smokeloader | 3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37

Modify Registry

Processes:

instup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\aswKbd\ImagePath = "system32\\drivers\\aswKbd.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\aswRdr\ImagePath = "system32\\drivers\\aswRdr2.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\aswSP\ImagePath = "system32\\drivers\\aswSP.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\aswSnx\ImagePath = "system32\\drivers\\aswSnx.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\aswArPot\ImagePath = "system32\\drivers\\aswArPot.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\aswbuniv\ImagePath = "system32\\drivers\\aswbuniv.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\aswStm\ImagePath = "system32\\drivers\\aswStm.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\aswbidsdriver\ImagePath = "system32\\drivers\\aswbidsdriver.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\aswVmm\ImagePath = "system32\\drivers\\aswVmm.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\aswArDisk\ImagePath = "system32\\drivers\\aswArDisk.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\aswNetHub\ImagePath = "system32\\drivers\\aswNetHub.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\aswMonFlt\ImagePath = "system32\\drivers\\aswMonFlt.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\aswRvrt\ImagePath = "system32\\drivers\\aswRvrt.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\aswbidsh\ImagePath = "system32\\drivers\\aswbidsh.sys"	instup.exe

Deletes itself 1 IoCs

Processes:

pid process

1196

Executes dropped EXE 35 IoCs

Processes:

tjidejdABEB.exeB31C.exeavast_free_antivirus_setup_online.exeavast_free_antivirus_setup_online_x64.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exesbr.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeAvEmUpdate.exeAvEmUpdate.exeavBugReport.exeavBugReport.exeSetupInf.exeSetupInf.exeRegSvr.exeRegSvr.exeRegSvr.exeRegSvr.exeAvastNM.exeengsup.exeoverseer.exewsc_proxy.exeengsup.exe

pid	process
2380	tjidejd
2244	ABEB.exe
2072	B31C.exe
2644	avast_free_antivirus_setup_online.exe
2832	avast_free_antivirus_setup_online_x64.exe
324	instup.exe
2560	instup.exe
2720	aswOfferTool.exe
2812	aswOfferTool.exe
2368	aswOfferTool.exe
860	aswOfferTool.exe
2916	aswOfferTool.exe
768	aswOfferTool.exe
2632	aswOfferTool.exe
1364	aswOfferTool.exe
2720	sbr.exe
3964	SetupInf.exe
4004	SetupInf.exe
4048	SetupInf.exe
4064	SetupInf.exe
1564	AvEmUpdate.exe
488	AvEmUpdate.exe
5616	avBugReport.exe
5632	avBugReport.exe
5864	SetupInf.exe
5820	SetupInf.exe
6140	RegSvr.exe
6184	RegSvr.exe
6404	RegSvr.exe
6440	RegSvr.exe
6284	AvastNM.exe
6316	engsup.exe
6300	overseer.exe
6748	wsc_proxy.exe
6796	engsup.exe

Loads dropped DLL 64 IoCs

Processes:

avast_free_antivirus_setup_online.exeavast_free_antivirus_setup_online_x64.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exe

pid	process
2644	avast_free_antivirus_setup_online.exe
2644	avast_free_antivirus_setup_online.exe
1196
2832	avast_free_antivirus_setup_online_x64.exe
2832	avast_free_antivirus_setup_online_x64.exe
2832	avast_free_antivirus_setup_online_x64.exe
2832	avast_free_antivirus_setup_online_x64.exe
2832	avast_free_antivirus_setup_online_x64.exe
2832	avast_free_antivirus_setup_online_x64.exe
2832	avast_free_antivirus_setup_online_x64.exe
324	instup.exe
324	instup.exe
324	instup.exe
324	instup.exe
324	instup.exe
324	instup.exe
324	instup.exe
324	instup.exe
324	instup.exe
324	instup.exe
324	instup.exe
324	instup.exe
324	instup.exe
324	instup.exe
324	instup.exe
324	instup.exe
324	instup.exe
324	instup.exe
2560	instup.exe
2368	aswOfferTool.exe
2916	aswOfferTool.exe
2632	aswOfferTool.exe
1364	aswOfferTool.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe
2560	instup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

RegSvr.exeinstup.exeRegSvr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}\InProcServer32\ = "C:\\Program Files\\Avast Software\\Avast\\ashShell.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\InprocServer32\ = "C:\\Program Files\\Avast Software\\Avast\\asOutExt.dll"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32\ = "C:\\Program Files\\Avast Software\\Avast\\aswAMSI.dll"	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\InprocServer32	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}\InProcServer32	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}\InProcServer32\ReleaseName = "C:\\Program Files\\Avast Software\\Avast\\ashShell.dll"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32\ThreadingModel = "Both"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}\InProcServer32\ThreadingModel = "Apartment"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32\ = "C:\\Program Files\\Avast Software\\Avast\\aswAMSI.dll"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32\ThreadingModel = "Both"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\InprocServer32\ThreadingModel = "Apartment"	RegSvr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

instup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AvRepair = "\"C:\\Program Files\\Avast Software\\Avast\\setup\\instup.exe\" /instop:repair /wait"	instup.exe

Checks for any installed AV software in registry 1 TTPs 64 IoCs

Security Software Discovery

T1518.001

Processes:

instup.exeSetupInf.exeAvEmUpdate.exeavBugReport.exeinstup.exeSetupInf.exeRegSvr.exeengsup.exeSetupInf.exeengsup.exeSetupInf.exeAvEmUpdate.exeSetupInf.exeRegSvr.exewsc_proxy.exeRegSvr.exeSetupInf.exeRegSvr.exeAvastNM.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ShepherdDebug	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages	AvEmUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\UpdateVersion = "317"	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode	avBugReport.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\InstallTime = "1714158688"	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ReportFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LicenseFile	engsup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\IDP	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\JournalFolder	SetupInf.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common	avBugReport.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupVersion	avBugReport.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupFolder	RegSvr.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Scanner	engsup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\JournalFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\TempFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\TempFolder	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\StreamBack\Test	avBugReport.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\UpdateVersion = "650"	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\JournalFolder	avBugReport.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Volatile	avBugReport.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog	SetupInf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\InstallTree = "MTE5NixDOlxXaW5kb3dzXGV4cGxvcmVyLmV4ZTsxMjkyLEM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblxjaHJvbWUuZXhlOzI2NDQsQzpcVXNlcnNcQWRtaW5cRG93bmxvYWRzXGF2YXN0X2ZyZWVfYW50aXZpcnVzX3NldHVwX29ubGluZS5leGU7MjgzMixDOlxXaW5kb3dzXFRlbXBcYXN3LjdhZDI0ZjE3N2U4YjZmN2FcYXZhc3RfZnJlZV9hbnRpdmlydXNfc2V0dXBfb25saW5lX3g2NC5leGU7MzI0LEM6XFdpbmRvd3NcVGVtcFxhc3cuYjI5MDZlOTYzZjJiMjNmMlxJbnN0dXAuZXhl"	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ReportFolder	SetupInf.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	SetupInf.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder	engsup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CrashGuardProcessWatcherExclusions	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SetupInf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\UpdateVersion = "318"	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupFolder	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast\properties\settings	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\JournalFolder	engsup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CrashGuardProcessWatcherExclusions	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Platform = "x64"	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog	SetupInf.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\StreamBack	avBugReport.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SZBProgramFolder	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Instup_IgnoredDownloadTypes	instup.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\MicroUpdates	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\UpdateVersion = "648"	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\StreamBack	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry	SetupInf.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\TempFolder	engsup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder	AvastNM.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LogFolder	engsup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ChestFolder	engsup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\One	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Version	wsc_proxy.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

41 drive.google.com
42 drive.google.com

flow	ioc
41	drive.google.com
42	drive.google.com

Writes to the Master Boot Record (MBR) 1 TTPs 18 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

avast_free_antivirus_setup_online.exeSetupInf.exeAvEmUpdate.exewsc_proxy.exeABEB.exeSetupInf.exeRegSvr.exeavast_free_antivirus_setup_online_x64.exeSetupInf.exeSetupInf.exeavBugReport.exeSetupInf.exeSetupInf.exeinstup.exeRegSvr.exeRegSvr.exeRegSvr.exeinstup.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	avast_free_antivirus_setup_online.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	AvEmUpdate.exe
File opened for modification	\??\PhysicalDrive0	wsc_proxy.exe
File opened for modification	\??\PHYSICALDRIVE0	ABEB.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	avast_free_antivirus_setup_online_x64.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	avBugReport.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	instup.exe

Drops file in System32 directory 23 IoCs

Processes:

DrvInst.exeSetupInf.exeinstup.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\aswnetnd6.inf_amd64_neutral_ae5022b1cccaa39c\aswnetnd6.PNF	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1b505cdb-1f93-509c-6d89-b511a3792a16}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1b505cdb-1f93-509c-6d89-b511a3792a16}\x64\aswNetNd6.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1b505cdb-1f93-509c-6d89-b511a3792a16}\SETCF71.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1b505cdb-1f93-509c-6d89-b511a3792a16}\aswNetNd6.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\aswnetnd6.inf_amd64_neutral_ae5022b1cccaa39c\aswNetNd6.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	SetupInf.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	SetupInf.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1b505cdb-1f93-509c-6d89-b511a3792a16}\aswNetNd6.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	SetupInf.exe
File opened for modification	C:\Windows\system32\aswe9fbd8ead0b99041.tmp	instup.exe
File created	C:\Windows\system32\aswe9fbd8ead0b99041.tmp	instup.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1b505cdb-1f93-509c-6d89-b511a3792a16}\x64\SETCF70.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1b505cdb-1f93-509c-6d89-b511a3792a16}\SETCF72.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1b505cdb-1f93-509c-6d89-b511a3792a16}\SETCF72.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\aswnetnd6.inf_amd64_neutral_ae5022b1cccaa39c\aswnetnd6.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1b505cdb-1f93-509c-6d89-b511a3792a16}\x64	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1b505cdb-1f93-509c-6d89-b511a3792a16}\x64\SETCF70.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1b505cdb-1f93-509c-6d89-b511a3792a16}\SETCF71.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe

Drops file in Program Files directory 64 IoCs

Processes:

instup.exeengsup.exeengsup.exeAvEmUpdate.exe

description	ioc	process
File created	C:\Program Files\Avast Software\Avast\defs\24042599\aswc2763685e1fe2333.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24042599\db_wat.nmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswMonDS.sys	instup.exe
File created	C:\Program Files\Avast Software\Avast\defs\24042599\avast.local_vc142.crt\vcruntime140.dll	engsup.exe
File created	C:\Program Files\Avast Software\Avast\aswef50e77bc073b36a.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\CommonRes.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\api-ms-win-core-file-l1-2-0.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\resources_omni	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24042599\engsup.ini	engsup.exe
File created	C:\Program Files\Avast Software\Avast\RescueDisk\aswa5db05952ee3d8b9.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24042599\certs.map.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\Licenses\mbedTLS.txt	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-core-synch-l1-2-0.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\aswe437bd4a1c23b865.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw1406c61ef2ae9b46.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\Licenses\asw455c6613762b64c9.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\aswabacd190e3210db4.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\api-ms-win-crt-math-l1-1-0.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswjsscan.dll	instup.exe
File created	C:\Program Files\Avast Software\Avast\asw926ac85059326e67.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24042599\aswHds.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\hns_tools.dll	instup.exe
File opened for modification	\??\c:\program files\avast software\avast\setup\asw2f4985fbc402423b.backup	instup.exe
File created	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\asw1cce4bd85116ea12.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24042599\aswJsFlt.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\AhAScr.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw5e3b9e11c34f34ea.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\Licenses\lzfse.txt.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\ashServ.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswAux.dll.sum	instup.exe
File created	C:\Program Files\Avast Software\Avast\aswd403b844535d9f18.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\asw822c7c902ff8c5a9.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24042599\db_java.sig	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswidsagent.exe.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\concrt140.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw5b10b9e06c316750.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\Setup\4553c9a5-1fb1-4667-b4dd-59f0c4446dab.cab	AvEmUpdate.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24042599\aswc2763685e1fe2333.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\aswf57f188bc32cc107.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\aswe99442f85773c6b1.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\AvastNM.exe	instup.exe
File created	C:\Program Files\Avast Software\Avast\defs\24042599\asw0ab2f64957f256ca.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\module_lifetime.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw0d62219c24d96f6a.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\mfc140u.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-core-synch-l1-1-0.dll.sum	instup.exe
File opened for modification	C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\AvastNM.exe.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswProperty.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\burger_client.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswBoot.exe.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\asw204bd8ce5fccf42e.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\defs\24042599\avast.local_vc142.crt\api-ms-win-crt-heap-l1-1-0.dll	engsup.exe
File created	C:\Program Files\Avast Software\Avast\asw6f0c3c5c95245057.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24042599\aswCmnBS.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\instup_arm64_ais-*.vpx	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswntsqlite.dll	instup.exe
File created	C:\Program Files\Avast Software\Avast\Licenses\aswfb34ffc4c7d9035b.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\api-ms-win-core-heap-l1-1-0.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-crt-conio-l1-1-0.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-crt-locale-l1-1-0.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswavdetection.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\ais_cmp_cleanup_x64-7e8.vpx	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\aswProperty.dll	instup.exe

Drops file in Windows directory 6 IoCs

Processes:

SetupInf.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.app.log	SetupInf.exe
File created	C:\Windows\INF\oem2.PNF	SetupInf.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	SetupInf.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

tjidejd3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tjidejd
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tjidejd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tjidejd

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

SetupInf.exeRegSvr.exeengsup.exeSetupInf.exeSetupInf.exeavBugReport.exeSetupInf.exeSetupInf.exeSetupInf.exeAvEmUpdate.exeinstup.exeinstup.exeengsup.exeavast_free_antivirus_setup_online_x64.exewsc_proxy.exeavBugReport.exeAvEmUpdate.exeRegSvr.exeRegSvr.exeRegSvr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	avBugReport.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	avBugReport.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	avast_free_antivirus_setup_online_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	avBugReport.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	avBugReport.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	avBugReport.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	avast_free_antivirus_setup_online_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	avBugReport.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RegSvr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exeinstup.exeEXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosReleaseDate	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

Processes:

EXCEL.EXERegSvr.exeRegSvr.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80}	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80}	RegSvr.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation	RegSvr.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Validation	RegSvr.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

instup.exeinstup.exeRegSvr.exeEXCEL.EXERegSvr.exeRegSvr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "43"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswPEAntivirus.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\Inf\\x86\\aswNdisFlt.sys"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "30"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: ais_gen_streamfilter_x64"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: uiext.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: RobotoCondensed-Bold.ttf"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: libcrypto-1_1-x64.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: RegSvr.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\ais_cmp_cleanup-*.vpx"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CD2CE11F-5C26-4217-A773-914FADDA6FD9}\TypeLib	RegSvr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "55"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: burger_client.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: api-ms-win-core-util-l1-1-0.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}\InProcServer32\ = "C:\\Program Files\\Avast Software\\Avast\\x86\\ashShell.dll"	instup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Installing kernel driver: aswStm"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD2CE11F-5C26-4217-A773-914FADDA6FD9}\ProxyStubClsid32	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Launching executable file: C:\\Program Files\\Avast Software\\Avast\\wsc_proxy.exe /svc /register /ppl_svc"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "54"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "76"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: mbedTLS.txt"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avastlicfile\shell	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Starting kernel driver: aswSP"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Calling named action: AcsMergeAvastIni"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "6"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "18"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "61"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "40"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Main = "18"	instup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\AhResMai.dll"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\VersionIndependentProgID	RegSvr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "17"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "12"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: list_d.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: EULA.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: api-ms-win-core-errorhandling-l1-1-0.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32\ThreadingModel = "Both"	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Updating package: instcont_x64_ais"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "41"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: ais_cmp_cleanup_x64-7e8.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswCmnIS64.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: db_fn.sig"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Common Files\\AV\\avast! Antivirus\\upgrade.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: api-ms-win-core-processthreads-l1-1-0.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\x86\\SetupInf64.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Uninstalling kernel driver: aswVmm.cat"	instup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Main = "53"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: db_elfa.sig"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: db_evope.dat"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: db_tx.dat"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\ngiodriver_x64_ais-*.vpx"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\Programmable	RegSvr.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

SetupInf.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\06F36DDE6035DDBFF8C1DC173ABDADDCAECFA0F3	SetupInf.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\06F36DDE6035DDBFF8C1DC173ABDADDCAECFA0F3\Blob = 03000000010000001400000006f36dde6035ddbff8c1dc173abdaddcaecfa0f320000000010000006d0500003082056930820451a003020102021333000000244d59538809906ea7000100000024300d06092a864886f70d010105050030818b310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e313530330603550403132c4d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c69747920504341301e170d3136313031323230333235335a170d3138303130353230333235335a3081a0310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f5052313b3039060355040313324d6963726f736f66742057696e646f777320486172647761726520436f6d7061746962696c697479205075626c697368657230820122300d06092a864886f70d01010105000382010f003082010a0282010100cac4d414bc7af631fe3b1175be765cd234e2aa33da4353fcb884b455b60e535af666f59e1e3ecad3a58228c51beba328979a9ed1f4dd1307a0ebf18825ccb7da3c4885817fbeb1169764b0c61c6e42c8af2ed7b1cc69b762e4b37255ac9e0751027ccbdfdf40b3d8986956573c42c979c42e6f1097ffa43ea0b730ac769a39ddee95296ac6e6baf84d2829037f083aa1331240c7d932682b6af82a53656112044adc1d1e9d060a6575eca4c29289ef3f5f9bb9a59cadf49a9d707781eb586733a9c153fdaa595d290db6b7c216a151fdbd49366283ef29ce84d13b2968487fa1c6778c48c21d4df76e6ed5831a199009c418dfc91d20a1899d52ce796b987eb50203010001a38201ad308201a9301f0603551d2504183016060a2b0601040182370a030506082b06010505070303301d0603551d0e04160414d7a4c73622e223adfd86454e64b4189cffa7cda330520603551d11044b3049a4473045310d300b060355040b13044d4f5052313430320603550405132b3233303030312b36656137363033632d653362352d343164372d383537332d313034646466626463613462301f0603551d2304183016801428ccef61a47cbc3f966bf60d227f6a2b80883e2d30760603551d1f046f306d306ba069a0678665687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f43524c2f70726f64756374732f4d6963726f736f667425323057696e646f77732532304861726477617265253230436f6d7061746962696c6974792532305043412831292e63726c307a06082b06010505070101046e306c306a06082b06010505073002865e687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963726f736f667425323057696e646f77732532304861726477617265253230436f6d7061746962696c6974792532305043412831292e637274300d06092a864886f70d010105050003820101009fcff5d0683abc4c8daea4cc93841a3b037f2512114b780e6d1d0baf20ca63f15baf12e15392d0952d7ad3d6e270182085d8dd2a78af8a585f557506c975546138a087c58dcac5b9e5879a21dcaf4f026b9a97dc57c5b8a7e85f57861dedf618421b036a4b332cd12a4f6e2aba0aa1ff5249e9d93d7669d13eba761d5dddd495b86ac46eac38f724f525060c90079045e305a8ee0ccb626e4cd6722decd56f824d6e36eca2016fcbccf5479e9df7b3b123f6d1aa429d73808cf59f65b75e7f2da16f7d5c81b05430dc587c008f3fbf5afc42c99cf40b7f2ea7b27a314c22cb33eb2ebadfe904b7b6ea40f57eee80cc058229a617e31dead3909aad73885d21e7	SetupInf.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\06F36DDE6035DDBFF8C1DC173ABDADDCAECFA0F3	SetupInf.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1940 EXCEL.EXE

pid	process
1940	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37.exe

pid	process
2700	3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37.exe
2700	3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37.exe
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1196
Suspicious behavior: LoadsDriver 13 IoCs

Processes:

pid process

480
480
480
480
480
480
480
480
480
480
480
480
480
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37.exetjidejd

pid process

2700 3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37.exe
2380 tjidejd

pid	process
480
480
480
480
480
480
480
480
480
480
480
480
480

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1196
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe

Suspicious use of FindShellTrayWindow 57 IoCs

Processes:

chrome.exeinstup.exe

pid	process
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
2560	instup.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

pid	process
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

EXCEL.EXEinstup.exeinstup.exe

pid process

1940 EXCEL.EXE
1940 EXCEL.EXE
1940 EXCEL.EXE
1940 EXCEL.EXE
1196
1196
1196
1196
324 instup.exe
2560 instup.exe
2560 instup.exe

pid	process
1940	EXCEL.EXE
1940	EXCEL.EXE
1940	EXCEL.EXE
1940	EXCEL.EXE
1196
1196
1196
1196
324	instup.exe
2560	instup.exe
2560	instup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.execmd.exetaskeng.exechrome.exe

description	pid	process	target process
PID 1196 wrote to memory of 2600	1196		cmd.exe
PID 1196 wrote to memory of 2600	1196		cmd.exe
PID 1196 wrote to memory of 2600	1196		cmd.exe
PID 2600 wrote to memory of 2964	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 2964	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 2964	2600	cmd.exe	reg.exe
PID 1196 wrote to memory of 2536	1196		cmd.exe
PID 1196 wrote to memory of 2536	1196		cmd.exe
PID 1196 wrote to memory of 2536	1196		cmd.exe
PID 2536 wrote to memory of 2596	2536	cmd.exe	reg.exe
PID 2536 wrote to memory of 2596	2536	cmd.exe	reg.exe
PID 2536 wrote to memory of 2596	2536	cmd.exe	reg.exe
PID 1196 wrote to memory of 1940	1196		EXCEL.EXE
PID 1196 wrote to memory of 1940	1196		EXCEL.EXE
PID 1196 wrote to memory of 1940	1196		EXCEL.EXE
PID 1196 wrote to memory of 1940	1196		EXCEL.EXE
PID 1196 wrote to memory of 1940	1196		EXCEL.EXE
PID 1196 wrote to memory of 1940	1196		EXCEL.EXE
PID 1196 wrote to memory of 1940	1196		EXCEL.EXE
PID 1196 wrote to memory of 1940	1196		EXCEL.EXE
PID 1196 wrote to memory of 1940	1196		EXCEL.EXE
PID 1196 wrote to memory of 2216	1196		explorer.exe
PID 1196 wrote to memory of 2216	1196		explorer.exe
PID 1196 wrote to memory of 2216	1196		explorer.exe
PID 1620 wrote to memory of 2380	1620	taskeng.exe	tjidejd
PID 1620 wrote to memory of 2380	1620	taskeng.exe	tjidejd
PID 1620 wrote to memory of 2380	1620	taskeng.exe	tjidejd
PID 1620 wrote to memory of 2380	1620	taskeng.exe	tjidejd
PID 1196 wrote to memory of 2244	1196		ABEB.exe
PID 1196 wrote to memory of 2244	1196		ABEB.exe
PID 1196 wrote to memory of 2244	1196		ABEB.exe
PID 1196 wrote to memory of 2244	1196		ABEB.exe
PID 1196 wrote to memory of 2072	1196		B31C.exe
PID 1196 wrote to memory of 2072	1196		B31C.exe
PID 1196 wrote to memory of 2072	1196		B31C.exe
PID 1196 wrote to memory of 2072	1196		B31C.exe
PID 1196 wrote to memory of 2128	1196		MSASCui.exe
PID 1196 wrote to memory of 2128	1196		MSASCui.exe
PID 1196 wrote to memory of 2128	1196		MSASCui.exe
PID 1196 wrote to memory of 1292	1196		chrome.exe
PID 1196 wrote to memory of 1292	1196		chrome.exe
PID 1196 wrote to memory of 1292	1196		chrome.exe
PID 1292 wrote to memory of 692	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 692	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 692	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe
PID 1292 wrote to memory of 108	1292	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37.exe
"C:\Users\Admin\AppData\Local\Temp\3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2700

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\7A7D.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
  2⤵
  PID:2964

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\9435.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
  2⤵
  PID:2596

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1940

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2216

C:\Windows\system32\taskeng.exe
taskeng.exe {3488C42A-9FCF-4F74-83FC-C8A9618707F8} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Roaming\tjidejd
  C:\Users\Admin\AppData\Roaming\tjidejd
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:2380

C:\Users\Admin\AppData\Local\Temp\ABEB.exe
C:\Users\Admin\AppData\Local\Temp\ABEB.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:2244

C:\Users\Admin\AppData\Local\Temp\B31C.exe
C:\Users\Admin\AppData\Local\Temp\B31C.exe
1⤵
- Executes dropped EXE
PID:2072

C:\Program Files\Windows Defender\MSASCui.exe
"C:\Program Files\Windows Defender\MSASCui.exe"
1⤵
PID:2128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4b09758,0x7fef4b09768,0x7fef4b09778
  2⤵
  PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1096 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:2
  2⤵
  PID:108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:8
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2296 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2308 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1400 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:2
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3188 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3408 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:8
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3564 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3564 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:1912
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x140017688,0x140017698,0x1400176a8
    3⤵
    PID:384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3748 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2432 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3736 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:8
  2⤵
  PID:108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4436 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4404 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4544 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2508 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4184 --field-trial-handle=1384,i,12078757968574317264,2151603456709104112,131072 /prefetch:8
  2⤵
  PID:2424
- C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe
  "C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  PID:2644
- - C:\Windows\Temp\asw.7ad24f177e8b6f7a\avast_free_antivirus_setup_online_x64.exe
    "C:\Windows\Temp\asw.7ad24f177e8b6f7a\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_ava_012_999_i8d_m /ga_clientid:1d66945d-129a-49cb-82de-1610ec8adaf2 /edat_dir:C:\Windows\Temp\asw.7ad24f177e8b6f7a
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Checks processor information in registry
    PID:2832
  - - C:\Windows\Temp\asw.b2906e963f2b23f2\instup.exe
      "C:\Windows\Temp\asw.b2906e963f2b23f2\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.b2906e963f2b23f2 /edition:1 /prod:ais /stub_context:d8abe7a8-b31a-4a1f-9963-67ca5b7eb67b:9938128 /guid:28fa0c39-1d29-40df-a009-b794805b45df /ga_clientid:1d66945d-129a-49cb-82de-1610ec8adaf2 /cookie:mmm_ava_012_999_i8d_m /ga_clientid:1d66945d-129a-49cb-82de-1610ec8adaf2 /edat_dir:C:\Windows\Temp\asw.7ad24f177e8b6f7a
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks for any installed AV software in registry
      Writes to the Master Boot Record (MBR)
      Checks processor information in registry
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:324
    - - C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\instup.exe
        
        "C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.b2906e963f2b23f2 /edition:1 /prod:ais /stub_context:d8abe7a8-b31a-4a1f-9963-67ca5b7eb67b:9938128 /guid:28fa0c39-1d29-40df-a009-b794805b45df /ga_clientid:1d66945d-129a-49cb-82de-1610ec8adaf2 /cookie:mmm_ava_012_999_i8d_m /edat_dir:C:\Windows\Temp\asw.7ad24f177e8b6f7a /online_installer
        5⤵
        Drops file in Drivers directory
        Sets service image path in registry
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Adds Run key to start application
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:2560
      - C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\aswOfferTool.exe" -checkGToolbar -elevated
        6⤵
        Executes dropped EXE
        
        PID:2720
      - C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\aswOfferTool.exe" /check_secure_browser
        6⤵
        Executes dropped EXE
        
        PID:2812
      - C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\aswOfferTool.exe" -checkChrome -elevated
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2368
      - C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFA
        6⤵
        Executes dropped EXE
        
        PID:860
        
        C:\Users\Public\Documents\aswOfferTool.exe
        
        "C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFA
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2916
      - C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFA
        6⤵
        Executes dropped EXE
        
        PID:768
        
        C:\Users\Public\Documents\aswOfferTool.exe
        
        "C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFA
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2632
      - C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\aswOfferTool.exe" -checkChrome -elevated
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1364
      - C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\sbr.exe
        
        "C:\Windows\Temp\asw.b2906e963f2b23f2\New_15020997\sbr.exe" 2560 "Avast Antivirus setup" "Avast Antivirus is being installed. Do not shut down your computer!"
        6⤵
        Executes dropped EXE
        
        PID:2720
      - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRdr2.cat
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        
        PID:3964
      - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswHwid.cat
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        
        PID:4004
      - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswVmm.cat
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        
        PID:4048
      - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRvrt.cat
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        
        PID:4064
      - C:\Program Files\Avast Software\Avast\AvEmUpdate.exe
        
        "C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer /reg
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Checks processor information in registry
        
        PID:1564
      - C:\Program Files\Avast Software\Avast\AvEmUpdate.exe
        
        "C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer1
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Drops file in Program Files directory
        Checks processor information in registry
        
        PID:488
        
        C:\Program Files\Avast Software\Avast\avBugReport.exe
        
        "C:\Program Files\Avast Software\Avast\avBugReport.exe" --send "dumps|report" --silent --path "C:\ProgramData\Avast Software\Avast" --guid 28fa0c39-1d29-40df-a009-b794805b45df
        7⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5616
        
        C:\Program Files\Avast Software\Avast\avBugReport.exe
        
        "C:\Program Files\Avast Software\Avast\avBugReport.exe" --send dumps|report --silent --keep --contentfilter "chrome-extension://gomekmidlodglbbmalcneegieacbdmki" --product 46 --programpath "C:\Program Files\Avast Software\Avast" --logpath "C:\ProgramData\Avast Software\Avast\log" --path "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports" --guid 28fa0c39-1d29-40df-a009-b794805b45df
        7⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        
        PID:5632
      - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /netservice:aswNetNd6 /catalog:aswNetNd6.cat
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        
        PID:5864
      - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /install /netservice:aswNetNd6 /catalog:aswNetNd6.cat "C:\Program Files\Avast Software\Avast\setup\Inf\aswNetNd6.inf"
        6⤵
        Drops file in Drivers directory
        Manipulates Digital Signatures
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Drops file in Windows directory
        Checks processor information in registry
        Modifies system certificate store
        
        PID:5820
      - C:\Program Files\Avast Software\Avast\x86\RegSvr.exe
        
        "C:\Program Files\Avast Software\Avast\x86\RegSvr.exe" "C:\Program Files\Avast Software\Avast\x86\aswAMSI.dll"
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Modifies Internet Explorer settings
        Modifies registry class
        
        PID:6140
      - C:\Program Files\Avast Software\Avast\RegSvr.exe
        
        "C:\Program Files\Avast Software\Avast\RegSvr.exe" "C:\Program Files\Avast Software\Avast\aswAMSI.dll"
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Modifies Internet Explorer settings
        
        PID:6184
      - C:\Program Files\Avast Software\Avast\x86\RegSvr.exe
        
        "C:\Program Files\Avast Software\Avast\x86\RegSvr.exe" "C:\Program Files\Avast Software\Avast\x86\asOutExt.dll"
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Modifies registry class
        
        PID:6404
      - C:\Program Files\Avast Software\Avast\RegSvr.exe
        
        "C:\Program Files\Avast Software\Avast\RegSvr.exe" "C:\Program Files\Avast Software\Avast\asOutExt.dll"
        6⤵
        Executes dropped EXE
        Registers COM server for autorun
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Modifies registry class
        
        PID:6440
      - C:\Program Files\Avast Software\Avast\AvastNM.exe
        
        "C:\Program Files\Avast Software\Avast\AvastNM.exe" /install
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        
        PID:6284
      - C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe
        
        "C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe" /skip_uptime /skip_remediations
        6⤵
        Executes dropped EXE
        
        PID:6300
      - C:\Program Files\Avast Software\Avast\defs\24042599\engsup.exe
        
        "C:\Program Files\Avast Software\Avast\defs\24042599\engsup.exe" /prepare_definitions_folder
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Drops file in Program Files directory
        Checks processor information in registry
        
        PID:6316
      - C:\Program Files\Avast Software\Avast\wsc_proxy.exe
        
        "C:\Program Files\Avast Software\Avast\wsc_proxy.exe" /svc /register /ppl_svc
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        
        PID:6748
      - C:\Program Files\Avast Software\Avast\defs\24042599\engsup.exe
        
        "C:\Program Files\Avast Software\Avast\defs\24042599\engsup.exe" /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Drops file in Program Files directory
        Checks processor information in registry
        
        PID:6796

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2648

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7b8e8248-f8d8-147e-0d13-6959b1952b1d}\aswNetNd6.inf" "9" "6128e1ea7" "00000000000003A4" "WinSta0\Default" "00000000000005AC" "208" "C:\Program Files\Avast Software\Avast\setup\Inf"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:5880

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:3544

C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe
"C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe"
1⤵
PID:3756
- C:\Windows\Temp\asw.d69d3712c1ce290e\avast_free_antivirus_setup_online_x64.exe
  "C:\Windows\Temp\asw.d69d3712c1ce290e\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_ava_012_999_i8d_m /ga_clientid:bf761388-06b1-40fb-af16-036ecf94d155 /edat_dir:C:\Windows\Temp\asw.d69d3712c1ce290e
  2⤵
  PID:4152
- - C:\Program Files\Avast Software\Avast\setup\instup.exe
    "C:\Program Files\Avast Software\Avast\setup\instup.exe" /copy_sfx:C:\Windows\Temp\asw.002f65afed149071\instup.exe /wait
    3⤵
    PID:4188
- - C:\Program Files\Avast Software\Avast\setup\instup.exe
    "C:\Program Files\Avast Software\Avast\setup\instup.exe" /copy_sfx:C:\Windows\Temp\asw.002f65afed149071\Instup.dll /wait
    3⤵
    PID:4540
- - C:\Program Files\Avast Software\Avast\setup\Sfx\instup.exe
    "C:\Program Files\Avast Software\Avast\setup\Sfx\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.002f65afed149071 /edition:1 /prod:ais /stub_context:fbe66aec-0ede-49aa-986e-1aa4d79043f3:9938128 /ga_clientid:bf761388-06b1-40fb-af16-036ecf94d155 /cookie:mmm_ava_012_999_i8d_m /ga_clientid:bf761388-06b1-40fb-af16-036ecf94d155 /edat_dir:C:\Windows\Temp\asw.d69d3712c1ce290e
    3⤵
    PID:1240
  - - C:\Program Files\Avast Software\Avast\setup\Sfx\New_15020997\instup.exe
      "C:\Program Files\Avast Software\Avast\setup\Sfx\New_15020997\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.002f65afed149071 /edition:1 /prod:ais /stub_context:fbe66aec-0ede-49aa-986e-1aa4d79043f3:9938128 /ga_clientid:bf761388-06b1-40fb-af16-036ecf94d155 /cookie:mmm_ava_012_999_i8d_m /edat_dir:C:\Windows\Temp\asw.d69d3712c1ce290e /online_installer
      4⤵
      PID:5256
    - - C:\Program Files\Avast Software\Avast\setup\Sfx\New_15020997\sbr.exe
        
        "C:\Program Files\Avast Software\Avast\setup\Sfx\New_15020997\sbr.exe" 5256 "Avast Antivirus setup" "Avast Antivirus is being installed. Do not shut down your computer!"
        5⤵
        
        PID:5560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery