` and `task.ini`
• Approximate first-execution and detection times
• Which items Defender detected, rather than merely which files were nearby
• What you removed and the results after each reboot
• Any available Defender Protection History details or exported task information

Mention that antivirus protection was temporarily disabled and that the suspicious program was executed several times. That affects the exposure assessment and helps explain the repeated temporary directories.

Do not run cleaners, delete additional unknown entries or apply custom scripts while the specialist review is underway unless the assisting analyst requests it. Preserving the current state makes the remaining checks more meaningful.

About the activator possibility​

Parkinsond's suggestion is plausible if the original download was presented as an activator or crack, but the listed artifacts alone do not prove that classification. Activators commonly arrive through untrusted distribution channels and may bundle legitimate signed programs with loaders or unwanted payloads.

Whether it was marketed as an activator and whether it installed malware are also separate questions. The unusual task names, nonstandard `com_lib_engine` directory, recurring Defender detection and persistence behavior are the important security findings here; the Autodesk signature does not neutralize those findings.

 

[stonjean633]

Hi everyone,

I’m sharing this case because I recently dealt with a recurring Trojan:Win64/Lazy.PGLI!MTB detection on Windows 11, and the technical details may help someone who encounters the same or a similar infection.

The incident appears to have started after I ran a program downloaded from the internet that I initially believed was legitimate. The original downloaded executable was later deleted, so I cannot prove the initial infection vector with certainty.

Microsoft Defender repeatedly detected:

Trojan:Win64/Lazy.PGLI!MTB<br>Threat ID: 2147952503
The detections occurred multiple times with different process IDs, including after reboots.

The recurring process was:

%LOCALAPPDATA%\Temp\ParallelRegi.exe
SHA-256:

F3FA49863B0512E7065F9B3B4353F8D7840213EDB47A92BDFC32BA61592251D1
During the investigation, I found two suspicious scheduled tasks:

dispatcherhost_arm_releasSPKVWorker<br>heaphost_v3
Both launched:

C:\ProgramData\com_lib_engine\Info-Injector.exe
The com_lib_engine directory contained a collection of Autodesk Identity Manager-related files, including:

Info-Injector.exe<br>audio_ext.dat<br>task.ini<br>AdIDSDKLog.dll<br>AdpSDKWrapper.dll<br>AdskProxyManager.dll<br>AdSSOServices.dll<br>IdIPCServer.dll<br>IdServicesCore.dll<br>sqlite3.dll<br>WebView2Loader.dll
Info-Injector.exe had a valid Autodesk Authenticode signature.

Its version information showed:

FileDescription : Autodesk Identity Manager<br>ProductName : Autodesk SSO<br>OriginalFilename : AdskIdentityManager.exe<br>CompanyName : Autodesk, Inc.<br>FileVersion : 1.11.9.11
SHA-256:

D15EBC1C55781E891AAB66B1E7AD34373FE26ECED64194121A0F7803A604C042
This suggests that Info-Injector.exe was a legitimate Autodesk binary renamed from AdskIdentityManager.exe.

Two files in the same directory were especially unusual:

audio_ext.dat<br>task.ini
SHA-256:

audio_ext.dat<br>7E009715B7270037274FEC145DD99E9E7DD33913AB6EA49AACAAB089C6B1111F<br><br>task.ini<br>F08AEC4DE0384B1509E651E0202FEEF63FF67739BB3D2B920DB3B75A487C54A1
task.ini did not contain normal INI-style configuration data and appeared to contain obfuscated or binary content.

audio_ext.dat had an entropy of approximately:

7.9217 bits/byte
which is consistent with highly compressed, encrypted or heavily obfuscated data, although this alone does not prove that the file is malicious.

I also found multiple temporary directories created during the same time window. Each contained identical copies of:

Info-Injector.exe<br>audio_ext.dat<br>task.ini
The copies had identical SHA-256 hashes.

One important caveat: I had attempted to launch the original suspicious program several times while temporarily disabling antivirus protection, so the repeated temporary-directory extraction may have been caused by my own repeated execution attempts rather than autonomous malware replication.

During the live investigation, ParallelRegi.exe was observed holding an open handle to:

C:\ProgramData\com_lib_engine\Info-Injector.exe
This established a direct interaction between the two components, although it did not prove the exact direction of execution or causality.

Remediation performed​

I first disabled and then removed the two scheduled tasks.

I then removed:

C:\ProgramData\com_lib_engine
the identified temporary copies of the staged bundle, and:

%LOCALAPPDATA%\Temp\ParallelRegi.exe
After removal, I rebooted the system and verified that:

ParallelRegi.exe = not present<br>ParallelRegi process = not running<br>com_lib_engine = not present<br>scheduled tasks = not present
I then ran:

• Microsoft Defender Quick Scan
• Microsoft Defender Offline Scan
• another reboot
• another persistence check

No new detections appeared.

The most recent Defender detection remained the pre-remediation event, and none of the removed files or scheduled tasks reappeared after the subsequent reboots.

Current status​

At the time of writing, the system has remained clean after reboot, Quick Scan and Defender Offline Scan.

Microsoft Defender is now the primary antivirus, with real-time protection, behavior monitoring and the main antimalware services enabled.

Important limitation​

Because the original downloaded executable was deleted before the full investigation, I cannot prove that it was the initial dropper, although the timing strongly suggests that it was related.

I’m sharing these indicators mainly so that anyone searching for:

ParallelRegi.exe<br>com_lib_engine<br>Info-Injector.exe<br>dispatcherhost_arm_releasSPKVWorker<br>heaphost_v3<br>Trojan:Win64/Lazy.PGLI!MTB
can compare them with their own system.

If anyone has seen the same combination of artifacts, especially the Autodesk Identity Manager bundle together with audio_ext.dat and task.ini, I would be interested to know whether it matches a known malware family, loader or persistence technique.

This is behavior based detection and not thru Exact Signatures.
The clue is MTB - Malware Threat Behavior.

Could be FP or TP.

 

[Achdad]

Looks like an activator.

Thanks. What specifically makes it look like an activator to you? Is it the renamed signed Autodesk binary, the companion .dat/.ini files, or have you seen this exact bundle before?

 

[Achdad]

This is behavior based detection and not thru Exact Signatures.
The clue is MTB - Malware Threat Behavior.

Could be FP or TP.

That makes sense. I also assumed the MTB label was behavior-based rather than an exact family signature. Given the scheduled-task persistence, the recurring ParallelRegi.exe process, and the fact that the detections stopped only after removing those components, I suspect this was a true positive, but I agree that the Defender label alone is not enough to identify the malware family.

 

[Parkinsond]

What specifically makes it look like an activator to you?

infoinjector; usually used to bypass activation process by injecting false activation data.