5cbc5083d0c8ab91c9d538a2e5a8e51fdbafe0caa37173a0176413d4cbba064e

Analysis

max time kernel
139s
max time network
164s
platform
windows10_x64
resource
win10v20210410
submitted
15-07-2021 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Users/Administrator/AppData/Local/Google/Chrome/User Data/Default/Cache/f_0000c5.exe
Size

3.6MB
MD5

aa48774579e4468e629e344cbb4a5a12
SHA1

9397efdbc42d509f5f4c51903f125530b81f5fc6
SHA256

033d58611b17fe96939b2092f1d486341206d547545d4bc0bf12c2097436ccdd
SHA512

ba52d727efee5b3da0fc221fca92cda92790e013f222d4a32edc98cb4ddd508822966bde9a65f10834105c29cfcd94363ccb48e840c8c8b7db99678ac1186c92

Score

10^/10

bootkit discovery evasion persistence trojan upx

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

59 3984 msiexec.exe
Downloads MZ/PE file

flow	pid	process
59	3984	msiexec.exe

Drops file in Drivers directory 64 IoCs

Processes:

instup.exe

description	ioc	process
File created	C:\Windows\system32\drivers\aswa833d45d698d7e8a.tmp	instup.exe
File created	C:\Windows\system32\drivers\asw861865be1a6e068b.tmp	instup.exe
File created	C:\Windows\system32\drivers\aswb4f763a9e7705754.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswc55efec8e794e846.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswblogx.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswbuniv.sys	instup.exe
File created	C:\Windows\system32\drivers\asw98c696f88747ab7d.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswbidshx.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswbunivx.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswArPot.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswbidsh.sys	instup.exe
File created	C:\Windows\system32\drivers\aswSnx.sys	instup.exe
File created	C:\Windows\system32\drivers\aswKbd.sys	instup.exe
File created	C:\Windows\system32\drivers\aswNetHub.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\asw88db506a57b35060.tmp	instup.exe
File created	C:\Windows\system32\drivers\asw0e1ea99017fdf076.tmp	instup.exe
File created	C:\Windows\system32\drivers\aswe3ff394467d6e171.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswRvrt.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\asw395b3eedb105f7d5.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswMonFlt.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswStm.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\asw0e1ea99017fdf076.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswbloga.sys	instup.exe
File created	C:\Windows\system32\drivers\aswArPot.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswb4f763a9e7705754.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\asw69c9222f468de5dd.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswb26d05a055c6aea3.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswFsBlk.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswbidsdriver.sys	instup.exe
File created	C:\Windows\system32\drivers\aswStm.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\asw98c696f88747ab7d.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswVmm.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswec3bb85b17ba110a.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswbidsdrivera.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswbidsha.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswSnx.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswKbd.sys	instup.exe
File created	C:\Windows\system32\drivers\aswElam.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswe3ff394467d6e171.tmp	instup.exe
File created	C:\Windows\system32\drivers\asw69c9222f468de5dd.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswbuniva.sys	instup.exe
File created	C:\Windows\system32\drivers\asw9c0a888bc35fa228.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswa833d45d698d7e8a.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswRdr2.sys	instup.exe
File created	C:\Windows\system32\drivers\aswRdr2.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswb1f80b6f9c9b6db9.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswNetHub.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswSP.sys	instup.exe
File created	C:\Windows\system32\drivers\aswMonFlt.sys	instup.exe
File created	C:\Windows\system32\drivers\aswRvrt.sys	instup.exe
File created	C:\Windows\system32\drivers\aswbidsh.sys	instup.exe
File created	C:\Windows\system32\drivers\aswbuniv.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswa1a935111a58e8b8.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\asw861865be1a6e068b.tmp	instup.exe
File created	C:\Windows\system32\drivers\aswa1a935111a58e8b8.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswElam.sys	instup.exe
File created	C:\Windows\system32\drivers\aswb26d05a055c6aea3.tmp	instup.exe
File created	C:\Windows\system32\drivers\aswb1f80b6f9c9b6db9.tmp	instup.exe
File created	C:\Windows\system32\drivers\aswc55efec8e794e846.tmp	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswbdiska.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswbdiskx.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswbidsdriverx.sys	instup.exe
File opened for modification	C:\Windows\system32\drivers\aswNet.sys	instup.exe
File created	C:\Windows\system32\drivers\aswSP.sys	instup.exe

Executes dropped EXE 17 IoCs

Processes:

DriverHub.exehighdpimfcx86.exehighdpimfcx86.exeVC_redist.x86.exeAvast-downloader.exeavast_free_antivirus_setup_online_x64.exeinstup.exeinstup.exeDriverHub.exesbr.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeAvEmUpdate.exeAvEmUpdate.exe

pid	process
3472	DriverHub.exe
3192	highdpimfcx86.exe
2252	highdpimfcx86.exe
3860	VC_redist.x86.exe
912	Avast-downloader.exe
3848	avast_free_antivirus_setup_online_x64.exe
2752	instup.exe
3180	instup.exe
4348	DriverHub.exe
4476	sbr.exe
4860	SetupInf.exe
5068	SetupInf.exe
640	SetupInf.exe
4376	SetupInf.exe
4400	SetupInf.exe
4520	AvEmUpdate.exe
1272	AvEmUpdate.exe

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\DriverHub\DriverHub.exe	upx
C:\Users\Admin\AppData\Local\Temp\DriverHub\DriverHub.exe	upx

Loads dropped DLL 35 IoCs

Processes:

highdpimfcx86.exeAvast-downloader.exeinstup.exeinstup.exeDriverHub.exe

pid	process
2252	highdpimfcx86.exe
912	Avast-downloader.exe
2752	instup.exe
2752	instup.exe
3180	instup.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

VC_redist.x86.exeinstup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{dfea0fad-88b2-4a1f-8536-3f8f9391f4ef} = "\"C:\\ProgramData\\Package Cache\\{dfea0fad-88b2-4a1f-8536-3f8f9391f4ef}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AvRepair = "\"C:\\Program Files\\Avast Software\\Avast\\setup\\instup.exe\" /instop:repair /wait"	instup.exe

Checks for any installed AV software in registry 1 TTPs 64 IoCs

Security Software Discovery

T1063

Processes:

avast_free_antivirus_setup_online_x64.exeSetupInf.exeSetupInf.exeinstup.exeAvEmUpdate.exeSetupInf.exeAvEmUpdate.exeSetupInf.exeSetupInf.exeinstup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	avast_free_antivirus_setup_online_x64.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast\properties	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupVersion	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast\properties	SetupInf.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast\properties\settings	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Version	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CrashGuardProcessWatcherExclusions	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LicenseFile	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LogFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\MovedFolder	AvEmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus\Description = "Manages and implements Avast antivirus services for this computer. This includes the real-time shields, the virus chest and the scheduler."	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\FwDataFolder	instup.exe
\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog	SetupInf.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SZBProgramFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Version	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\UpdateVersion	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ReportFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SZBProgramFolder	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\JournalFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SZBProgramFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CrashGuardProcessWatcherExclusions	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus\ImagePath	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	avast_free_antivirus_setup_online_x64.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	SetupInf.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\UpdateVersion	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\MovedFolder	SetupInf.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupVersion	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ChestFolder	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\FwDataFolder	SetupInf.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\InstallerPhase2	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CrashGuardProcessWatcherExclusions	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupVersion	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ReportFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\TempFolder	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Version	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LogFolder	SetupInf.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	AvEmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog = "C:\\ProgramData\\Avast Software\\Persistent Data\\Avast\\Logs\\Setup.log"	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ShepherdDebug	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ChestFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupVersion	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\JournalFolder	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\JournalFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CertificateFile	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CertificateFile	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\TempFolder	SetupInf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

f_0000c5.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA f_0000c5.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	f_0000c5.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 10 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

SetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeAvEmUpdate.exeAvast-downloader.exeavast_free_antivirus_setup_online_x64.exeinstup.exeinstup.exeSetupInf.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	AvEmUpdate.exe
File opened for modification	\??\PhysicalDrive0	Avast-downloader.exe
File opened for modification	\??\PhysicalDrive0	avast_free_antivirus_setup_online_x64.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe

Drops file in System32 directory 62 IoCs

Processes:

DriverHub.exemsiexec.exeinstup.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\FileRepository\hal.inf_amd64_46273d75d66bd849\hal.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\disk.inf_amd64_4411de1bdd5382d9\disk.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_1496862836cc181d\kdnic.PNF	DriverHub.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\printqueue.inf_amd64_eb83bfa648f15d52\printqueue.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_82738beb7b514250\keyboard.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\monitor.inf_amd64_72dbcbbbb0666b3f\monitor.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_e15abe7d25aa2071\input.PNF	DriverHub.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cdrom.inf_amd64_8343533b38a2a0da\cdrom.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mssmbios.inf_amd64_98bded6d6f406ee7\mssmbios.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\volume.inf_amd64_58a93fc6c89329f3\volume.PNF	DriverHub.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\volmgr.inf_amd64_84149a6ef7112aa8\volmgr.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\basicrender.inf_amd64_f1f1af29566626b0\basicrender.PNF	DriverHub.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\compositebus.inf_amd64_de4c68ea4fb1be53\compositebus.PNF	DriverHub.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\aswfd4c4649be7c05be.tmp	instup.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pci.inf_amd64_4cf9a878972c8fa1\pci.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\audioendpoint.inf_amd64_b8966bfe6600218e\audioendpoint.PNF	DriverHub.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_8e5f608c0111283d\usbport.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_e22da3cb2d7a1ed6\hdaudbus.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\umbus.inf_amd64_b2036a5d6cbf5691\umbus.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpi.inf_amd64_2b4e9b8ed43ceb06\acpi.PNF	DriverHub.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_e6c89cc58804e205\machine.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\basicdisplay.inf_amd64_85cec69e2fcef504\basicdisplay.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vdrvroot.inf_amd64_bf07d1948babd2cd\vdrvroot.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cpu.inf_amd64_06bb16552d790e06\cpu.PNF	DriverHub.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_74965e869fab271a\mshdc.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\spaceport.inf_amd64_8ef56a7570075f6c\spaceport.PNF	DriverHub.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_b0ca8be2ac09ed24\msmouse.PNF	DriverHub.exe
File created	C:\Windows\system32\aswfd4c4649be7c05be.tmp	instup.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndisvirtualbus.inf_amd64_311b5482b2fc4ccc\ndisvirtualbus.PNF	DriverHub.exe
File created	C:\Windows\System32\DriverStore\FileRepository\swenum.inf_amd64_2272ffce58da1b4a\swenum.PNF	DriverHub.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rdpbus.inf_amd64_9e4fd69bbfb40126\rdpbus.PNF	DriverHub.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_17acd95043918fe1\volsnap.PNF	DriverHub.exe

Drops file in Program Files directory 64 IoCs

Processes:

DriverHub.exeinstup.exe

description	ioc	process
File created	C:\Program Files (x86)\DriverHub\QtQuick\Dialogs\DefaultFontDialog.qml	DriverHub.exe
File created	C:\Program Files (x86)\DriverHub\imageformats\qgif.dll	DriverHub.exe
File created	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\asw6fc9eb5f56d48864.tmp	instup.exe
File created	C:\Program Files (x86)\DriverHub\QtQuick\Controls.2\Material\plugins.qmltypes	DriverHub.exe
File created	C:\Program Files (x86)\DriverHub\QtQuick\Controls.2\Universal\RadioButton.qml	DriverHub.exe
File opened for modification	C:\Program Files\Avast Software\Avast\asw9f32c2c7872a2d8c.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\aswbe203f1e1fe33bce.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\aswc6391c8be37c659f.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\asw705481843415051b.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\hns_tools.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\serialization.dll.sum	instup.exe
File created	C:\Program Files (x86)\DriverHub\QtQuick\Controls.2\Material\ScrollIndicator.qml	DriverHub.exe
File created	C:\Program Files\Avast Software\Avast\defs\21071403\aswc26a0f180b518891.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\AvDump64.exe	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswd2705b8f4c84483f.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\asw2e54afd6cab3b403.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\aswb34960bceac760aa.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\api-ms-win-core-errorhandling-l1-1-0.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\api-ms-win-crt-math-l1-1-0.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\API-MS-Win-core-xstate-l2-1-0.dll	instup.exe
File created	C:\Program Files (x86)\DriverHub\QtQuick\Controls\Styles\Base\SliderStyle.qml	DriverHub.exe
File created	C:\Program Files (x86)\DriverHub\QtQuick\Controls.2\designer\images\tumbler-icon.png	DriverHub.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-crt-convert-l1-1-0.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\msvcp140_1.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswNdisFlt.sys	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\AvHandleService.exe	instup.exe
File created	C:\Program Files (x86)\DriverHub\QtQuick\Controls\StackView.qml	DriverHub.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\ucrtbase.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\aswd20d7707d8e5f78c.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\Licenses\libevent.txt.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\resources_av	instup.exe
File created	C:\Program Files (x86)\DriverHub\Qt\labs\settings\qmlsettingsplugin.dll	DriverHub.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswf3ab0cc1bcd200f8.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\asw44081e58b13658f3.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\Licenses\cURL.txt	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\gaming_mode_ui.dll	instup.exe
File created	C:\Program Files (x86)\DriverHub\QtQuick\Controls\Private\SourceProxy.qml	DriverHub.exe
File created	C:\Program Files\Avast Software\Avast\aswd2705b8f4c84483f.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\msvcp140_atomic_wait.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\asOutExt.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\ntp_time.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-core-processthreads-l1-1-1.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\asw4dc6fb105fa8aaaf.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\21071403\db_o7c.dat	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\TuneupSmartScan.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswArPot.sys	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-core-synch-l1-2-0.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\vps_binaries-cf.vpx	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\aswb186a98f4d9ad5d1.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x86\aswbidshx.sys	instup.exe
File created	C:\Program Files (x86)\DriverHub\DriverHub.exe	DriverHub.exe
File created	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\aswdb8e81fbf0c000e7.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\setup\asw6b368366c9e99234.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\21071403\list_i.txt	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\asulaunch.exe.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswntsqlite.dll	instup.exe
File opened for modification	C:\Program Files (x86)\DriverHub\QtQuick\Controls.2\designer\images\	DriverHub.exe
File created	C:\Program Files\Avast Software\Avast\Licenses\asw385eff784935e749.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\1033\aswClnTg.txt.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\ashTask.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.der	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswWrcIEBroker32.dll	instup.exe
File created	C:\Program Files (x86)\DriverHub\QtQuick\Controls.2\Material\DelayButton.qml	DriverHub.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\21071403\asw179a95a6a41f27ae.tmp	instup.exe

Drops file in Windows directory 15 IoCs

Processes:

msiexec.exeinstup.exe

description	ioc	process
File created	C:\Windows\Installer\f756b5d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7D75664A-6C04-424C-82A1-EE88913E5F16}	msiexec.exe
File created	C:\Windows\Installer\f756b6a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f756b5d.msi	msiexec.exe
File created	C:\Windows\Installer\f756b66.msi	msiexec.exe
File created	C:\Windows\Installer\f756b67.msi	msiexec.exe
File opened for modification	C:\Windows\ELAMBKUP\asw57611e8eb3c06c50.tmp	instup.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\f756b67.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{01FAEC41-B3BC-44F4-B185-5E8475AEB855}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7488.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E4B.tmp	msiexec.exe
File created	C:\Windows\ELAMBKUP\asw57611e8eb3c06c50.tmp	instup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exeDriverHub.exeinstup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs	DriverHub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	DriverHub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName	DriverHub.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\LocationInformation	DriverHub.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Mfg	DriverHub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags	DriverHub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0003\	DriverHub.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Class	DriverHub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Driver	DriverHub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ClassGUID	DriverHub.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM	DriverHub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0003	DriverHub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk	DriverHub.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceType	DriverHub.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DriverHub.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\	DriverHub.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe

Checks processor information in registry 2 TTPs 50 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SetupInf.exeAvEmUpdate.exeAvEmUpdate.exeinstup.exeSetupInf.exeSetupInf.exeSetupInf.exeavast_free_antivirus_setup_online_x64.exeSetupInf.exeinstup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	avast_free_antivirus_setup_online_x64.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	avast_free_antivirus_setup_online_x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	avast_free_antivirus_setup_online_x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe

Modifies data under HKEY_USERS 7 IoCs

Processes:

svchost.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\17	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 64 IoCs

Processes:

instup.exeinstup.exeVC_redist.x86.exemsiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "58"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "18"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: ntp_time.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\custody.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\Inf\\x64\\aswTdi.sys"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "14"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "95"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: cURL.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\dbghelp.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.29,bundle\Version = "14.29.30037.0"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: AvastNM.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\aswStrm.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\AvDump32.exe"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "81"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File extracted: config.def"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: lexbor.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\Inf\\x64\\aswbloga.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\TuneupBin"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\resources_av"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14CEAF10CB3B4F441B58E54857EA8B55	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "65"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "28"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: Base.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\aswJsFlt.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\instup_ais-*.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "87"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\part-vps_win32-*.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\avastlicfile\EditFlags = "65536"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14CEAF10CB3B4F441B58E54857EA8B55\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14CEAF10CB3B4F441B58E54857EA8B55\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14CEAF10CB3B4F441B58E54857EA8B55\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: algo64.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: msvcp140_1.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\GuidCreated = "1626346830"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: api-ms-win-core-synch-l1-2-0.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\aswcertx.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "54"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Updating package: ais_cmp_rescuedisk_x64"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Updating package: ais_cmp_swhealth_x64"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Main = "21"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: ais_res-8f2.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Main = "44"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\Morphisec\\MorphiDriver.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: libPNG.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\resources"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: Xerces.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: process_monitor.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14CEAF10CB3B4F441B58E54857EA8B55\Version = "236811605"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "99"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "48"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "64"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Main = "53"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswidpm.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: RegSvr.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\Inf\\x64\\aswbdiska.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\x86\\avast.vc140.crt"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "53"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "98"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: fwAux.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: libevent.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: streamback.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\rescue_disk.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "50"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswVmm.sys"	instup.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

DriverHub.exe

pid process

4348 DriverHub.exe

pid	process
4348	DriverHub.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

f_0000c5.exemsiexec.exeavast_free_antivirus_setup_online_x64.exeDriverHub.exe

pid	process
3724	f_0000c5.exe
3724	f_0000c5.exe
3724	f_0000c5.exe
3724	f_0000c5.exe
3984	msiexec.exe
3984	msiexec.exe
3984	msiexec.exe
3984	msiexec.exe
3724	f_0000c5.exe
3724	f_0000c5.exe
3848	avast_free_antivirus_setup_online_x64.exe
3848	avast_free_antivirus_setup_online_x64.exe
4348	DriverHub.exe
4348	DriverHub.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

DriverHub.exe

pid process

4348 DriverHub.exe

pid	process
4348	DriverHub.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeVC_redist.x86.exemsiexec.exe

description	pid	process
Token: SeBackupPrivilege	3536	vssvc.exe
Token: SeRestorePrivilege	3536	vssvc.exe
Token: SeAuditPrivilege	3536	vssvc.exe
Token: SeShutdownPrivilege	3860	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	3860	VC_redist.x86.exe
Token: SeSecurityPrivilege	3984	msiexec.exe
Token: SeCreateTokenPrivilege	3860	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	3860	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	3860	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	3860	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	3860	VC_redist.x86.exe
Token: SeTcbPrivilege	3860	VC_redist.x86.exe
Token: SeSecurityPrivilege	3860	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	3860	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	3860	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	3860	VC_redist.x86.exe
Token: SeSystemtimePrivilege	3860	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	3860	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	3860	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	3860	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	3860	VC_redist.x86.exe
Token: SeBackupPrivilege	3860	VC_redist.x86.exe
Token: SeRestorePrivilege	3860	VC_redist.x86.exe
Token: SeShutdownPrivilege	3860	VC_redist.x86.exe
Token: SeDebugPrivilege	3860	VC_redist.x86.exe
Token: SeAuditPrivilege	3860	VC_redist.x86.exe
Token: SeSystemEnvironmentPrivilege	3860	VC_redist.x86.exe
Token: SeChangeNotifyPrivilege	3860	VC_redist.x86.exe
Token: SeRemoteShutdownPrivilege	3860	VC_redist.x86.exe
Token: SeUndockPrivilege	3860	VC_redist.x86.exe
Token: SeSyncAgentPrivilege	3860	VC_redist.x86.exe
Token: SeEnableDelegationPrivilege	3860	VC_redist.x86.exe
Token: SeManageVolumePrivilege	3860	VC_redist.x86.exe
Token: SeImpersonatePrivilege	3860	VC_redist.x86.exe
Token: SeCreateGlobalPrivilege	3860	VC_redist.x86.exe
Token: SeRestorePrivilege	3984	msiexec.exe
Token: SeTakeOwnershipPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	3984	msiexec.exe
Token: SeTakeOwnershipPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	3984	msiexec.exe
Token: SeTakeOwnershipPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	3984	msiexec.exe
Token: SeTakeOwnershipPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	3984	msiexec.exe
Token: SeTakeOwnershipPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	3984	msiexec.exe
Token: SeTakeOwnershipPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	3984	msiexec.exe
Token: SeTakeOwnershipPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	3984	msiexec.exe
Token: SeTakeOwnershipPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	3984	msiexec.exe
Token: SeTakeOwnershipPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	3984	msiexec.exe
Token: SeTakeOwnershipPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	3984	msiexec.exe
Token: SeTakeOwnershipPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	3984	msiexec.exe
Token: SeTakeOwnershipPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	3984	msiexec.exe
Token: SeTakeOwnershipPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	3984	msiexec.exe
Token: SeTakeOwnershipPrivilege	3984	msiexec.exe
Token: SeRestorePrivilege	3984	msiexec.exe

Suspicious use of SetWindowsHookEx 41 IoCs

Processes:

f_0000c5.exeDriverHub.exeDriverHub.exe

pid	process
3724	f_0000c5.exe
3724	f_0000c5.exe
3724	f_0000c5.exe
3724	f_0000c5.exe
3472	DriverHub.exe
3472	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe
4348	DriverHub.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

f_0000c5.exehighdpimfcx86.exehighdpimfcx86.exeAvast-downloader.exeavast_free_antivirus_setup_online_x64.exeinstup.exeinstup.exe

description	pid	process	target process
PID 3724 wrote to memory of 3472	3724	f_0000c5.exe	DriverHub.exe
PID 3724 wrote to memory of 3472	3724	f_0000c5.exe	DriverHub.exe
PID 3724 wrote to memory of 3472	3724	f_0000c5.exe	DriverHub.exe
PID 3724 wrote to memory of 3192	3724	f_0000c5.exe	highdpimfcx86.exe
PID 3724 wrote to memory of 3192	3724	f_0000c5.exe	highdpimfcx86.exe
PID 3724 wrote to memory of 3192	3724	f_0000c5.exe	highdpimfcx86.exe
PID 3192 wrote to memory of 2252	3192	highdpimfcx86.exe	highdpimfcx86.exe
PID 3192 wrote to memory of 2252	3192	highdpimfcx86.exe	highdpimfcx86.exe
PID 3192 wrote to memory of 2252	3192	highdpimfcx86.exe	highdpimfcx86.exe
PID 2252 wrote to memory of 3860	2252	highdpimfcx86.exe	VC_redist.x86.exe
PID 2252 wrote to memory of 3860	2252	highdpimfcx86.exe	VC_redist.x86.exe
PID 2252 wrote to memory of 3860	2252	highdpimfcx86.exe	VC_redist.x86.exe
PID 3724 wrote to memory of 912	3724	f_0000c5.exe	Avast-downloader.exe
PID 3724 wrote to memory of 912	3724	f_0000c5.exe	Avast-downloader.exe
PID 3724 wrote to memory of 912	3724	f_0000c5.exe	Avast-downloader.exe
PID 912 wrote to memory of 3848	912	Avast-downloader.exe	avast_free_antivirus_setup_online_x64.exe
PID 912 wrote to memory of 3848	912	Avast-downloader.exe	avast_free_antivirus_setup_online_x64.exe
PID 3848 wrote to memory of 2752	3848	avast_free_antivirus_setup_online_x64.exe	instup.exe
PID 3848 wrote to memory of 2752	3848	avast_free_antivirus_setup_online_x64.exe	instup.exe
PID 2752 wrote to memory of 3180	2752	instup.exe	instup.exe
PID 2752 wrote to memory of 3180	2752	instup.exe	instup.exe
PID 3724 wrote to memory of 4348	3724	f_0000c5.exe	DriverHub.exe
PID 3724 wrote to memory of 4348	3724	f_0000c5.exe	DriverHub.exe
PID 3724 wrote to memory of 4348	3724	f_0000c5.exe	DriverHub.exe
PID 3180 wrote to memory of 4476	3180	instup.exe	sbr.exe
PID 3180 wrote to memory of 4476	3180	instup.exe	sbr.exe
PID 3180 wrote to memory of 4860	3180	instup.exe	SetupInf.exe
PID 3180 wrote to memory of 4860	3180	instup.exe	SetupInf.exe
PID 3180 wrote to memory of 5068	3180	instup.exe	SetupInf.exe
PID 3180 wrote to memory of 5068	3180	instup.exe	SetupInf.exe
PID 3180 wrote to memory of 640	3180	instup.exe	SetupInf.exe
PID 3180 wrote to memory of 640	3180	instup.exe	SetupInf.exe
PID 3180 wrote to memory of 4376	3180	instup.exe	SetupInf.exe
PID 3180 wrote to memory of 4376	3180	instup.exe	SetupInf.exe
PID 3180 wrote to memory of 4400	3180	instup.exe	SetupInf.exe
PID 3180 wrote to memory of 4400	3180	instup.exe	SetupInf.exe
PID 3180 wrote to memory of 4520	3180	instup.exe	AvEmUpdate.exe
PID 3180 wrote to memory of 4520	3180	instup.exe	AvEmUpdate.exe
PID 3180 wrote to memory of 1272	3180	instup.exe	AvEmUpdate.exe
PID 3180 wrote to memory of 1272	3180	instup.exe	AvEmUpdate.exe

C:\Users\Admin\AppData\Local\Temp\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cache\f_0000c5.exe
"C:\Users\Admin\AppData\Local\Temp\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cache\f_0000c5.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724

C:\Users\Admin\AppData\Local\Temp\DriverHub\DriverHub.exe
"C:\Users\Admin\AppData\Local\Temp\DriverHub\DriverHub.exe" --silent "C:\Program Files (x86)\DriverHub" -5
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3472

C:\Users\Admin\AppData\Local\Temp\DriverHub\highdpimfcx86.exe
"C:\Users\Admin\AppData\Local\Temp\DriverHub\highdpimfcx86.exe" /q /norestart
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192

C:\Windows\Temp\{A1F2C286-8E58-46E8-9C5E-B168DDCD2478}\.cr\highdpimfcx86.exe
"C:\Windows\Temp\{A1F2C286-8E58-46E8-9C5E-B168DDCD2478}\.cr\highdpimfcx86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\DriverHub\highdpimfcx86.exe" -burn.filehandle.attached=604 -burn.filehandle.self=608 /q /norestart
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252

C:\Windows\Temp\{EC597860-0898-4327-B0BE-F4C80ADBA6AB}\.be\VC_redist.x86.exe
"C:\Windows\Temp\{EC597860-0898-4327-B0BE-F4C80ADBA6AB}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{939FEFDC-9791-4422-B3A4-2F8FF22B5977} {A5C66535-71AD-4C32-8718-2AABD9817E6D} 2252
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\Users\Admin\AppData\Local\Temp\DriverHub\Avast-downloader.exe
"C:\Users\Admin\AppData\Local\Temp\DriverHub\Avast-downloader.exe" /silent /WS
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\Temp\asw.1b9d154fac0b015d\avast_free_antivirus_setup_online_x64.exe
"C:\Windows\Temp\asw.1b9d154fac0b015d\avast_free_antivirus_setup_online_x64.exe" /silent /WS /cookie:mmm_rsp_ppi_003_462_a /ga_clientid:bd8e3531-191d-4182-ad20-1d0de32a37c4 /edat_dir:C:\Windows\Temp\asw.1b9d154fac0b015d
3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3848

C:\Windows\Temp\asw.eec113b37c07283a\instup.exe
"C:\Windows\Temp\asw.eec113b37c07283a\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.eec113b37c07283a /edition:1 /prod:ais /guid:f7804596-3014-4c9f-b459-a071b5e80221 /ga_clientid:bd8e3531-191d-4182-ad20-1d0de32a37c4 /silent /WS /cookie:mmm_rsp_ppi_003_462_a /ga_clientid:bd8e3531-191d-4182-ad20-1d0de32a37c4 /edat_dir:C:\Windows\Temp\asw.1b9d154fac0b015d
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2752

C:\Windows\Temp\asw.eec113b37c07283a\New_150509a6\instup.exe
"C:\Windows\Temp\asw.eec113b37c07283a\New_150509a6\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.eec113b37c07283a /edition:1 /prod:ais /guid:f7804596-3014-4c9f-b459-a071b5e80221 /ga_clientid:bd8e3531-191d-4182-ad20-1d0de32a37c4 /silent /WS /cookie:mmm_rsp_ppi_003_462_a /edat_dir:C:\Windows\Temp\asw.1b9d154fac0b015d /online_installer
5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3180

C:\Windows\Temp\asw.eec113b37c07283a\New_150509a6\sbr.exe
"C:\Windows\Temp\asw.eec113b37c07283a\New_150509a6\sbr.exe" 3180 "Avast Antivirus setup" "Avast Antivirus is being installed. Do not shut down your computer!"
6⤵
- Executes dropped EXE
PID:4476

C:\Program Files\Avast Software\Avast\SetupInf.exe
"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRdr2.cat
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:4860

C:\Program Files\Avast Software\Avast\SetupInf.exe
"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswHwid.cat
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:5068

C:\Program Files\Avast Software\Avast\SetupInf.exe
"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswVmm.cat
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:640

C:\Program Files\Avast Software\Avast\SetupInf.exe
"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRvrt.cat
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:4376

C:\Program Files\Avast Software\Avast\SetupInf.exe
"C:\Program Files\Avast Software\Avast\SetupInf.exe" /elaminst C:\Windows\system32\drivers\aswElam.sys
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:4400

C:\Program Files\Avast Software\Avast\AvEmUpdate.exe
"C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer /reg
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:4520

C:\Program Files\Avast Software\Avast\AvEmUpdate.exe
"C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer1
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:1272

C:\Program Files (x86)\DriverHub\DriverHub.exe
"C:\Program Files (x86)\DriverHub\DriverHub.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4348

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3536

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3828

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:1700

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Security Software Discovery

T1063

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\DriverHub\DriverHub.exe
MD5
1cc099253c6baa24932f94b1c1c7e9bb

SHA1
f89f6c51ad2e552f8a2f59083fb3fd8f0684cdcf

SHA256
dc1cc0b1cae7a412b03ac4d519401b4888bb50f74b45425982a32ad8ad92fa8d

SHA512
c559670c8c3e76913e07ff54d5f85c7a3ca39247319807fc86c6a093d254ee1aa8f43777100657dc958985eec6afe2f1577d12d9ad9b26192c59f243332713a8

Download Submit
C:\Program Files (x86)\DriverHub\DriverHub.exe
MD5
1cc099253c6baa24932f94b1c1c7e9bb

SHA1
f89f6c51ad2e552f8a2f59083fb3fd8f0684cdcf

SHA256
dc1cc0b1cae7a412b03ac4d519401b4888bb50f74b45425982a32ad8ad92fa8d

SHA512
c559670c8c3e76913e07ff54d5f85c7a3ca39247319807fc86c6a093d254ee1aa8f43777100657dc958985eec6afe2f1577d12d9ad9b26192c59f243332713a8

Download Submit
C:\Program Files (x86)\DriverHub\Qt5Core.dll
MD5
80a95eac18b0d41d393b3f72cf03cce0

SHA1
724eb57bcea953e132577ac540aa4ed0851dde17

SHA256
2059ae8af9b3adc40e3fbac46edce469a5a3340b1a42c0e2b0f79fcfab838ed2

SHA512
b17d526b2ae9e39d4dd3fe452ae9e2460801b542b4e6d396a0cb86b7486d10615d673ac85ca313190ea9626832a736eadbec4017608c9fbcc6966749ea84540a

Download Submit
C:\Program Files (x86)\DriverHub\Qt5Gui.dll
MD5
df758556c1235d3a7e0cfac2e060a465

SHA1
91fa26c8641cc13acb7030179ad286c73dbe2c02

SHA256
a383bc6b268d1e1b344414ddbdd400843649c61ad45c6018ca81ec0ef535b0dd

SHA512
9d14cb74388fcd49e28ff35e399c4c244440bd9ab31ae68459a6a613da7c42c1172e0f4c13f11dc30602759a6b8c815a80dcbab3d9d75f15f18cda4f62849467

Download Submit
C:\Program Files (x86)\DriverHub\Qt5Network.dll
MD5
4ccc16253f60fc8c06475bf936c8d168

SHA1
143aef75820abba5bcf80eba477079ccd7e14a1b

SHA256
df013042c338346b30d2e33a9895a6de8d6a6ee785406996b4a523957ab10a2e

SHA512
c5f881711c183e87ab069430634f9bd98851324fbe27563472d4dd59b05096e5cd3134d178d79083b8c98943e509fdc5c14696d60b9470be233b1fbfe4c6a4b1

Download Submit
C:\Program Files (x86)\DriverHub\Qt5Qml.dll
MD5
d3939d46d3756542c4eab1df9207a776

SHA1
51a3ee6299a765a29dec03c45058d8499bda0685

SHA256
caae45fcf9538b4d5994491a322aacc9854bdedf054b681cd21d8ee38d143673

SHA512
b33e904536859ca78d7667a9c0888bbb41467405cf4dd66ee6910f65b33828439aa904d2aa35fe23cf11d330e056104869af20791150a82587cadd638cdf3ff0

Download Submit
C:\Program Files (x86)\DriverHub\libcurl.dll
MD5
e5064adfbc48e3fb81f09e7b8e78d49d

SHA1
887fd08cb3c2989a9d88adc9717d3ec00ab97462

SHA256
4bfcaee356cf1b99d3dbc03d42018fcfc29271c6a72b373343d24c45a7569489

SHA512
0adb6675ad6de574c4cdba3e48cbb37901e6e8ef37a92b481d441a6dafe2726bb9432b7db7612040ff30ec490d8ebdc0eb8bdd1ad58b9bb53eab905934679a93

Download Submit
C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\Setup.log
MD5
e010f35ba0dbf84eb7cf475a6b8ace43

SHA1
0495ed4a01e58b191ee4362e10ce2c281d4382c1

SHA256
5ba6c72f4a24edfafb28c132d57b2ba2abb22560a3c9582f18f67de77d01720f

SHA512
fcdd947fb7653349fef49767d877e8782daa256f985856494ef716773486f14e10e7836a0eeece309baddf7ff67afe36c0f59adeb47fbebd2b444f94f0ce6b89

Download Submit
C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\Setup.log
MD5
922c3320ee6aeb58ed2fb635b4ad181d

SHA1
fafa4ef090c4cb5f227280446ac87e1c3408dd38

SHA256
46bcc9fff8644ae9bd7c19bd27d197dbfeb5d284213c176d1ac49e64e03f9a48

SHA512
0317be2697e81ecefb5dd30c1d2e39c11afa4c96275fab36cf471f421166bd232f641a42036467d2bf5aec9371e20aa7a3cd8871645a1c5bf90ba48be33d5534

Download Submit
C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\event_manager.log
MD5
aa593f2ab0440b878210d29829289ac3

SHA1
6971eb7ebbef5af417f3f3940f0a87615908d387

SHA256
b188a69e0be14c9ca73a82776ff2003a4d064c5204e9416c9c7b4be2964ce9f3

SHA512
b3b0ea78946c4df3ef68908bf4ad1ecb0c9590b541b799b808ceb8de7dd8720729ac7d81ad8bad5be17139559596ba3f6ab7b85d2d4f923dc7f6ecbe5eb73420

Download Submit
C:\Users\Admin\AppData\Local\Temp\DriverHub\Avast-downloader.exe
MD5
dec4a7357538dc67fb64b6d72b4a5cc2

SHA1
c0ad4db8228873b863019fc36a8c79b61525d9e1

SHA256
e0222ade7919ad88c685100b64a0e839ce9d87e2003a628f4b9843fda2c94b8b

SHA512
b50f7763e50939be41ca2647f28b8f15b5c646e42552e75e6f5ad0dd6373c1e8bb53bb6f72c68f5040259f85175a4cf9d68134912e0f4941bd861743870b2dd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\DriverHub\DriverHub.exe
MD5
c0d569fb36781dc938d48c51743cffd3

SHA1
1fcb3c805205b409e9f0e7245d555693431993c7

SHA256
aed087d1c472fad71497122b3fd145b9a31652ed1a847613a1f0f9cb09d3f6f6

SHA512
7e9a185b77c67dc534a65a7a80f71fada9cd8eb71d47eddd54928d0e9055e8d356ee1cd7481138264627621c22a9adf92a5507b771becbc469fb0f8679f0f6e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\DriverHub\DriverHub.exe
MD5
c0d569fb36781dc938d48c51743cffd3

SHA1
1fcb3c805205b409e9f0e7245d555693431993c7

SHA256
aed087d1c472fad71497122b3fd145b9a31652ed1a847613a1f0f9cb09d3f6f6

SHA512
7e9a185b77c67dc534a65a7a80f71fada9cd8eb71d47eddd54928d0e9055e8d356ee1cd7481138264627621c22a9adf92a5507b771becbc469fb0f8679f0f6e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\DriverHub\highdpimfcx86.exe
MD5
ca778a97f31d6ab131f1e0bb58a466fb

SHA1
5b8637acc24f11e9bf83c77aacc8d529ea62d173

SHA256
91c21c93a88dd82e8ae429534dacbc7a4885198361eae18d82920c714e328cf9

SHA512
e2de89cb69803339f765bc1b29a7d6b24effd079f8296463ae6be0a0fdc99d2df2bc742c77b1e22ec320366ada672c022605c26ce21f7a59ba9246df8be9e27d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DriverHub\highdpimfcx86.exe
MD5
ca778a97f31d6ab131f1e0bb58a466fb

SHA1
5b8637acc24f11e9bf83c77aacc8d529ea62d173

SHA256
91c21c93a88dd82e8ae429534dacbc7a4885198361eae18d82920c714e328cf9

SHA512
e2de89cb69803339f765bc1b29a7d6b24effd079f8296463ae6be0a0fdc99d2df2bc742c77b1e22ec320366ada672c022605c26ce21f7a59ba9246df8be9e27d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20210715105957_000_vcRuntimeMinimum_x86.log
MD5
31abfbc376c305315ce3475d2cfddf62

SHA1
fa4891716cb720485c329dc5239a89a942b2c70a

SHA256
99dcdf42ab6481457dd159b10a8b08872997101b3edf82641d38ad78b72390d5

SHA512
d74616e4255fdf3e04c96fa025dde7d52b409b337d9f037a2d3c180ed0619ac1d3507d2747356564bf14fd781c9c4cf86ed468dc1a35df34bdd129b5f7931f49

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20210715105957_001_vcRuntimeAdditional_x86.log
MD5
74e65216981388d4e53b30545644577d

SHA1
4381cb6f6367d20bcfd533d238864e658a86d01b

SHA256
d63f5287238a56d0aa0917d76cd50428d94917423d0e4d46bb21aed97399644a

SHA512
6825219c7fc2a1655085a51c74563ec1d089a793aa4c121366ccc94548bd6738cdfe94244509bc009c269a467824d906724e6c9a83202e97f1248fad646ee876

Download Submit
C:\Windows\SysWOW64\MSVCP140.dll
MD5
04224b38d06ee732b998318d3508300c

SHA1
d2cf697342b33203ef80b545573627e0b16a6a9e

SHA256
df7920f190d05f677367058e03a63c9b59e47a7395ab513cf9d0dcee1ec486f3

SHA512
e915d73def8cda745048a5da2db5713f2d9b7a2cac237e37ee82946b58a0e898a70f0ccdb1481bec24c3671a94ed5bc65851dc2957c594e9f2ba8f1996ed73e4

Download Submit
C:\Windows\SysWOW64\MSVCP140_1.dll
MD5
d6d10681231978e04c449e8c3a42dbf7

SHA1
93e8d19d7ad7e79b8627da0421d3aea0c077ec2d

SHA256
b5124c320f78f377da3c89078f66a99c76fc115a2bf85455666f2107caf24dcf

SHA512
344968c315c2621158187a5f858084a40f485910cafe044f7ee8a1349fb17423c7d8ed0d3de9573f6c0f7f4155be0c1546c141ecb032ee29a81aebddf14652d1

Download Submit
C:\Windows\SysWOW64\VCRUNTIME140.dll
MD5
9e2d8462f10b8972bf8a14c4457b24e2

SHA1
3b3099ecd21728b3cba24826bb948c213bd14761

SHA256
827f03554e5eaccb970bb9e53136a8d96be5fd2748572eee1a1f7616f36d9abe

SHA512
c7572e293fb3a7ef402f876b162d48e529d47dc282850b406e05fdf6cee011cf28be224e79ce82054324a6c043c27610fad108992ff0e80e18d5b2dd38ebdb61

Download Submit
C:\Windows\Temp\asw.1b9d154fac0b015d\avast_free_antivirus_setup_online_x64.exe
MD5
8d29f15bf97bc116cc59b7b6c0538768

SHA1
ec9576f4592e6e4973e2011e85cb9c253d8a089c

SHA256
ca8dd4180c36f7fb03a6e0ed26f3f5309f5525f07f8657aba3c3bb8957c0012c

SHA512
5f16c58da011d86dd12ee015dbe047f50c62815b346ef026a12575fd9e3d6d19477e470808f8af98d93a38cb0e4cbbc29aa47f22d43149dd0d4e5ecdbe589a98

Download Submit
C:\Windows\Temp\asw.1b9d154fac0b015d\avast_free_antivirus_setup_online_x64.exe
MD5
8d29f15bf97bc116cc59b7b6c0538768

SHA1
ec9576f4592e6e4973e2011e85cb9c253d8a089c

SHA256
ca8dd4180c36f7fb03a6e0ed26f3f5309f5525f07f8657aba3c3bb8957c0012c

SHA512
5f16c58da011d86dd12ee015dbe047f50c62815b346ef026a12575fd9e3d6d19477e470808f8af98d93a38cb0e4cbbc29aa47f22d43149dd0d4e5ecdbe589a98

Download Submit
C:\Windows\Temp\asw.1b9d154fac0b015d\ecoo.edat
MD5
ef5d211f72eaa1f423ae036ad22904bb

SHA1
03507c4a6febdb3d11481e5f82cd9bc297a36eb5

SHA256
a18ce368798f5738d12fea0a4378d7748881767f39b7bf9d91fca61251b6228d

SHA512
39eee415b593ce3168a3569f3870b580cb31d1eab6355319615e317050619f0ae7a62a9736b879ac29a563e79f1d74b8b9ba959c142ef4e5653b1cf7f9c1afda

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\Instup.dll
MD5
812cc16a310075bedebf77821cae2ce2

SHA1
c133649625794c68d96d3a4ceb4eada87d173c59

SHA256
351616a4b8bc2089686b39b2b11bbd917736bde19216beddb4a7fa3492e8775c

SHA512
6256875e5bd3347f642f8a530473bf1c2a177f4bfdacb8d41a65b5c56da27a2ad1fa1d3d47a788eac8b2f2a390d968b8c4f92013fc4943d89a18e122af16f6ac

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\Instup.exe
MD5
d1af49d19005a4767847b4231843097d

SHA1
1a78a948d00e0d3925397147636b76645e9dd7d3

SHA256
f738c48051553d0d118af6a01314b9ba3c73f535340e6b568a636d98bbb7eba7

SHA512
23ffb50f724406635f77c36e6780bdb27a9f8a18961f71b340a7b19554222826515b7280943d1a0efc8020413b1ac9b061831d51348f09b927d569c35fc3331d

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\New_150509a6\Instup.dll
MD5
812cc16a310075bedebf77821cae2ce2

SHA1
c133649625794c68d96d3a4ceb4eada87d173c59

SHA256
351616a4b8bc2089686b39b2b11bbd917736bde19216beddb4a7fa3492e8775c

SHA512
6256875e5bd3347f642f8a530473bf1c2a177f4bfdacb8d41a65b5c56da27a2ad1fa1d3d47a788eac8b2f2a390d968b8c4f92013fc4943d89a18e122af16f6ac

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\New_150509a6\instup.exe
MD5
d1af49d19005a4767847b4231843097d

SHA1
1a78a948d00e0d3925397147636b76645e9dd7d3

SHA256
f738c48051553d0d118af6a01314b9ba3c73f535340e6b568a636d98bbb7eba7

SHA512
23ffb50f724406635f77c36e6780bdb27a9f8a18961f71b340a7b19554222826515b7280943d1a0efc8020413b1ac9b061831d51348f09b927d569c35fc3331d

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\config.def
MD5
92338a7f3151c9840feba40f011c6de2

SHA1
67eb0973f39129535d0a875ffe7d6712fa4dcb7a

SHA256
daacfd7589691ac49fe00ba7be8a28f434788612e68269958dcd63066e44dd06

SHA512
bbb4144fb705404d2dcade4b3f8923e97959ff3673b39648ddfef5dbb882cf1ba3bed9c203ed4c542d8e488a806a359e28cf90a79b74bdda7dcc8b946398cf7c

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\config.def
MD5
b0ab4052b62782b8e446afb1e947df80

SHA1
ecd385da3db3a95ff431fd57e77d85e544143606

SHA256
537ff1ad485730a5c35bdd2e5eb2002534ed7031e6cbe8d292e8c1140c7a86a4

SHA512
b38bc80d50dceb2fd982282dfc283e9085176362751f42f90d4fa22c42487dda2f7d5a2a18232b7972c8161b98c61c044be5dba90cfb709b3ac1a1c7774b2cee

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\config.ini
MD5
83ef40720f5a0ec0ff07fa2d803c0933

SHA1
f7cee9c15590c2efe0c189083668d4d89ab1e22e

SHA256
7dd020e171ba45c33b4e3bdb4314028777f5ebdc3c2afeb5bd83bdb2aac76eeb

SHA512
7d2111b38a1dbc91979461d8fa113520ca681c363147df130de0af3db910b78555f6e357c62496fbd462593139ec9a8ca7cbe20046a5f300f0a1010c356768ea

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\instcont_x64_ais-9a6.vpx
MD5
d34af9e0a1a70c16479473f512b94874

SHA1
3102fd9fe386c52f81a7ba86c3c33d33abc5b4d5

SHA256
2ff8995eff94345517dde8625e216af579bb2b8df1c97e21838560ae26a6d808

SHA512
ddd7935b00dc3180ce8d77e06043aec04af1514f9fd4a8e50fe6659657581ecfa780c7c20b9d496a7974f3fbb2552f0f307983f22a0298dad951288d625f8606

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\instup_x64_ais-9a6.vpx
MD5
3c9e3e3ba76fd5a1380ab9c95443e32b

SHA1
f712b6eff99ea95173fb4c639a1b7fc903f5a9aa

SHA256
efc0da895b730c7c047acf5e0f628dbdb70fdf3ddfdd211cf5cca78617ee85d0

SHA512
c679d6cc7b7a798e0390b74009bf21f991826c286f0ad443b12b734c674bb2bcb5a24186b9732fd067bb4302d78db9ebe7c08529666dcd3a8430fe9084d8cdbd

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\part-prg_ais-150509a6.vpx
MD5
911b68cb6faf0bdf9e508c2ba00e1e71

SHA1
30615b78d43f0ca8657609b6fce0d50111270397

SHA256
1c0db8ac0b9e40ec4acdb43c309f59f3dcb092ca1cf9cad6dfca1d025231a750

SHA512
8230ba3adce521ca0ceca1f5cec8b14618da44d970c8ce9ddcfc07bb5c11b2e6151181e6b8d512a43c5b2f8275f7de949c7fc9ae8c80c33752ad12ba3f4aff28

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\part-setup_ais-150509a6.vpx
MD5
3712276a38aea320b0f9b76eb6d9b468

SHA1
d1d438e4c093a078b5f2fb89524c6a56b26f43e6

SHA256
c0441807c1994d4e8ff40e24608223e15977621f1384728559470e4058037771

SHA512
f322c7c2f9f85aada7df3b68992dd048620bd0a5a697c43e5e5d13bfb409f7c050caf97cb0f475ca0aa17acba4b8f33c9475d0e6a05ec378407d26ba7d82a137

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\prod-pgm.vpx
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\prod-pgm.vpx
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\prod-vps.vpx
MD5
7033569478d4197c850c62536b94fe42

SHA1
faacbdc0947f247698e1acb0077c5a405d008836

SHA256
d3988e288a30126b37e184b0550c8eefdc9f8dc0d36072a81e30bda6b94e057e

SHA512
136ef838e6e478156ec74f77122088dc684492e23dc634d3b2c7d522db671138ff01811823116f351dbdc496f3ef237a304827fad0af49030e9c35aa826c8210

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\servers.def
MD5
56d5f04ae1c2c4289d21a223166dffa8

SHA1
668ceecf07409f68e1cc2d04dbb6a5f9ea2f5b6b

SHA256
5c5a5167b54233e0223526b4220b245a7cd006978d8e928cd1df877754f22aa7

SHA512
98b9fd5d50f3287079a97323f4ee23b478b30d015f1f042620f2d5bfa7520813e2a549183250fcacc612e463973cf20f3723310a0669a4b555a994e0981e8e2f

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\servers.def
MD5
56d5f04ae1c2c4289d21a223166dffa8

SHA1
668ceecf07409f68e1cc2d04dbb6a5f9ea2f5b6b

SHA256
5c5a5167b54233e0223526b4220b245a7cd006978d8e928cd1df877754f22aa7

SHA512
98b9fd5d50f3287079a97323f4ee23b478b30d015f1f042620f2d5bfa7520813e2a549183250fcacc612e463973cf20f3723310a0669a4b555a994e0981e8e2f

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\servers.def.vpx
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\setgui_x64_ais-9a6.vpx
MD5
efabf576d1b8c266f975b9e89eb8f62b

SHA1
336bceea4fa41063c14e88467c59efd61a07e711

SHA256
7cc0c2b8b6f8a169c5cc693c9873becbe7959fc15f56528c181eebf8619a58f8

SHA512
808430901e30daeddc9ed6efa412807ddf6c7ef42178b5ad80f5696d2b76f7b6cc27e318ede02ae70577445808ea009d9fee29e63c72b4a665cfe247a97307ce

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\setup.def
MD5
3242a5fe4c8610d254a0f775f693ee46

SHA1
49304ed65d849c34b64701673d44d931e19ae2f7

SHA256
9ed5f7aca12a489919dc70a875e30e2c284b1ddd2770b31084892581ddcec9f9

SHA512
a221240ad7df5950dfb5413191323236390416bc4c2201544a80c09c5f0599a44c2321964aaa2242198041704effb37b405c14e3571a5d1224e118721833dcbd

Download Submit
C:\Windows\Temp\asw.eec113b37c07283a\uat64.vpx
MD5
003bc4c74a27f83ed3f7b4d3ca80afc8

SHA1
e450b026fa6710c027b331182c9bd9a46b6a271a

SHA256
7f99c91ed05b207102bc04f2bc47e82b136eb36881ecc38808b9f2ed086c205d

SHA512
7c15c4f55850e03b9f13ccedc49c0bd4bb2bf0b7dcdd4f6bcc4d221264b882c53932e79b3218537ef4570414a059c06257ee3a9a4971a56fe525fd70691ab57a

Download Submit
C:\Windows\Temp\{A1F2C286-8E58-46E8-9C5E-B168DDCD2478}\.cr\highdpimfcx86.exe
MD5
d34111f1c804b76b2545bbe88cda9d85

SHA1
1b6d4b7beb22c27a809194d6029cefec3aa605a2

SHA256
6d357caa2726d154394b4fcd3cebf36e60f3058e23b9938de602ee537bcc4905

SHA512
2ca8fcab1c6bddef6db00c8e15bf4a1531288ae5c9f822e5856417c87fc4e8211296f47bb48318798367cb9144f519ebdb1e9b48aea9f44cac8ee47b12b9d8e7

Download Submit
C:\Windows\Temp\{A1F2C286-8E58-46E8-9C5E-B168DDCD2478}\.cr\highdpimfcx86.exe
MD5
d34111f1c804b76b2545bbe88cda9d85

SHA1
1b6d4b7beb22c27a809194d6029cefec3aa605a2

SHA256
6d357caa2726d154394b4fcd3cebf36e60f3058e23b9938de602ee537bcc4905

SHA512
2ca8fcab1c6bddef6db00c8e15bf4a1531288ae5c9f822e5856417c87fc4e8211296f47bb48318798367cb9144f519ebdb1e9b48aea9f44cac8ee47b12b9d8e7

Download Submit
C:\Windows\Temp\{EC597860-0898-4327-B0BE-F4C80ADBA6AB}\.be\VC_redist.x86.exe
MD5
d34111f1c804b76b2545bbe88cda9d85

SHA1
1b6d4b7beb22c27a809194d6029cefec3aa605a2

SHA256
6d357caa2726d154394b4fcd3cebf36e60f3058e23b9938de602ee537bcc4905

SHA512
2ca8fcab1c6bddef6db00c8e15bf4a1531288ae5c9f822e5856417c87fc4e8211296f47bb48318798367cb9144f519ebdb1e9b48aea9f44cac8ee47b12b9d8e7

Download Submit
C:\Windows\Temp\{EC597860-0898-4327-B0BE-F4C80ADBA6AB}\.be\VC_redist.x86.exe
MD5
d34111f1c804b76b2545bbe88cda9d85

SHA1
1b6d4b7beb22c27a809194d6029cefec3aa605a2

SHA256
6d357caa2726d154394b4fcd3cebf36e60f3058e23b9938de602ee537bcc4905

SHA512
2ca8fcab1c6bddef6db00c8e15bf4a1531288ae5c9f822e5856417c87fc4e8211296f47bb48318798367cb9144f519ebdb1e9b48aea9f44cac8ee47b12b9d8e7

Download Submit
C:\Windows\Temp\{EC597860-0898-4327-B0BE-F4C80ADBA6AB}\cab54A5CABBE7274D8A22EB58060AAB7623
MD5
bc1d1b83a946ae7a1470dffe0a2de61e

SHA1
40566282555fce73db465d1c4616f34e229008ad

SHA256
75925d447f7b1bf625fcec1db83af283be9d048fc45f3c7806066f116ab8c64e

SHA512
a54fa1465b5921a031b451303c8198df175f80f02b8ea983bf7d77b86066127f13fac8b62c72b2eb5420f7b3e2487dbd735b24aa326db1f5f30128d6affa99ba

Download Submit
C:\Windows\Temp\{EC597860-0898-4327-B0BE-F4C80ADBA6AB}\cabB3E1576D1FEFBB979E13B1A5379E0B16
MD5
baf306e23e90c77f853728b9c8503b60

SHA1
ac894c4b49f051bd50cf5419d6420539837aece4

SHA256
667c79fad83ea5c3c6fc70b02b160782ae87a2c5ed01ccd657a1044f2a33424b

SHA512
217c0e97aa92c40f34b75ccfe1ab411ed06c0409049d03f203d49cdac7424f1226be95d4aa7bcd052b84faf64cdbc9f9e4142ccfa24b61780594eca1116a1a0a

Download Submit
C:\Windows\Temp\{EC597860-0898-4327-B0BE-F4C80ADBA6AB}\vcRuntimeAdditional_x86
MD5
4c79a99971e9c6b401b004e8fe0ac07a

SHA1
6b5c540dbe53ec97f13022720af1d9d86ef44116

SHA256
9b664e41d0b80112ecfbee6d508390003d3d4dfe1c2537b03b2f53dcfa38a421

SHA512
6e86863691fdbaa2401fcd09b44a73b8d678d9dd98a576ff283f896a812650274e976aa73eac46818590365e72ba3af02dbdc2454fb9e3b6c7682c2ceb2bba1d

Download Submit
C:\Windows\Temp\{EC597860-0898-4327-B0BE-F4C80ADBA6AB}\vcRuntimeMinimum_x86
MD5
067a3e4d1684efd6076664d92b6256c1

SHA1
d11c4e80a7181dfeac39a0a1fe7877217a3c7dfe

SHA256
18dcd9d2d3643aa029eaeb98fb3705f11bf9c0efa9cb8d91a5c7f8bc8c024e36

SHA512
cb654029586441f59f462d5e845b017c5761e6c05a60e0f04f8b91a0569485a4a86142dd01a4f6f0a0643715c46e0d9c9096c664ce879a7fd5aa1685d4b718e0

Download Submit
\Program Files (x86)\DriverHub\Qt5Core.dll
MD5
80a95eac18b0d41d393b3f72cf03cce0

SHA1
724eb57bcea953e132577ac540aa4ed0851dde17

SHA256
2059ae8af9b3adc40e3fbac46edce469a5a3340b1a42c0e2b0f79fcfab838ed2

SHA512
b17d526b2ae9e39d4dd3fe452ae9e2460801b542b4e6d396a0cb86b7486d10615d673ac85ca313190ea9626832a736eadbec4017608c9fbcc6966749ea84540a

Download Submit
\Program Files (x86)\DriverHub\Qt5Gui.dll
MD5
df758556c1235d3a7e0cfac2e060a465

SHA1
91fa26c8641cc13acb7030179ad286c73dbe2c02

SHA256
a383bc6b268d1e1b344414ddbdd400843649c61ad45c6018ca81ec0ef535b0dd

SHA512
9d14cb74388fcd49e28ff35e399c4c244440bd9ab31ae68459a6a613da7c42c1172e0f4c13f11dc30602759a6b8c815a80dcbab3d9d75f15f18cda4f62849467

Download Submit
\Program Files (x86)\DriverHub\Qt5Network.dll
MD5
4ccc16253f60fc8c06475bf936c8d168

SHA1
143aef75820abba5bcf80eba477079ccd7e14a1b

SHA256
df013042c338346b30d2e33a9895a6de8d6a6ee785406996b4a523957ab10a2e

SHA512
c5f881711c183e87ab069430634f9bd98851324fbe27563472d4dd59b05096e5cd3134d178d79083b8c98943e509fdc5c14696d60b9470be233b1fbfe4c6a4b1

Download Submit
\Program Files (x86)\DriverHub\Qt5Qml.dll
MD5
d3939d46d3756542c4eab1df9207a776

SHA1
51a3ee6299a765a29dec03c45058d8499bda0685

SHA256
caae45fcf9538b4d5994491a322aacc9854bdedf054b681cd21d8ee38d143673

SHA512
b33e904536859ca78d7667a9c0888bbb41467405cf4dd66ee6910f65b33828439aa904d2aa35fe23cf11d330e056104869af20791150a82587cadd638cdf3ff0

Download Submit
\Program Files (x86)\DriverHub\libcurl.dll
MD5
e5064adfbc48e3fb81f09e7b8e78d49d

SHA1
887fd08cb3c2989a9d88adc9717d3ec00ab97462

SHA256
4bfcaee356cf1b99d3dbc03d42018fcfc29271c6a72b373343d24c45a7569489

SHA512
0adb6675ad6de574c4cdba3e48cbb37901e6e8ef37a92b481d441a6dafe2726bb9432b7db7612040ff30ec490d8ebdc0eb8bdd1ad58b9bb53eab905934679a93

Download Submit
\Windows\SysWOW64\msvcp140.dll
MD5
04224b38d06ee732b998318d3508300c

SHA1
d2cf697342b33203ef80b545573627e0b16a6a9e

SHA256
df7920f190d05f677367058e03a63c9b59e47a7395ab513cf9d0dcee1ec486f3

SHA512
e915d73def8cda745048a5da2db5713f2d9b7a2cac237e37ee82946b58a0e898a70f0ccdb1481bec24c3671a94ed5bc65851dc2957c594e9f2ba8f1996ed73e4

Download Submit
\Windows\SysWOW64\msvcp140_1.dll
MD5
d6d10681231978e04c449e8c3a42dbf7

SHA1
93e8d19d7ad7e79b8627da0421d3aea0c077ec2d

SHA256
b5124c320f78f377da3c89078f66a99c76fc115a2bf85455666f2107caf24dcf

SHA512
344968c315c2621158187a5f858084a40f485910cafe044f7ee8a1349fb17423c7d8ed0d3de9573f6c0f7f4155be0c1546c141ecb032ee29a81aebddf14652d1

Download Submit
\Windows\SysWOW64\vcruntime140.dll
MD5
9e2d8462f10b8972bf8a14c4457b24e2

SHA1
3b3099ecd21728b3cba24826bb948c213bd14761

SHA256
827f03554e5eaccb970bb9e53136a8d96be5fd2748572eee1a1f7616f36d9abe

SHA512
c7572e293fb3a7ef402f876b162d48e529d47dc282850b406e05fdf6cee011cf28be224e79ce82054324a6c043c27610fad108992ff0e80e18d5b2dd38ebdb61

Download Submit
\Windows\Temp\asw.1b9d154fac0b015d\avast_free_antivirus_setup_online_x64.exe
MD5
8d29f15bf97bc116cc59b7b6c0538768

SHA1
ec9576f4592e6e4973e2011e85cb9c253d8a089c

SHA256
ca8dd4180c36f7fb03a6e0ed26f3f5309f5525f07f8657aba3c3bb8957c0012c

SHA512
5f16c58da011d86dd12ee015dbe047f50c62815b346ef026a12575fd9e3d6d19477e470808f8af98d93a38cb0e4cbbc29aa47f22d43149dd0d4e5ecdbe589a98

Download Submit
\Windows\Temp\asw.eec113b37c07283a\Instup.dll
MD5
812cc16a310075bedebf77821cae2ce2

SHA1
c133649625794c68d96d3a4ceb4eada87d173c59

SHA256
351616a4b8bc2089686b39b2b11bbd917736bde19216beddb4a7fa3492e8775c

SHA512
6256875e5bd3347f642f8a530473bf1c2a177f4bfdacb8d41a65b5c56da27a2ad1fa1d3d47a788eac8b2f2a390d968b8c4f92013fc4943d89a18e122af16f6ac

Download Submit
\Windows\Temp\asw.eec113b37c07283a\uat_2752.dll
MD5
deff12d9719ce3b091348877ab5b3736

SHA1
95aba652640c7039c97c5f7c97ae76f58e6aa6c4

SHA256
1d3aa362c151e98596ee7d49e5f08435897d40ae0148be923fe2817bef0a07cf

SHA512
e893ac726881531b2e022ba4bffd63f2b010c96d7e480b7f1014d54551306d1763617f3dba85e0b7a0e1581bdb573651f39fc7385c470744e3c8819e633e410f

Download Submit
\Windows\Temp\asw.eec113b37c07283a\uat_3180.dll
MD5
deff12d9719ce3b091348877ab5b3736

SHA1
95aba652640c7039c97c5f7c97ae76f58e6aa6c4

SHA256
1d3aa362c151e98596ee7d49e5f08435897d40ae0148be923fe2817bef0a07cf

SHA512
e893ac726881531b2e022ba4bffd63f2b010c96d7e480b7f1014d54551306d1763617f3dba85e0b7a0e1581bdb573651f39fc7385c470744e3c8819e633e410f

Download Submit
\Windows\Temp\{EC597860-0898-4327-B0BE-F4C80ADBA6AB}\.ba\wixstdba.dll
MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
memory/640-253-0x0000000000000000-mapping.dmp

Download
memory/912-135-0x0000000000000000-mapping.dmp

Download
memory/1272-365-0x0000000000000000-mapping.dmp

Download
memory/2252-120-0x0000000000000000-mapping.dmp

Download
memory/2752-145-0x0000000000000000-mapping.dmp

Download
memory/3180-161-0x0000000000000000-mapping.dmp

Download
memory/3192-117-0x0000000000000000-mapping.dmp

Download
memory/3472-114-0x0000000000000000-mapping.dmp

Download
memory/3848-141-0x0000000000000000-mapping.dmp

Download
memory/3860-124-0x0000000000000000-mapping.dmp

Download
memory/4348-198-0x000000000A790000-0x000000000A791000-memory.dmp

Filesize
4KB

Download
memory/4348-194-0x0000000003E50000-0x0000000004050000-memory.dmp

Filesize
2.0MB

Download
memory/4348-197-0x0000000008E10000-0x0000000008E11000-memory.dmp

Filesize
4KB

Download
memory/4348-192-0x0000000003A10000-0x0000000003E50000-memory.dmp

Filesize
4.2MB

Download
memory/4348-173-0x0000000000000000-mapping.dmp

Download
memory/4348-191-0x0000000000790000-0x00000000007B3000-memory.dmp

Filesize
140KB

Download
memory/4376-280-0x0000000000000000-mapping.dmp

Download
memory/4400-307-0x0000000000000000-mapping.dmp

Download
memory/4476-195-0x0000000000000000-mapping.dmp

Download
memory/4520-334-0x0000000000000000-mapping.dmp

Download
memory/4860-199-0x0000000000000000-mapping.dmp

Download
memory/5068-226-0x0000000000000000-mapping.dmp

Download