chaos | aaf3cf701b06ca873f9fdbf5b4ba33722c6ecea49316a344df35926a45bce1fb

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswNetHub\ImagePath = "system32\\drivers\\aswNetHub.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswRdr\ImagePath = "system32\\drivers\\aswRdr2.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswMonFlt\ImagePath = "system32\\drivers\\aswMonFlt.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswStm\ImagePath = "system32\\drivers\\aswStm.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswArPot\ImagePath = "system32\\drivers\\aswArPot.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswKbd\ImagePath = "system32\\drivers\\aswKbd.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswbuniv\ImagePath = "system32\\drivers\\aswbuniv.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswbidsdriver\ImagePath = "system32\\drivers\\aswbidsdriver.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswSnx\ImagePath = "system32\\drivers\\aswSnx.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswElam\ImagePath = "system32\\drivers\\aswElam.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswRvrt\ImagePath = "system32\\drivers\\aswRvrt.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswbidsh\ImagePath = "system32\\drivers\\aswbidsh.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswArDisk\ImagePath = "system32\\drivers\\aswArDisk.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswSP\ImagePath = "system32\\drivers\\aswSP.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswVmm\ImagePath = "system32\\drivers\\aswVmm.sys"	instup.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	AvastUI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	AvastUI.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 43 IoCs

pid	Process
2220	avast_free_antivirus_setup_beta.exe
3712	avast_free_antivirus_setup_online_x64.exe
3404	instup.exe
2356	instup.exe
1644	aswOfferTool.exe
2348	aswOfferTool.exe
1044	aswOfferTool.exe
1376	aswOfferTool.exe
2452	aswOfferTool.exe
1512	sbr.exe
12696	SetupInf.exe
12836	SetupInf.exe
12876	SetupInf.exe
12908	SetupInf.exe
12940	SetupInf.exe
12972	SetupInf.exe
13004	SetupInf.exe
13052	AvEmUpdate.exe
13180	AvEmUpdate.exe
8020	RegSvr.exe
8060	RegSvr.exe
8128	AvastNM.exe
8168	SetupInf.exe
1984	overseer.exe
4580	engsup.exe
8440	AvDump.exe
8788	AvDump.exe
9988	wsc_proxy.exe
4272	avDump.exe
11276	afwServ.exe
9792	afwServ.exe
9952	afwServ.exe
10136	engsup.exe
9372	AvastUI.exe
8704	afwServ.exe
11928	AvastUI.exe
12220	AvastUI.exe
10216	AvastUI.exe
5076	AvastUI.exe
5204	AvastUI.exe
6288	VisthAux.exe
6296	VisthAux.exe
3396	EmsisoftEmergencyKit.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\aswSP.sys	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\aswSP.sys\ = "Driver"	instup.exe

Loads dropped DLL 64 IoCs

pid	Process
2220	avast_free_antivirus_setup_beta.exe
3404	instup.exe
3404	instup.exe
3404	instup.exe
3404	instup.exe
2356	instup.exe
2356	instup.exe
2356	instup.exe
2356	instup.exe
1376	aswOfferTool.exe
2452	aswOfferTool.exe
13180	AvEmUpdate.exe
13180	AvEmUpdate.exe
13180	AvEmUpdate.exe
13180	AvEmUpdate.exe
8020	RegSvr.exe
8060	RegSvr.exe
4580	engsup.exe
4580	engsup.exe
4580	engsup.exe
4580	engsup.exe
4580	engsup.exe
4580	engsup.exe
4580	engsup.exe
4580	engsup.exe
2064	Process not Found
2356	instup.exe
9988	wsc_proxy.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
11276	afwServ.exe
9792	afwServ.exe
9792	afwServ.exe
9792	afwServ.exe
9792	afwServ.exe
9792	afwServ.exe
9792	afwServ.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SECURITY CENTER\PROVIDER\AV\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}	instup.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

defense_evasion privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AvRepair = "\"C:\\Program Files\\Avast Software\\Avast\\setup\\instup.exe\" /instop:repair /wait"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AvastUI.exe = "\"C:\\Program Files\\Avast Software\\Avast\\AvLaunch.exe\" /gui"	instup.exe

Checks for any installed AV software in registry 1 TTPs 64 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\IDP	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CrashGuardProcessWatcherExclusions	SetupInf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{93876F24-B4F5-4DBC-97B9-762CD8066719}\TaskSensitivity = "80"	afwServ.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings	afwServ.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\CPLLast	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Scanner\Task1	AvastUI.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages	AvastUI.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	AvEmUpdate.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{FDC844BC-62CE-4A58-A28B-77AA70274062}	AvastUI.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\SelfDefense	wsc_proxy.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Scanner	AvastUI.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Perfstats	AvastUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog = "C:\\ProgramData\\Avast Software\\Persistent Data\\Avast\\Logs\\Setup.log"	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder	engsup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Version	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ChestFolder	AvastUI.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{93876F24-B4F5-4DBC-97B9-762CD8066719}	AvastUI.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{D93EF81A-B92F-27FE-AF54-9278EA8BF910}	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\MovedFolder	afwServ.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\BadFwDb	afwServ.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings	AvEmUpdate.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\SelfDefense	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{93876F24-B4F5-4DBC-97B9-762CD8066719}\SpecialTask = "1"	afwServ.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{7C4966F0-D502-412D-A636-ACCC39A24BB2}	afwServ.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{CB6AE6F8-D9A8-4794-B2BF-53A84058C58F}	afwServ.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{CB6AE6F8-D9A8-4794-B2BF-53A84058C58F}	afwServ.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CertificateFile	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\LogMaxSize	afwServ.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog	SetupInf.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common	SetupInf.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast\properties\settings\Scanner	afwServ.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\UiStats	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\ignore_fsshield_off	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CrashGuardProcessWatcherExclusions	AvEmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{2243A056-84B3-4327-8E46-5FE41F72EE91}\ScanAreas	afwServ.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages	AvastUI.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{2243A056-84B3-4327-8E46-5FE41F72EE91}	afwServ.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{A9682249-08E7-4BBF-B870-EFBC63AA2888}	AvastUI.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\AutosandboxNotify_SkipScan	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SZBProgramFolder	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Version	afwServ.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\FwDataFolder	AvEmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{CC13CA7D-229B-4D0A-8D27-E26129CDDF10}\ConsultUsn = "0"	afwServ.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{CC13CA7D-229B-4D0A-8D27-E26129CDDF10}	afwServ.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Scanner	AvastUI.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{2243A056-84B3-4327-8E46-5FE41F72EE91}	AvastUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\IDP	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Platform = "x64"	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{D93EF81A-B92F-27FE-AF54-9278EA8BF910}	afwServ.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\AlphaMigrationFlag	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\JournalFolder	AvastUI.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\semo	AvastUI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\UpdateVersion = "528"	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CrashGuardProcessWatcherExclusions	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode\DisabledProviders = "FileSystemShield,EmailShield,WebShield,AntiSpamShield,BehaviorShield,AntiRansomwareShield,SecureDnsShield,RemoteAccessShield,Sandbox,Firewall,SensitiveDataShield"	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast\properties\settings	SetupInf.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{93876F24-B4F5-4DBC-97B9-762CD8066719}	afwServ.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{CB6AE6F8-D9A8-4794-B2BF-53A84058C58F}	AvastUI.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 27 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	AvastUI.exe
File opened for modification	\??\PhysicalDrive0	AvastUI.exe
File opened for modification	\??\PhysicalDrive0	avast_free_antivirus_setup_online_x64.exe
File opened for modification	\??\PhysicalDrive0	overseer.exe
File opened for modification	\??\PhysicalDrive0	afwServ.exe
File opened for modification	\??\PhysicalDrive0	afwServ.exe
File opened for modification	\??\PhysicalDrive0	AvastUI.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	AvastUI.exe
File opened for modification	\??\PhysicalDrive0	avast_free_antivirus_setup_beta.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	AvEmUpdate.exe
File opened for modification	\??\PhysicalDrive0	AvastUI.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	afwServ.exe
File opened for modification	\??\PhysicalDrive0	afwServ.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	wsc_proxy.exe
File opened for modification	\??\PhysicalDrive0	AvastUI.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\asw71e02d68e982b48f.tmp	instup.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	SetupInf.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File opened for modification	C:\Windows\system32\asw71e02d68e982b48f.tmp	instup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\aswcf1ab695fbbe7e74.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-core-console-l1-1-0.dll.sum	instup.exe
File created	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw18d8afe739c67123.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\defs\24082902\avast.local_vc142.crt\vcruntime140.dll	engsup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw49c1dc6361556202.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\Setup\015d0a67-4f01-48e4-8796-d04a8e527019.ini	AvEmUpdate.exe
File created	C:\Program Files\Avast Software\Avast\setup\usn_cache.tsv.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\avdump_x64_ais-a49.vpx	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x64\asw42dee76f9a2675f7.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24082902\aswCmnBS.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24082902\aswCmnOS.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw981db76bcc41cf43.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw0322a2ce941a6511.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\x86\asw3c9725b34b6f1760.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\asw197a5de1222eed02.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24082902\aswRawFS64.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswbidsh.sys	instup.exe
File created	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw907218e3909e9326.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\ais_cmp_fw_x64-985.vpx	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\aswf916fd8eacdc30a5.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswRvrt.sys	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\gui_resources\default_av\libs.js.sum	instup.exe
File created	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw3054e510f1566994.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\Licenses\asw614bc89cd6d0a88c.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\Licenses\aswcd3429f3c69214d1.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24082902\db_swf.nmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\d3dcompiler_47.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\Licenses\libPNG.txt	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswremoval.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\locales\fr.pak	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\RescueDisk\waikamd64.mst	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-crt-runtime-l1-1-0.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\gui_resources\default_av\update.js.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24082902\asw75ed0b6ad47bea99.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\gui_resources\default_av\aswab22b97546a6f7bb.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24082902\db_dyna.nmp.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24082902\db_o7.nmp.sum	instup.exe
File created	C:\Program Files\Avast Software\Avast\Licenses\asw8eb8f5b47c51cfce.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24082902\engsup.exe	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswSP.sys.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw671b04a3671d61f1.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\gui_resources\default_av\asw62b47235e6e3e32c.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24082902\db_pe3.dat	instup.exe
File created	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\asw53fcdaa58f4a4959.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24082902\db_o7c.map.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Proxy.ini	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\Setup\f7188ab6-0b2a-401c-85ef-9369df0d7685	AvEmUpdate.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswidsagent.exe.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswArDisk.sys.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\asw7901f29ef4bf0fc6.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\locales\asw4c95099d8fca9230.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\afwCoreClient.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\gaming_hook.exe.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\locales\el.pak	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\gui_resources\default_av\locale-fa.json	instup.exe
File created	C:\Program Files\Avast Software\Avast\defs\24082902\avast.local_vc142.crt\api-ms-win-core-synch-l1-2-0.dll	engsup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswf4965b28be2b8cea.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\gui_resources\default_av\aswfbd1e1f60b23ad14.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\mfc140u.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\aswRunDll.exe	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-crt-heap-l1-1-0.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\asw25eaa78e2d50ffde.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\asw431b818e0230ef1a.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\ashShell.dll.sum	instup.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ELAMBKUP\asw099bf1d07107c5cf.tmp	instup.exe
File created	C:\Windows\ELAMBKUP\asw099bf1d07107c5cf.tmp	instup.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

Create Process with Token

T1134.002

pid	Process
8788	AvDump.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 6 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000700000002354e-742.dat	embeds_openssl
behavioral2/files/0x0007000000023589-1488.dat	embeds_openssl
behavioral2/files/0x00070000000235aa-1594.dat	embeds_openssl
behavioral2/files/0x0007000000023585-2542.dat	embeds_openssl
behavioral2/files/0x000700000002357d-4641.dat	embeds_openssl
behavioral2/files/0x0007000000023751-4649.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aswOfferTool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EmsisoftEmergencyKit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avast_free_antivirus_setup_beta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aswOfferTool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aswOfferTool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aswOfferTool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aswOfferTool.exe

Checks SCSI registry key(s) 3 TTPs 16 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	AvastUI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	AvastUI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	AvastUI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	AvastUI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	AvastUI.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	avast_free_antivirus_setup_online_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvDump.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	avast_free_antivirus_setup_online_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvastUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvastUI.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	afwServ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	afwServ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	afwServ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvastNM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	AvastNM.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvastUI.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvastUI.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	afwServ.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	afwServ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvastUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	engsup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvastUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	afwServ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosReleaseDate	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80}	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80}	RegSvr.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133694307491158367"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Registering file: C:\\Program Files\\Avast Software\\Avast\\x86\\aswAMSI.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\ = "Avast IExtensionValidation implementation"	RegSvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\SfxInstProgress = "50"	avast_free_antivirus_setup_online_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "25"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: api-ms-win-core-profile-l1-1-0.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: jsbridge.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Avast Omni.lnk"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Main = "81"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Uninstalling kernel driver: aswlog"	instup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	tmk.scr
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: wsc_proxy.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswSqLt.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswClnTg.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Avast One Free.lnk"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Creating directory: C:\\ProgramData\\Avast Software\\Avast\\log"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: firefox_pass.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: AvDump.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: locale-th.json"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "75"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: instup.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Checking install conditions"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "78"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "27"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: db_elfa.sig"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Uninstalling kernel driver: aswNdis"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Inserting license file"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Main = "51"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Windows\\system32\\drivers\\aswbdiskx.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: RobotoCondensed-Regular.ttf"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\Inf\\x64\\aswbidsha.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File extracted: prod-pgm.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswJsFlt64.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Creating directory: C:\\Recovery\\AutoApply\\CustomizationFiles"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\RescueDisk\\Base.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Avast Premium.lnk"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Main = "36"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: yara.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: config.xml"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: libssl-3-x64.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\ProgramData\\Avast Software\\Avast\\log\\*.log.3"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\x86\\aswRegSvr64.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: prod-pgm.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: db_str.nmp"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: templates.xml"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: SupportTool.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\AvastNet.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\ais_cmp_secdns-*.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: part-jrog2-15f6.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: BCUEngine.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswidpm.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\vps_bootwin64-*.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: am.pak"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswStm.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: config.ini"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: dnd_helper.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "6"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "61"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Users\\Public\\Desktop\\Avast One Essential.lnk"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Uninstalling kernel driver: aswNdis2"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\instup_ais-*.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\avastconfigfile\EditFlags = "65536"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: instup.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Main = "39"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}\InProcServer32\ReleaseName = "C:\\Program Files\\Avast Software\\Avast\\ashShell.dll"	instup.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
1352	tmk.scr
2444	chrome.exe
2444	chrome.exe
3712	avast_free_antivirus_setup_online_x64.exe
3712	avast_free_antivirus_setup_online_x64.exe
3712	avast_free_antivirus_setup_online_x64.exe
3712	avast_free_antivirus_setup_online_x64.exe
2356	instup.exe
2356	instup.exe
2356	instup.exe
2356	instup.exe
2356	instup.exe
2356	instup.exe
2356	instup.exe
2356	instup.exe
4272	avDump.exe
4272	avDump.exe
2356	instup.exe
2356	instup.exe
12220	AvastUI.exe
12220	AvastUI.exe
10216	AvastUI.exe
10216	AvastUI.exe
5204	AvastUI.exe
5204	AvastUI.exe
5076	AvastUI.exe
5076	AvastUI.exe
6560	chrome.exe
6560	chrome.exe
9372	AvastUI.exe
9372	AvastUI.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1352	tmk.scr
9372	AvastUI.exe

Suspicious behavior: LoadsDriver 23 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe
6560	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1352	tmk.scr
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2356	instup.exe
2356	instup.exe
2356	instup.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2356	instup.exe
2356	instup.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe
9372	AvastUI.exe

Suspicious use of SetWindowsHookEx 41 IoCs

pid	Process
2220	avast_free_antivirus_setup_beta.exe
3712	avast_free_antivirus_setup_online_x64.exe
3404	instup.exe
3404	instup.exe
2356	instup.exe
2356	instup.exe
1644	aswOfferTool.exe
2348	aswOfferTool.exe
1044	aswOfferTool.exe
2452	aswOfferTool.exe
2356	instup.exe
2356	instup.exe
1512	sbr.exe
1352	tmk.scr
12696	SetupInf.exe
12836	SetupInf.exe
12876	SetupInf.exe
12908	SetupInf.exe
12940	SetupInf.exe
12972	SetupInf.exe
13004	SetupInf.exe
13052	AvEmUpdate.exe
13180	AvEmUpdate.exe
8020	RegSvr.exe
8060	RegSvr.exe
8128	AvastNM.exe
8168	SetupInf.exe
4580	engsup.exe
1984	overseer.exe
8440	AvDump.exe
4272	avDump.exe
10136	engsup.exe
1352	tmk.scr
9372	AvastUI.exe
11928	AvastUI.exe
12220	AvastUI.exe
5204	AvastUI.exe
10216	AvastUI.exe
5076	AvastUI.exe
3396	EmsisoftEmergencyKit.exe
3396	EmsisoftEmergencyKit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 4352	2444	chrome.exe	101
PID 2444 wrote to memory of 4352	2444	chrome.exe	101
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 4000	2444	chrome.exe	102
PID 2444 wrote to memory of 3500	2444	chrome.exe	103
PID 2444 wrote to memory of 3500	2444	chrome.exe	103
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104
PID 2444 wrote to memory of 4556	2444	chrome.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmk.scr
"C:\Users\Admin\AppData\Local\Temp\tmk.scr" /S
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1352
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tsmciq04\tsmciq04.cmdline"
  2⤵
  PID:8528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8255ecc40,0x7ff8255ecc4c,0x7ff8255ecc58
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1888,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2296,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3232,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3728,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4712,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4744,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:4836
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff62eba4698,0x7ff62eba46a4,0x7ff62eba46b0
    3⤵
    PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5076,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4680,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4888,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5224,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3876,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5660,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5812,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5244,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5116,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5108,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=4500,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4920,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5928,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5992,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6120,i,12798013066570416292,5195521296921943057,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:3332

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1212

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3ec 0x2cc
1⤵
PID:1972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:760

C:\Users\Admin\Downloads\avast_free_antivirus_setup_beta.exe
"C:\Users\Admin\Downloads\avast_free_antivirus_setup_beta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2220
- C:\Windows\Temp\asw.0afe59c6040c1f36\avast_free_antivirus_setup_online_x64.exe
  "C:\Windows\Temp\asw.0afe59c6040c1f36\avast_free_antivirus_setup_online_x64.exe" /ga_clientid:958670ff-9cee-4138-92f6-bd33d3537c1e /edat_dir:C:\Windows\Temp\asw.0afe59c6040c1f36
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3712
- - C:\Windows\Temp\asw.976ef4702e0ad6f1\instup.exe
    "C:\Windows\Temp\asw.976ef4702e0ad6f1\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.976ef4702e0ad6f1 /edition:1 /prod:ais /stub_context:fbbc2a2d-a5cd-423a-8f03-b22aa13ebafa:11056808 /guid:c5869dc4-a517-4b9c-8dce-27b7f68ddac7 /ga_clientid:958670ff-9cee-4138-92f6-bd33d3537c1e /no_delayed_installation /ga_clientid:958670ff-9cee-4138-92f6-bd33d3537c1e /edat_dir:C:\Windows\Temp\asw.0afe59c6040c1f36
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks for any installed AV software in registry
    - Writes to the Master Boot Record (MBR)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:3404
  - - C:\Windows\Temp\asw.976ef4702e0ad6f1\New_180917f0\instup.exe
      "C:\Windows\Temp\asw.976ef4702e0ad6f1\New_180917f0\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.976ef4702e0ad6f1 /edition:1 /prod:ais /stub_context:fbbc2a2d-a5cd-423a-8f03-b22aa13ebafa:11056808 /guid:c5869dc4-a517-4b9c-8dce-27b7f68ddac7 /ga_clientid:958670ff-9cee-4138-92f6-bd33d3537c1e /no_delayed_installation /edat_dir:C:\Windows\Temp\asw.0afe59c6040c1f36 /online_installer
      4⤵
      Drops file in Drivers directory
      Sets service image path in registry
      Executes dropped EXE
      Impair Defenses: Safe Mode Boot
      Loads dropped DLL
      Windows security modification
      Adds Run key to start application
      Checks for any installed AV software in registry
      Writes to the Master Boot Record (MBR)
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Checks SCSI registry key(s)
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:2356
    - - C:\Windows\Temp\asw.976ef4702e0ad6f1\New_180917f0\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.976ef4702e0ad6f1\New_180917f0\aswOfferTool.exe" -checkGToolbar -elevated
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1644
    - - C:\Windows\Temp\asw.976ef4702e0ad6f1\New_180917f0\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.976ef4702e0ad6f1\New_180917f0\aswOfferTool.exe" /check_secure_browser
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2348
    - - C:\Windows\Temp\asw.976ef4702e0ad6f1\New_180917f0\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.976ef4702e0ad6f1\New_180917f0\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFC
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1044
      - C:\Users\Public\Documents\aswOfferTool.exe
        
        "C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFC
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1376
    - - C:\Windows\Temp\asw.976ef4702e0ad6f1\New_180917f0\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.976ef4702e0ad6f1\New_180917f0\aswOfferTool.exe" -checkChrome -elevated
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2452
    - - C:\Windows\Temp\asw.976ef4702e0ad6f1\New_180917f0\sbr.exe
        
        "C:\Windows\Temp\asw.976ef4702e0ad6f1\New_180917f0\sbr.exe" 2356 "Avast Antivirus setup" "Avast Antivirus is being installed. Do not shut down your computer!"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
    - - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /netservice:sw_aswNdis
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:12696
    - - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /netservice:aswNdisFlt /catalog:aswNdisFlt.cat
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:12836
    - - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRdr2.cat
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:12876
    - - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswHwid.cat
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:12908
    - - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswVmm.cat
        5⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:12940
    - - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRvrt.cat
        5⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:12972
    - - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /elaminst C:\Windows\system32\drivers\aswElam.sys
        5⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Suspicious use of SetWindowsHookEx
        
        PID:13004
    - - C:\Program Files\Avast Software\Avast\AvEmUpdate.exe
        
        "C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer /reg
        5⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:13052
    - - C:\Program Files\Avast Software\Avast\AvEmUpdate.exe
        
        "C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Drops file in Program Files directory
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:13180
    - - C:\Program Files\Avast Software\Avast\x86\RegSvr.exe
        
        "C:\Program Files\Avast Software\Avast\x86\RegSvr.exe" "C:\Program Files\Avast Software\Avast\x86\aswAMSI.dll"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:8020
    - - C:\Program Files\Avast Software\Avast\RegSvr.exe
        
        "C:\Program Files\Avast Software\Avast\RegSvr.exe" "C:\Program Files\Avast Software\Avast\aswAMSI.dll"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:8060
    - - C:\Program Files\Avast Software\Avast\AvastNM.exe
        
        "C:\Program Files\Avast Software\Avast\AvastNM.exe" /install
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:8128
    - - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /catinstall:"C:\Program Files\Avast Software\Avast\setup\crts.cat" /basename:pkg_{af98c830-4f53-4176-a7b0-ec21fc603adc}.cat /crtid:D9D1E63123760F5EE0F69B6613E0933E9CBCAB11
        5⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:8168
    - - C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe
        
        "C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe" /skip_uptime /skip_remediations
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Suspicious use of SetWindowsHookEx
        
        PID:1984
    - - C:\Program Files\Avast Software\Avast\defs\24082902\engsup.exe
        
        "C:\Program Files\Avast Software\Avast\defs\24082902\engsup.exe" /prepare_definitions_folder
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:4580
    - - C:\Program Files\Avast Software\Avast\AvDump.exe
        
        "C:\Program Files\Avast Software\Avast\AvDump.exe" /register
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:8440
    - - C:\Program Files\Avast Software\Avast\wsc_proxy.exe
        
        "C:\Program Files\Avast Software\Avast\wsc_proxy.exe" /svc /register /ppl_svc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        
        PID:9988
      - C:\Program Files\Avast Software\Avast\avDump.exe
        
        "C:\Program Files\Avast Software\Avast\avDump.exe" --pid 9988 --exception_ptr 00000063EF0FE6C0 --thread_id 10060 --dump_level 21 --dump_file "C:\ProgramData\Avast Software\Avast\log\unp311281321046367359i-manual.mdmp" --comment "Cause: VectoredExceptionHandler Reason: sd is not loaded Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of exception instantiation." --min_interval 60
        6⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4272
    - - C:\Program Files\Avast Software\Avast\defs\24082902\engsup.exe
        
        "C:\Program Files\Avast Software\Avast\defs\24082902\engsup.exe" /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie /get_latest_trpar
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:10136

C:\Program Files\Avast Software\Avast\AvDump.exe
"C:\Program Files\Avast Software\Avast\AvDump.exe" /runassvc
1⤵
- Executes dropped EXE
- Access Token Manipulation: Create Process with Token
- Checks processor information in registry
PID:8788

C:\Program Files\Avast Software\Avast\afwServ.exe
"C:\Program Files\Avast Software\Avast\afwServ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:11276

C:\Program Files\Avast Software\Avast\afwServ.exe
"C:\Program Files\Avast Software\Avast\afwServ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:9792

C:\Program Files\Avast Software\Avast\afwServ.exe
"C:\Program Files\Avast Software\Avast\afwServ.exe"
1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:9952

C:\Program Files\Avast Software\Avast\AvastUI.exe
"C:\Program Files\Avast Software\Avast\AvastUI.exe" /welcome
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:9372
- C:\Program Files\Avast Software\Avast\AvastUI.exe
  "C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=gpu-process --field-trial-handle=9280,12868291111343716727,4865442116546830001,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --no-sandbox --disable-gpu-driver-bug-workarounds --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --gpu-preferences=SAAAAAAAAADgAABwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=9292 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  - Writes to the Master Boot Record (MBR)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:12220
- C:\Program Files\Avast Software\Avast\AvastUI.exe
  "C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=9280,12868291111343716727,4865442116546830001,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=utility --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=1300 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  - Writes to the Master Boot Record (MBR)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:10216
- C:\Program Files\Avast Software\Avast\AvastUI.exe
  "C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=9280,12868291111343716727,4865442116546830001,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=none --no-sandbox --force-wave-audio --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=9524 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  - Writes to the Master Boot Record (MBR)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5076
- C:\Program Files\Avast Software\Avast\AvastUI.exe
  "C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --field-trial-handle=9280,12868291111343716727,4865442116546830001,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=9768 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5204
- C:\Program Files\Avast Software\Avast\VisthAux.exe
  "C:\Program Files\Avast Software\Avast\VisthAux.exe" /runavservice
  2⤵
  - Executes dropped EXE
  PID:6288
- C:\Program Files\Avast Software\Avast\VisthAux.exe
  "C:\Program Files\Avast Software\Avast\VisthAux.exe" /runtoolsservice
  2⤵
  - Executes dropped EXE
  PID:6296

C:\Program Files\Avast Software\Avast\afwServ.exe
"C:\Program Files\Avast Software\Avast\afwServ.exe"
1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:8704

C:\Program Files\Avast Software\Avast\AvastUI.exe
"C:\Program Files\Avast Software\Avast\AvastUI.exe"
1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:11928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:6560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8255ecc40,0x7ff8255ecc4c,0x7ff8255ecc58
  2⤵
  PID:6580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1996,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:6772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:10316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3180,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:10332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4028,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:10792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4704,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:10816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4828,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:10988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4876,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:10464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4524,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:10264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5168,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:12524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4036,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:12532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5340,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:12652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4764,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5600,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:12832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3388,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:13140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5204,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:13232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5536,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5652,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5272,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:6324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5684,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:11144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5804,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:7156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6072,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6084,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5960,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5908,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:2544
- C:\Users\Admin\Downloads\EmsisoftEmergencyKit.exe
  "C:\Users\Admin\Downloads\EmsisoftEmergencyKit.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=6060,i,11266659744751879031,7521182773337313286,262144 --variations-seed-version=20240829-050112.583000 --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5348

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:10520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:10832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery