Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
setup-avast-premium-x64.exe

Overview

General Information

Sample name:setup-avast-premium-x64.exe
Analysis ID:1585136
MD5:e099255ea4aa8eb41e26e5d94737fc26
SHA1:2c13d842e788e6c981b2fae65834b1220d55f5a8
SHA256:89b9f7499d59d0d308f5ad02cd6fddd55b368190c37f6c5413c4cfcd343eeff3
Tags:exefunklockerfunksecransomwareuser-TheRavenFile
Infos:

Detection

Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Bypasses PowerShell execution policy
Creates files in the recycle bin to hide itself
Disables Windows Defender (via service or powershell)
Loading BitLocker PowerShell Module
Modifies Windows Defender protection settings
Sigma detected: Disable of ETW Trace
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Sigma detected: Suspicious Eventlog Clear or Configuration Change
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Drops PE files
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level

Classification

Process Tree

  • System is w10x64
  • setup-avast-premium-x64.exe (PID: 5732 cmdline: "C:\Users\user\Desktop\setup-avast-premium-x64.exe" MD5: E099255EA4AA8EB41E26E5D94737FC26)
    • conhost.exe (PID: 7164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • net.exe (PID: 2656 cmdline: "net" session MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
      • net1.exe (PID: 3160 cmdline: C:\Windows\system32\net1 session MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)
    • tasklist.exe (PID: 3724 cmdline: "tasklist" /fi "IMAGENAME eq vmware" MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
    • powershell.exe (PID: 3220 cmdline: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • WmiPrvSE.exe (PID: 2952 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
    • powershell.exe (PID: 3200 cmdline: "powershell" -Command "wevtutil sl Security /e:false" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • wevtutil.exe (PID: 3876 cmdline: "C:\Windows\system32\wevtutil.exe" sl Security /e:false MD5: 1AAE26BD68B911D0420626A27070EB8D)
    • powershell.exe (PID: 1996 cmdline: "powershell" -Command "wevtutil sl Application /e:false" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • wevtutil.exe (PID: 5840 cmdline: "C:\Windows\system32\wevtutil.exe" sl Application /e:false MD5: 1AAE26BD68B911D0420626A27070EB8D)
    • powershell.exe (PID: 5700 cmdline: "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Disable of ETW Trace
Source: Process startedAuthor: @neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "powershell" -Command "wevtutil sl Security /e:false", CommandLine: "powershell" -Command "wevtutil sl Security /e:false", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\setup-avast-premium-x64.exe", ParentImage: C:\Users\user\Desktop\setup-avast-premium-x64.exe, ParentProcessId: 5732, ParentProcessName: setup-avast-premium-x64.exe, ProcessCommandLine: "powershell" -Command "wevtutil sl Security /e:false", ProcessId: 3200, ProcessName: powershell.exe
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\setup-avast-premium-x64.exe", ParentImage: C:\Users\user\Desktop\setup-avast-premium-x64.exe, ParentProcessId: 5732, ParentProcessName: setup-avast-premium-x64.exe, ProcessCommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", ProcessId: 3220, ProcessName: powershell.exe
Sigma detected: Powershell Defender Disable Scan Feature
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\setup-avast-premium-x64.exe", ParentImage: C:\Users\user\Desktop\setup-avast-premium-x64.exe, ParentProcessId: 5732, ParentProcessName: setup-avast-premium-x64.exe, ProcessCommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", ProcessId: 3220, ProcessName: powershell.exe
Sigma detected: Suspicious Eventlog Clear or Configuration Change
Source: Process startedAuthor: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105: Data: Command: "C:\Windows\system32\wevtutil.exe" sl Application /e:false, CommandLine: "C:\Windows\system32\wevtutil.exe" sl Application /e:false, CommandLine|base64offset|contains: , Image: C:\Windows\System32\wevtutil.exe, NewProcessName: C:\Windows\System32\wevtutil.exe, OriginalFileName: C:\Windows\System32\wevtutil.exe, ParentCommandLine: "powershell" -Command "wevtutil sl Application /e:false", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1996, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\wevtutil.exe" sl Application /e:false, ProcessId: 5840, ProcessName: wevtutil.exe
Sigma detected: Change PowerShell Policies to an Insecure Level
Source: Process startedAuthor: frack113: Data: Command: "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force", CommandLine: "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\setup-avast-premium-x64.exe", ParentImage: C:\Users\user\Desktop\setup-avast-premium-x64.exe, ParentProcessId: 5732, ParentProcessName: setup-avast-premium-x64.exe, ProcessCommandLine: "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force", ProcessId: 5700, ProcessName: powershell.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\setup-avast-premium-x64.exe", ParentImage: C:\Users\user\Desktop\setup-avast-premium-x64.exe, ParentProcessId: 5732, ParentProcessName: setup-avast-premium-x64.exe, ProcessCommandLine: "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true", ProcessId: 3220, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: setup-avast-premium-x64.exeVirustotal: Detection: 9%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 92.9% probability
Source: unknownHTTPS traffic detected: 199.232.192.193:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: setup-avast-premium-x64.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: dev.pdbw source: setup-avast-premium-x64.exe, I5iANwxNsA.exe.0.dr
Source: Binary string: dev.pdb source: setup-avast-premium-x64.exe, I5iANwxNsA.exe.0.dr
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile opened: C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\000003.logJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile opened: C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile opened: C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile opened: C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile opened: C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile opened: C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\336a045b-df12-4067-9f71-93ee2edb038d\Jump to behavior
Source: global trafficHTTP traffic detected: GET /HCYQoVR.jpeg HTTP/1.1accept: */*host: i.imgur.com
Source: Joe Sandbox ViewIP Address: 199.232.192.193 199.232.192.193
Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /HCYQoVR.jpeg HTTP/1.1accept: */*host: i.imgur.com
Source: global trafficDNS traffic detected: DNS query: i.imgur.com
Source: I5iANwxNsA.exe.0.drString found in binary or memory: http://ns.adobe.
Source: powershell.exe, 00000009.00000002.2158229069.000001E981973000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2176656219.000001E990070000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000009.00000002.2158229069.000001E980228000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000009.00000002.2158229069.000001E980DC3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2158229069.000001E980228000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000009.00000002.2158229069.000001E980001000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.2158229069.000001E980DC3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2158229069.000001E980228000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000009.00000002.2158229069.000001E980228000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000009.00000002.2158229069.000001E980001000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000009.00000002.2158229069.000001E980228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2158229069.000001E98162B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2158229069.000001E981312000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000009.00000002.2158229069.000001E98162B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: powershell.exe, 00000009.00000002.2176656219.000001E990070000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000009.00000002.2176656219.000001E990070000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000009.00000002.2176656219.000001E990070000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
Source: setup-avast-premium-x64.exe, I5iANwxNsA.exe.0.drString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: setup-avast-premium-x64.exe, README-I7PHWsRfJK.md.0.dr, I5iANwxNsA.exe.0.drString found in binary or memory: https://getsession.org/
Source: powershell.exe, 00000009.00000002.2158229069.000001E980228000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000009.00000002.2158229069.000001E98162B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
Source: I5iANwxNsA.exe.0.drString found in binary or memory: https://i.imgur.com/HCYQoVR.jpeg
Source: powershell.exe, 00000009.00000002.2158229069.000001E981973000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2176656219.000001E990070000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
Source: setup-avast-premium-x64.exe, README-I7PHWsRfJK.md.0.dr, I5iANwxNsA.exe.0.drString found in binary or memory: https://www.blockchain.com/)
Source: setup-avast-premium-x64.exe, README-I7PHWsRfJK.md.0.dr, I5iANwxNsA.exe.0.drString found in binary or memory: https://www.coinbase.com/)
Source: setup-avast-premium-x64.exe, README-I7PHWsRfJK.md.0.dr, I5iANwxNsA.exe.0.drString found in binary or memory: https://www.torproject.org/
Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
Source: unknownHTTPS traffic detected: 199.232.192.193:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: C:\Windows\System32\wevtutil.exeProcess token adjusted: SecurityJump to behavior
Source: I5iANwxNsA.exe.0.drBinary string: Failed to open \Device\Afd\Mio: X
Source: I5iANwxNsA.exe.0.drBinary string: 0\Device\Afd\Mio
Source: classification engineClassification label: mal88.evad.winEXE@21/34@1/1
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile created: C:\Users\user\Desktop\README-I7PHWsRfJK.mdJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7164:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tjcvkg2z.cox.ps1Jump to behavior
Source: setup-avast-premium-x64.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: setup-avast-premium-x64.exe, 00000000.00000003.2187160569.0000022C3A3A6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE [Activity_PackageId]([ActivityId] GUID NOT NULL, [Platform] TEXT NOT NULL COLLATE NOCASE, [PackageName] TEXT NOT NULL COLLATE NOCASE, [ExpirationTime] DATETIME NOT NULL);
Source: setup-avast-premium-x64.exeVirustotal: Detection: 9%
Source: setup-avast-premium-x64.exeString found in binary or memory: /load_hpack; header malformed -- pseudo not at head of block
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile read: C:\Users\user\Desktop\setup-avast-premium-x64.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\setup-avast-premium-x64.exe "C:\Users\user\Desktop\setup-avast-premium-x64.exe"
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\net.exe "net" session
Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 session
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vmware"
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Security /e:false"
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Application /e:false"
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Application /e:false
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Security /e:false
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\net.exe "net" sessionJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vmware"Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Security /e:false"Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Application /e:false"Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"Jump to behavior
Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 sessionJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Security /e:falseJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Application /e:falseJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: cryptnet.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\net.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\net.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\net.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\net.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\System32\net.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\net.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\net1.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\System32\net1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\net1.exeSection loaded: dsrole.dllJump to behavior
Source: C:\Windows\System32\net1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\net1.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\net1.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\System32\net1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\wevtutil.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wevtutil.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Windows\System32\wevtutil.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wevtutil.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vmware"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: setup-avast-premium-x64.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: setup-avast-premium-x64.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: setup-avast-premium-x64.exeStatic file information: File size 5485056 > 1048576
Source: setup-avast-premium-x64.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x37c600
Source: setup-avast-premium-x64.exeStatic PE information: Raw size of .rdata is bigger than: 0x100000 < 0x18bc00
Source: setup-avast-premium-x64.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: setup-avast-premium-x64.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: setup-avast-premium-x64.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: setup-avast-premium-x64.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: setup-avast-premium-x64.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: setup-avast-premium-x64.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: setup-avast-premium-x64.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: setup-avast-premium-x64.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: dev.pdbw source: setup-avast-premium-x64.exe, I5iANwxNsA.exe.0.dr
Source: Binary string: dev.pdb source: setup-avast-premium-x64.exe, I5iANwxNsA.exe.0.dr
Source: setup-avast-premium-x64.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: setup-avast-premium-x64.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: setup-avast-premium-x64.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: setup-avast-premium-x64.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: setup-avast-premium-x64.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile created: C:\Users\user\Desktop\I5iANwxNsA.exeJump to dropped file

Hooking and other Techniques for Hiding and Protection

barindex
Creates files in the recycle bin to hide itself
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile created: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini.funksecJump to behavior
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7074Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1549Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1501Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1598Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6616Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 504Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1988Thread sleep count: 7074 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 368Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3228Thread sleep count: 1549 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1520Thread sleep time: -1844674407370954s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5548Thread sleep count: 1501 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1788Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6544Thread sleep count: 1598 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5020Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6160Thread sleep count: 6616 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3224Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6160Thread sleep count: 504 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3408Thread sleep time: -1844674407370954s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile opened: C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\000003.logJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile opened: C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile opened: C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile opened: C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile opened: C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeFile opened: C:\Documents and Settings\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\336a045b-df12-4067-9f71-93ee2edb038d\Jump to behavior
Source: tasklist.exe, 00000004.00000003.2031882860.000002451BD9C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasklist/fiIMAGENAME eq vmware
Source: tasklist.exe, 00000004.00000003.2031882860.000002451BD9C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'
Source: tasklist.exe, 00000004.00000003.2031882860.000002451BD9C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: WMI.ExecQuery(SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE');
Source: tasklist.exe, 00000004.00000003.2031882860.000002451BD9C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IMAGENAME eq vmware
Source: tasklist.exe, 00000004.00000003.2031992408.000002451BDAC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'ER=Intel64 Family 6 Mo
Source: setup-avast-premium-x64.exe, 00000000.00000002.2192752865.00007FF6A6F9E000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: *Set-MpPreference -DisableRealtimeMonitoring $truewevtutil sl Security /e:falsewevtutil sl Application /e:falsevboxserviceqemuhypervvmwaretasklist/fiIMAGENAME eq LB
Source: tasklist.exe, 00000004.00000002.2032847726.000002451BFC0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasklist/fiIMAGENAME eq vmware\Users
Source: I5iANwxNsA.exe.0.drBinary or memory string: *Set-MpPreference -DisableRealtimeMonitoring $truewevtutil sl Security /e:falsewevtutil sl Application /e:falsevboxserviceqemuhypervvmwaretasklist/fiIMAGENAME eq LB8@
Source: tasklist.exe, 00000004.00000002.2032847726.000002451BFC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'E
Source: I5iANwxNsA.exe.0.drBinary or memory string: Set-MpPreference -DisableRealtimeMonitoring $truewevtutil sl Security /e:falsewevtutil sl Application /e:falsevboxserviceqemuhypervvmwaretasklist/fiIMAGENAME eq
Source: tasklist.exe, 00000004.00000002.2032267369.000002451BD60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\Desktop\C:\Windows\system32\tasklist.exe"tasklist" /fi "IMAGENAME eq vmware"C:\Windows\system32\tasklist.exeWinsta0\Default
Source: tasklist.exe, 00000004.00000002.2032740341.000002451BD9C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'
Source: tasklist.exe, 00000004.00000002.2032847726.000002451BFC5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: > WHERE Caption = 'VMWARE'2\Wbem;C:\Windows\System32\WindowsPoerShell
Source: tasklist.exe, 00000004.00000002.2032740341.000002451BD9C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: cQuery(SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE');
Source: tasklist.exe, 00000004.00000003.2031992408.000002451BD97000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'0
Source: tasklist.exe, 00000004.00000002.2032740341.000002451BDAC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'VMWARE'ER=Intel64 Family 6 Mo((
Source: tasklist.exe, 00000004.00000002.2032267369.000002451BD60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "tasklist" /fi "IMAGENAME eq vmware"
Source: setup-avast-premium-x64.exe, 00000000.00000002.2191932585.0000022C38707000.00000004.00000020.00020000.00000000.sdmp, setup-avast-premium-x64.exe, 00000000.00000003.2191129962.0000022C38707000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeMemory allocated: page read and write | page guardJump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Bypasses PowerShell execution policy
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"
Disables Windows Defender (via service or powershell)
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Jump to behavior
Modifies Windows Defender protection settings
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\net.exe "net" sessionJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\tasklist.exe "tasklist" /fi "IMAGENAME eq vmware"Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Security /e:false"Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "wevtutil sl Application /e:false"Jump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"Jump to behavior
Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 sessionJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Security /e:falseJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" sl Application /e:falseJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$Recycle.Bin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$WinREAgent VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\$WinREAgent\Scratch VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\.curlrc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\3D Objects\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\3D Objects\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\3D Objects\desktop.ini VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\000003.log VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\000003.log VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\000003.log VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\336a045b-df12-4067-9f71-93ee2edb038d VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_1 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_1 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOCK VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOCK VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOCK VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOCK VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\MANIFEST-000001 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\MANIFEST-000001 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cookie VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\ARM VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\ARM\S VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\000003.log.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\000003.log.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\336a045b-df12-4067-9f71-93ee2edb038d VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_1 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_3 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_3 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\78bff3512887b83d_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\000003.log.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOCK VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\MANIFEST-000001 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies-journal VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies-journal VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\NetworkDataMigrated VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\NetworkDataMigrated VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Reporting and NEL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Reporting and NEL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\MANIFEST-000001 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cookie VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_1 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_1 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_3 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\78bff3512887b83d_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\000003.log.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\000003.log.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\MANIFEST-000001 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\MANIFEST-000001 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\MANIFEST-000001 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies-journal VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\NetworkDataMigrated VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Reporting and NEL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Reporting and NEL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Color VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_1 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_3 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_3 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d5dedf551f4d1592_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOCK VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\MANIFEST-000001 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Reporting and NEL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\CURRENT VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOCK VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\ARM\Acrobat_23.006.20320 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\ARM\S VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5} VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\000003.log.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_1 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_1 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_3 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_3 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\the-real-index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOCK VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOCK VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\NetworkDataMigrated VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Reporting and NEL-journal VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\ARM VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Color\Profiles VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\000003.log.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\000003.log.funksec VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\336a045b-df12-4067-9f71-93ee2edb038d VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_1 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_1 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_3 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_3 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\index VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeQueries volume information: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\78bff3512887b83d_0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeCode function: 0_2_00007FF6A6F8B7B8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF6A6F8B7B8
Source: C:\Users\user\Desktop\setup-avast-premium-x64.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation		1
DLL Side-Loading		11
Process Injection		1
Masquerading		OS Credential Dumping1
System Time Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts2
Command and Scripting Interpreter		Boot or Logon Initialization Scripts1
DLL Side-Loading		21
Disable or Modify Tools		LSASS Memory1
Security Software Discovery		Remote Desktop ProtocolData from Removable Media1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
PowerShell		Logon Script (Windows)Logon Script (Windows)21
Virtualization/Sandbox Evasion		Security Account Manager2
Process Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
Process Injection		NTDS21
Virtualization/Sandbox Evasion		Distributed Component Object ModelInput Capture3
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Hidden Files and Directories		LSA Secrets1
Application Window Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain Credentials2
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync14
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1585136 Sample: setup-avast-premium-x64.exe Startdate: 07/01/2025 Architecture: WINDOWS Score: 88 34 ipv4.imgur.map.fastly.net 2->34 36 i.imgur.com 2->36 40 Multi AV Scanner detection for submitted file 2->40 42 Sigma detected: Powershell Defender Disable Scan Feature 2->42 44 Sigma detected: Disable of ETW Trace 2->44 46 3 other signatures 2->46 8 setup-avast-premium-x64.exe 22 2->8         started        signatures3 process4 dnsIp5 38 ipv4.imgur.map.fastly.net 199.232.192.193, 443, 49704 FASTLYUS United States 8->38 30 C:\$Recycle.Bin\...\desktop.ini.funksec, data 8->30 dropped 32 C:\Users\user\Desktop\I5iANwxNsA.exe, PE32+ 8->32 dropped 48 Creates files in the recycle bin to hide itself 8->48 50 Bypasses PowerShell execution policy 8->50 52 Modifies Windows Defender protection settings 8->52 54 Disables Windows Defender (via service or powershell) 8->54 13 powershell.exe 23 8->13         started        16 powershell.exe 23 8->16         started        18 powershell.exe 7 8->18         started        20 4 other processes 8->20 file6 signatures7 process8 signatures9 56 Loading BitLocker PowerShell Module 13->56 22 WmiPrvSE.exe 13->22         started        24 wevtutil.exe 1 18->24         started        26 wevtutil.exe 1 20->26         started        28 net1.exe 1 20->28         started        process10

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
setup-avast-premium-x64.exe10%VirustotalBrowse
setup-avast-premium-x64.exe3%ReversingLabs

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\Desktop\I5iANwxNsA.exe3%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://getsession.org/0%Avira URL Cloudsafe
http://ns.adobe.0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
ipv4.imgur.map.fastly.net
199.232.192.193
truefalse
    		high
    i.imgur.com
    		unknown
    		unknownfalse
      		high

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://nuget.org/NuGet.exepowershell.exe, 00000009.00000002.2158229069.000001E981973000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2176656219.000001E990070000.00000004.00000800.00020000.00000000.sdmpfalse
        		high
        https://aka.ms/winsvr-2022-pshelppowershell.exe, 00000009.00000002.2158229069.000001E980228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2158229069.000001E98162B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2158229069.000001E981312000.00000004.00000800.00020000.00000000.sdmpfalse
          		high
          https://www.coinbase.com/)setup-avast-premium-x64.exe, README-I7PHWsRfJK.md.0.dr, I5iANwxNsA.exe.0.drfalse
            		high
            http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000009.00000002.2158229069.000001E980228000.00000004.00000800.00020000.00000000.sdmpfalse
              		high
              http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000009.00000002.2158229069.000001E980DC3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2158229069.000001E980228000.00000004.00000800.00020000.00000000.sdmpfalse
                		high
                http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000009.00000002.2158229069.000001E980228000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  https://go.micropowershell.exe, 00000009.00000002.2158229069.000001E98162B000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000009.00000002.2158229069.000001E980DC3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2158229069.000001E980228000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      https://contoso.com/powershell.exe, 00000009.00000002.2176656219.000001E990070000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        https://nuget.org/nuget.exepowershell.exe, 00000009.00000002.2158229069.000001E981973000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2176656219.000001E990070000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          https://contoso.com/Licensepowershell.exe, 00000009.00000002.2176656219.000001E990070000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            https://contoso.com/Iconpowershell.exe, 00000009.00000002.2176656219.000001E990070000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              https://docs.rs/getrandom#nodejs-es-module-supportsetup-avast-premium-x64.exe, I5iANwxNsA.exe.0.drfalse
                                		high
                                https://aka.ms/winsvr-2022-pshelpXpowershell.exe, 00000009.00000002.2158229069.000001E98162B000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://i.imgur.com/HCYQoVR.jpegI5iANwxNsA.exe.0.drfalse
                                    		high
                                    https://aka.ms/pscore68powershell.exe, 00000009.00000002.2158229069.000001E980001000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://www.torproject.org/setup-avast-premium-x64.exe, README-I7PHWsRfJK.md.0.dr, I5iANwxNsA.exe.0.drfalse
                                        		high
                                        http://ns.adobe.I5iANwxNsA.exe.0.drfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000009.00000002.2158229069.000001E980001000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://github.com/Pester/Pesterpowershell.exe, 00000009.00000002.2158229069.000001E980228000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            https://www.blockchain.com/)setup-avast-premium-x64.exe, README-I7PHWsRfJK.md.0.dr, I5iANwxNsA.exe.0.drfalse
                                              		high
                                              https://getsession.org/setup-avast-premium-x64.exe, README-I7PHWsRfJK.md.0.dr, I5iANwxNsA.exe.0.drfalse
                                              • Avira URL Cloud: safe
                                              		unknown

                                              World Map of Contacted IPs

                                              • No. of IPs < 25%
                                              • 25% < No. of IPs < 50%
                                              • 50% < No. of IPs < 75%
                                              • 75% < No. of IPs

                                              Public IPs

                                              IPDomainCountryFlagASNASN NameMalicious
                                              199.232.192.193
                                              		ipv4.imgur.map.fastly.netUnited States
                                              		54113FASTLYUSfalse

                                              General Information

                                              Joe Sandbox version:41.0.0 Charoite
                                              Analysis ID:1585136
                                              Start date and time:2025-01-07 06:14:44 +01:00
                                              Joe Sandbox product:CloudBasic
                                              Overall analysis duration:0h 6m 35s
                                              Hypervisor based Inspection enabled:false
                                              Report type:full
                                              Cookbook file name:default.jbs
                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                              Run name:Run with higher sleep bypass
                                              Number of analysed new started processes analysed:16
                                              Number of new started drivers analysed:0
                                              Number of existing processes analysed:0
                                              Number of existing drivers analysed:0
                                              Number of injected processes analysed:0
                                              Technologies:
                                              • HCA enabled
                                              • EGA enabled
                                              • AMSI enabled
                                              Analysis Mode:default
                                              Analysis stop reason:Timeout
                                              Sample name:setup-avast-premium-x64.exe
                                              Detection:MAL
                                              Classification:mal88.evad.winEXE@21/34@1/1
                                              EGA Information:Failed
                                              HCA Information:Failed
                                              Cookbook Comments:
                                              • Found application associated with file extension: .exe
                                              • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                              • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored
                                              • Stop behavior analysis, all processes terminated

                                              Warnings

                                              • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                              • Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45
                                              • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                              • Execution Graph export aborted for target powershell.exe, PID 5700 because it is empty
                                              • Execution Graph export aborted for target setup-avast-premium-x64.exe, PID 5732 because there are no executed function
                                              • Not all processes where analyzed, report is missing behavior information
                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                              • Report size getting too big, too many NtCreateFile calls found.
                                              • Report size getting too big, too many NtCreateKey calls found.
                                              • Report size getting too big, too many NtOpenFile calls found.
                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                              • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                              • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                              Simulations

                                              Behavior and APIs

                                              ⊘No simulations

                                              Joe Sandbox View / Context

                                              IPs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              199.232.192.193https://report-scam.malwarebouncer.com/XcUR2TnV2VTlXT0s0Z0NYa01KSGt3dUtWMWNiblBrc29mMlpZUU1WdThBSjdDdTlRQTVDV1ZZd0pDeWRmUU5rQ1QvVDNiSlBNYWd2bTd0eTRkZW5jT0hrYTBKWHFiVUc4TVZBOGpiNkh4VG9OTm9zNTVUWHNmNWVydHpqbzhIc1llSzdzTHZ0dENVNWRLZy9BbCsyVDRMSGRHOThUWnV5QUxPU0RZL1dPalNYTmUzMTVoRzl5bmk1ZVZRPT0tLUdVYnJkMC9GazI3MWlxYmotLUpFOURyOWkzK1l6Vy9BYTVOVDBVNkE9PQ==?cid=2346401253Get hashmaliciousKnowBe4Browse
                                                https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyqlGet hashmaliciousHTMLPhisherBrowse
                                                  https://covid19.protected-forms.com/XQTNkY0hwMkttOEdiZmZ0V2RRTHpDdDNqUTROanhES0NBYmdFOG1KTGRSTUtrK3VMMzlEN1JKVVFXNUxaNGJOQmd1YzQ3ajJMeVdZUDU3TytRbGtIaFhWRkxnT0lkeTZhdy9xWEhjeFBoRXRTb2hxdjlVbi9iSk1qZytLQ0JxRjd4UmpOS3VUQ2lpOEZneTRoVmpzY2dyekR1WlhYOWVteVcrUXg0a2Y2aEU2ZEZwMVNId3R0U01RK3N3PT0tLVR0bDl1WEFUelg3K2VzTystLUxaMkFrZnU0UmJXRkR3aE5NRE9BOEE9PQ==?cid=2351432832Get hashmaliciousKnowBe4Browse
                                                    https://employeeportal.net-login.com/XL0pFWEloTnBYUmM5TnBUSmVpbWxiSUpWb3BBL1lPY1hwYU5uYktNWkd5ME82bWJMcUhoRklFUWJiVmFOUi9uUS81dGZ4dnJZYkltK2NMZG5BV1pmbFhqMXNZcm1QeXBXTXI4R090NHo5NWhuL2l4TXdxNlY4VlZxWHVPNTdnc1M3aU4xWjhFTmJiTEJWVUYydWVqZjNPbnFkM3M5T0FNQ2lRL3EySjhvdVVDNzZ2UHJQb0xQdlhZbTZRPT0tLTJaT0Z2TlJ3S0NMTTZjc2ktLTZGNUIwRnVkbFRTTHR2dUFITkcxVFE9PQ==?cid=2341891188Get hashmaliciousKnowBe4Browse
                                                      https://en.newsnowbangla.com/archives/69912Get hashmaliciousHTMLPhisher, TechSupportScamBrowse
                                                        https://gmail.net-login.com/Xb1Rnb3pKRC9CUEdpbldIVTREbHhIK1Vza1NvaWlrblBIbkN4aUdCZUt0Y2NlSGJiWmZ2d0M1dTB5dEpRbnRoVDdBVkFTcEJqWGowNVZycWJNWHlIUHlLOG1qS0FvemVPSXpFRFhGcUhmaVU1ekQwMklrVmM0QjVpNmhLaDdoY1I4UlhMcFo1TTJaSFhtaWpiWWFqWGZ5WEg4TnBiOUl4MDI1RFMyWStQRFoyNFo5UFZNUUpmWXBtaUg0Y0FjUG1jejdSVnFVOXJQL2VzdmNLM1lEaWtmRkZnZEk2Vi0tVHFIeU0vOWxTN01YVEtXbS0tTTh5Skh1eEtsc0xTT0J5Rzg2Q2ZJQT09?cid=2330416057%3EOpenGet hashmaliciousKnowBe4Browse
                                                          https://www.asda.com@hnvs.xyz/asda-christmas-prizesGet hashmaliciousUnknownBrowse
                                                            Ball - Temp.data for GCMs.docGet hashmaliciousHTMLPhisherBrowse
                                                              https://mail.donotreply.biz/XWW04VVZpU2JyWTFmVy96T2RUOUEvcEhyMWhFSm5uZElnVUlmb2dTZEdMRFdGSU1UV2V3S3RUNGdrNmNQRFJ4WTFPRHdYYlkraDV3S1YyVVpuU3E3K2p1bWowcEt3M24ySVBLanRDUkwyYitYWExuYTB5YlhVTUhySWZKbGJCTE9oRHl2RCtjR29BbEk3ZEwxZFJaNmNoK29ESk0vTGcxSmtyK0FWTExLWTdxYlQ1Yys1bjNiTUczY0RnPT0tLTU2R0pFM1VwZFRnVndZSWktLXptU2lWOHlQdjR0eGI1K09OQVZtRnc9PQ==?cid=2315575162Get hashmaliciousKnowBe4Browse

                                                                Domains

                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                ipv4.imgur.map.fastly.nethttps://report-scam.malwarebouncer.com/XcUR2TnV2VTlXT0s0Z0NYa01KSGt3dUtWMWNiblBrc29mMlpZUU1WdThBSjdDdTlRQTVDV1ZZd0pDeWRmUU5rQ1QvVDNiSlBNYWd2bTd0eTRkZW5jT0hrYTBKWHFiVUc4TVZBOGpiNkh4VG9OTm9zNTVUWHNmNWVydHpqbzhIc1llSzdzTHZ0dENVNWRLZy9BbCsyVDRMSGRHOThUWnV5QUxPU0RZL1dPalNYTmUzMTVoRzl5bmk1ZVZRPT0tLUdVYnJkMC9GazI3MWlxYmotLUpFOURyOWkzK1l6Vy9BYTVOVDBVNkE9PQ==?cid=2346401253Get hashmaliciousKnowBe4Browse
                                                                • 199.232.192.193
                                                                https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyqlGet hashmaliciousHTMLPhisherBrowse
                                                                • 199.232.192.193
                                                                https://covid19.protected-forms.com/XQTNkY0hwMkttOEdiZmZ0V2RRTHpDdDNqUTROanhES0NBYmdFOG1KTGRSTUtrK3VMMzlEN1JKVVFXNUxaNGJOQmd1YzQ3ajJMeVdZUDU3TytRbGtIaFhWRkxnT0lkeTZhdy9xWEhjeFBoRXRTb2hxdjlVbi9iSk1qZytLQ0JxRjd4UmpOS3VUQ2lpOEZneTRoVmpzY2dyekR1WlhYOWVteVcrUXg0a2Y2aEU2ZEZwMVNId3R0U01RK3N3PT0tLVR0bDl1WEFUelg3K2VzTystLUxaMkFrZnU0UmJXRkR3aE5NRE9BOEE9PQ==?cid=2351432832Get hashmaliciousKnowBe4Browse
                                                                • 199.232.192.193
                                                                https://employeeportal.net-login.com/XL0pFWEloTnBYUmM5TnBUSmVpbWxiSUpWb3BBL1lPY1hwYU5uYktNWkd5ME82bWJMcUhoRklFUWJiVmFOUi9uUS81dGZ4dnJZYkltK2NMZG5BV1pmbFhqMXNZcm1QeXBXTXI4R090NHo5NWhuL2l4TXdxNlY4VlZxWHVPNTdnc1M3aU4xWjhFTmJiTEJWVUYydWVqZjNPbnFkM3M5T0FNQ2lRL3EySjhvdVVDNzZ2UHJQb0xQdlhZbTZRPT0tLTJaT0Z2TlJ3S0NMTTZjc2ktLTZGNUIwRnVkbFRTTHR2dUFITkcxVFE9PQ==?cid=2341891188Get hashmaliciousKnowBe4Browse
                                                                • 199.232.192.193
                                                                https://en.newsnowbangla.com/archives/69912Get hashmaliciousHTMLPhisher, TechSupportScamBrowse
                                                                • 199.232.192.193
                                                                https://gmail.net-login.com/Xb1Rnb3pKRC9CUEdpbldIVTREbHhIK1Vza1NvaWlrblBIbkN4aUdCZUt0Y2NlSGJiWmZ2d0M1dTB5dEpRbnRoVDdBVkFTcEJqWGowNVZycWJNWHlIUHlLOG1qS0FvemVPSXpFRFhGcUhmaVU1ekQwMklrVmM0QjVpNmhLaDdoY1I4UlhMcFo1TTJaSFhtaWpiWWFqWGZ5WEg4TnBiOUl4MDI1RFMyWStQRFoyNFo5UFZNUUpmWXBtaUg0Y0FjUG1jejdSVnFVOXJQL2VzdmNLM1lEaWtmRkZnZEk2Vi0tVHFIeU0vOWxTN01YVEtXbS0tTTh5Skh1eEtsc0xTT0J5Rzg2Q2ZJQT09?cid=2330416057%3EOpenGet hashmaliciousKnowBe4Browse
                                                                • 199.232.196.193
                                                                https://www.asda.com@hnvs.xyz/asda-christmas-prizesGet hashmaliciousUnknownBrowse
                                                                • 199.232.196.193
                                                                Ball - Temp.data for GCMs.docGet hashmaliciousHTMLPhisherBrowse
                                                                • 199.232.196.193
                                                                Ball - Temp.data for GCMs.docGet hashmaliciousHTMLPhisherBrowse
                                                                • 199.232.192.193

                                                                ASNs

                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                FASTLYUShttps://u896278.ct.sendgrid.net/ls/click?upn=u001.qpi-2F0q-2FpcJZ7AGoG9N-2BrxLxoGn8scq-2BedBfmGHFAiwRCk-2Fciku7nsS3YfQMNNJI09mLo_nYx4-2F6dkZkjW10KMIp5mXhxys1ng1sBiI-2Bi9ROMYt6d5xhIh5rIqEUIaIxVHh8-2Ftz-2FouCgfXZk6mMUe2uKm92SOgBLlBdhjnRJuhENZnIuGoEoPqnROi7OCzdabJBBnGjEwd2iK-2BngR2RyIIgM3XrJQ7wQhHrfqScifSW3iAsv3H5nGFK9ntcSdChvkxj0yXdE-2FQ0ICDszl57i6aZSB-2Fow-3D-3DGet hashmaliciousUnknownBrowse
                                                                • 151.101.192.176
                                                                https://report-scam.malwarebouncer.com/XcUR2TnV2VTlXT0s0Z0NYa01KSGt3dUtWMWNiblBrc29mMlpZUU1WdThBSjdDdTlRQTVDV1ZZd0pDeWRmUU5rQ1QvVDNiSlBNYWd2bTd0eTRkZW5jT0hrYTBKWHFiVUc4TVZBOGpiNkh4VG9OTm9zNTVUWHNmNWVydHpqbzhIc1llSzdzTHZ0dENVNWRLZy9BbCsyVDRMSGRHOThUWnV5QUxPU0RZL1dPalNYTmUzMTVoRzl5bmk1ZVZRPT0tLUdVYnJkMC9GazI3MWlxYmotLUpFOURyOWkzK1l6Vy9BYTVOVDBVNkE9PQ==?cid=2346401253Get hashmaliciousKnowBe4Browse
                                                                • 199.232.196.193
                                                                https://bs32c.golfercaps.com/vfd23ced/#sean@virtualintelligencebriefing.comGet hashmaliciousHTMLPhisherBrowse
                                                                • 151.101.66.137
                                                                https://app.saner.ai/shared/notes/7353e5ae-dd5f-410b-92c3-210c9e88052aGet hashmaliciousHTMLPhisherBrowse
                                                                • 151.101.2.137
                                                                https://u43161309.ct.sendgrid.net/ls/click?upn=u001.L9-2FCbhkaoUACh7As3yZ8i4iABGphfl-2FJgS6Xiu1aw6I-3DgXpA_qO4VbBWAKg4gLfGs-2BfuSyZki3gKzG4I1DrYN15Q8fD7JV1twLeLo1AFs1GBSG3ZgA22dFJdXJloKc56aXDeV3olJKTBJd8NprednZ2LeXdX-2BkcSQE-2F2FRwgBng5RbUCLfjS8-2FI3mrpwyYu9lRatIB62qUwPSax-2Fhh2c7R-2B7pT3Kos0wK0SEJGj4ZMkgOGYhEniKYT7Kn7jN25xFz2sFdtPlVQkIdCFKwDNWmq-2BrAxerZE2GuKgfkuf3l1UY4J42sOOltybAAVyLhV-2BXfmbuQpN4NpshXRIuhta8ho3ChcTA5NtgjludQThyLtwhGns-2ByLqSbpO1Bhhc-2FCgdgP-2BAOxYrGHvKHjVYRr6-2BiryADxfM-3DGet hashmaliciousHTMLPhisherBrowse
                                                                • 151.101.1.229
                                                                Vernales Restaurant-encrypted.pdfGet hashmaliciousHTMLPhisherBrowse
                                                                • 151.101.2.137
                                                                ZipThis.exeGet hashmaliciousUnknownBrowse
                                                                • 151.101.65.229
                                                                https://sign.zoho.com/zsguest?locale=en&sign_id=234b4d535f4956235d3ed2bb80da1204238e412cdfe561cf1e7cff409a79a97da8a2d431ccef9065ebae57f03416d61f0971abb897fde199a21f0da5d9085251df31eb6747d99920190103a51a045e3e309308fa5f3a1ca3&action_type=SIGNGet hashmaliciousHTMLPhisherBrowse
                                                                • 151.101.2.137
                                                                http://click.pstmrk.itGet hashmaliciousUnknownBrowse
                                                                • 151.101.1.140

                                                                JA3 Fingerprints

                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                3b5074b1b5d032e5620f69f9f700ff0eZipThis.exeGet hashmaliciousUnknownBrowse
                                                                • 199.232.192.193
                                                                document pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                • 199.232.192.193
                                                                https://sendbot.me/mousse-w0fysl7Get hashmaliciousUnknownBrowse
                                                                • 199.232.192.193
                                                                fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                • 199.232.192.193
                                                                anrek.mp4.htaGet hashmaliciousLummaC StealerBrowse
                                                                • 199.232.192.193
                                                                title.mp4.htaGet hashmaliciousLummaC, PureLog Stealer, zgRATBrowse
                                                                • 199.232.192.193
                                                                Agent381.msiGet hashmaliciousUnknownBrowse
                                                                • 199.232.192.193
                                                                Setup.exeGet hashmaliciousUnknownBrowse
                                                                • 199.232.192.193
                                                                Setup.exeGet hashmaliciousUnknownBrowse
                                                                • 199.232.192.193

                                                                Dropped Files

                                                                ⊘No context

                                                                Created / dropped Files

                                                                C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):249
                                                                Entropy (8bit):7.139347865637937
                                                                Encrypted:false
                                                                SSDEEP:6:6zVqaFDy5VInzvcwLaM12dptmwaK0PsSONkYHQKgjCiW8cEx5Qc:KEas5VIzvcwh8dptm17sSiRSCUc0H
                                                                MD5:ED4ACD9F2962A7FB28E73467336946B0
                                                                SHA1:5790836E46AFB7CC2BDC285B257078794E2A42BB
                                                                SHA-256:FF3372303B5B117568114FE91D2958565BACB615C2A629FFB4B2196687F826B7
                                                                SHA-512:132BF0B20B743CA90A85A78D08FA909AF2639E3E32CACEF88FA8A3E441CB9AD5CC196CF750CEA309BDC9E12C998123C9B4A4DAFE5D9107B36DB6BD48CB7384EB
                                                                Malicious:true
                                                                Preview:.C.....3D.Zx...Q.8. .8......'..D.F.f...s.H&..(......a{.B...zM..wnI.Y..u..H.....I._}.g...V..<....j...f.#.y.......].9|.".N..S......$..|c...1.TtP.......U..g..O........lkv..e..$........X...c....fw.4_G=8.....',Ie...|...@..... ...e.u...$

                                                                C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):249
                                                                Entropy (8bit):7.218763277327966
                                                                Encrypted:false
                                                                SSDEEP:6:MmkKjqFbsk9O2P/0qm/KuPl80qPnzVes8S2yvFZjN1VsY2:MmkKask9O2Uqm/RPl8tBz8SzD9J2
                                                                MD5:C517AFA31883A9C51E7B4797DFFA06F2
                                                                SHA1:D136AF5DEF43305C2B8F797CF83490AB216F856B
                                                                SHA-256:632A6143D79DCDB6125B75DC185DDA86E7DC1A461C51C4D8C9E8BEE7FBBE7CA7
                                                                SHA-512:1AFA0A64D8BE1224421FFDCD3EE573D543092259F34D2017878836CADB26AC6071ED4D50B7F74D784B5998CD35D9CD372EFC22BDE301EFA348752859A53BE5D3
                                                                Malicious:false
                                                                Preview:....g./..A,.1.Ky.......Y...l.pS.......U......,#F...Ca..$..Z.;J....A.m.U....v}....[R...T.X.+.Zc.........K...[..*.'Z..].....i...l........6TR.,..7D.9.....#.w+n~I..9.C..0..K........HW....num....%...b..i."..K.....5....H0z..[.D>.s...F.6.

                                                                C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):249
                                                                Entropy (8bit):7.159506701014054
                                                                Encrypted:false
                                                                SSDEEP:6:o3i++cWxVSlV2/ZWmpncuif+IaYyzBlTtMRz6PQb:c/a3SlgRhZcutOy1lTYb
                                                                MD5:C37D00F177F45F217DB2AB8C64EAD61C
                                                                SHA1:538939334065E848BAC12473282A7FB56E23694E
                                                                SHA-256:09CEF2D90F10B28823A85B7711288294B6EAC348691BACF0415D2512357714C7
                                                                SHA-512:C8F2EA7AD56806EE376092096C50F5ACA803ECFE021480827689EEB86CF2D2BF608A07062CCC6A3605BEBAE236476BEF34DBBF45C1E65230EAF183E0B1F51EC3
                                                                Malicious:false
                                                                Preview:h.w.I`..~%n......}%..W....T.)...(j.x..rf..F0`U.Z...}.7..t.../[u....8Z.Q?../.D.........#H.li..C^..B.?d....W..di...a...).#.....)[ {wZ$..>.4.>..Bn\.1.....X..N ..g~...._.....t.....@..!..#....C.5..-BPHH;....9..K-.NR.*.c.V..f09.i9..W{..Vl.(~

                                                                C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):249
                                                                Entropy (8bit):7.159349672832098
                                                                Encrypted:false
                                                                SSDEEP:6:AIxENYv4VN0JBb7kxIA6rDu2Qa6V9DVxGLtyi4e54rc:AINYCrsqQx/7GLtuex
                                                                MD5:D111FCBF2387C9523759FD4D6440853F
                                                                SHA1:C85AB96E9B55C59598AE7C3362011E136F440AC2
                                                                SHA-256:540FFAAAF467AC20118695B0DF998C4DCDF89D7016C1E92A3851CDCCB9BAEA36
                                                                SHA-512:7C0D9D9C0DF306F976A730F7CD5F38C121FDB7E0729C3C33B9A3A8A1F3C4EBD557B683AEE414790AD489CBFF971C3F2CC9C951F02D6A13795785636062F45298
                                                                Malicious:false
                                                                Preview:.4..y...V..e..z[......<%.\=%....JN.Z....M...GnT.L+w0.Q.F7.....C.,.......*.7G...lT...5V....[v.z/.....BL7`....B...e....j....}......L...6:.A.Y..[...ne+....B.....l.[........P.k......C8@1....U..$.y~.....V+...'.....Z!...].i..f....%.@j.?P..K

                                                                C:\Users\user\3D Objects\desktop.ini.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):466
                                                                Entropy (8bit):7.285302730971663
                                                                Encrypted:false
                                                                SSDEEP:12:IFuF36/EJZcKibq5t5hqmnc8DuRRay2vcX1iOeXG:UuFK4Ze2z5hw8yRoJXG
                                                                MD5:FB12043482A8BD1CE7F76BAEF203DF73
                                                                SHA1:69D3FF40BABC1081B8132091A75746A4F3BE0EEB
                                                                SHA-256:EEBC44CAB318DFD8CFC859D80466870473C6E2D771F8DCA05F84F6534393B0F9
                                                                SHA-512:82844527D246C1E0E65E55BB15E318FE2BDD3B19F2CD7ACFD1B8F6B1B25654B3E10A6EE0788C494E2CBD29FF060DABDAC163064BA4E5026740A63FFB17E124B5
                                                                Malicious:false
                                                                Preview:.Vw.9C.&iG.W.]#.#..Mj.H.k........1.........e..9......;....P.xU..6. 5.\.......@z..i.B.f.J...5i..@.$.SD..."U...3..+.53....w...%.2Xk.t..dt...7....a~+..3I)m _`....}.i.z.~ ]S=..&..z.T..=...7...!.@.})...\.R.1.6..1t..V......T.|.?U..6. *.1.........hz..j..._.+...UiP..@U$.S.....";...5..*..3.....w...%.2Xk.t...t...7....^~...(IxmY_O....}.i.z.~~]k......."..g..!....]M......H..[S{;t."...Y...B.....a.f.7U..6. *.1.........$z..6...6.M..h.L..sab.[H...G

                                                                C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\000003.log.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):24
                                                                Entropy (8bit):4.41829583405449
                                                                Encrypted:false
                                                                SSDEEP:3:/5zGyBJ:xzGW
                                                                MD5:7B2C7AE391A662E757F49B8B170F5076
                                                                SHA1:6285C30DAE678B469A7818AE9A430EE068E008F8
                                                                SHA-256:09527012EA801E64E3A8B8BECB737B841399984B1A9416F7094D51CFCE71FF36
                                                                SHA-512:BBA10FB8409D4CBCB5D2D46ED488817F55DB2023DFFA31F4C48FD8F2D5722B52864DA45F70A00BE71F49AB05A5F505080EA4599427F7E7073798DE1C8D57B7CD
                                                                Malicious:false
                                                                Preview:I..........A....o.G..<.

                                                                C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\000003.log.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):24
                                                                Entropy (8bit):4.501629167387824
                                                                Encrypted:false
                                                                SSDEEP:3:GQ0xrDKLn:SxK
                                                                MD5:DF4C5C9FFA90FAD8A320B836D02B7D0A
                                                                SHA1:BD65CE0B9CB803BC4175596EB281E3106F88CFBA
                                                                SHA-256:4AEE1240810DC2705C289D4C5F603BAA3D4AC8D56E3676D8E47B8CC6F9518A1F
                                                                SHA-512:8261F5ED307CD689722159C375EE5ED68253CCE380AA9D2A36595EDF570E3FAA727B51408CC2415B04FA71F9C0E5BDD6A64079667948E8C8FFE2224555459AE9
                                                                Malicious:false
                                                                Preview:...q...Z.p."@.Q...Y&+...

                                                                C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):700
                                                                Entropy (8bit):7.737014361967387
                                                                Encrypted:false
                                                                SSDEEP:12:Zw08YIOFW5wqsLLEFPCge5B+9wtuwJ4wWHdxs8cN7N4YObWSpFUFSXcvqqQjzRMx:Zw0YO85C7XhCdxsf4YObWSpF9cvqPqTV
                                                                MD5:7F09C7A591DBBA0F13EDE1A3ECFC826D
                                                                SHA1:CF769EB9809C1499B2FEC337777B8A036B7030E8
                                                                SHA-256:6068092F9358BB26046AC8B6E4CDB78F3EE80A5F022AA8A9FF8E9EC423C8FA54
                                                                SHA-512:F12B011F4BA79D239B1E630568D0426122331BA04FF9EE88FBE0059EA475241AB34F77761A7E7946E32054E31B739B39DDC71BD4C89D174150DD635FA6F048E8
                                                                Malicious:false
                                                                Preview:(b..EsS....B;U...sP....[.,nG..s....kY.>@Q-M..._c......g9..........2=.P.t.Ju.XM,....A.rN#"..\R.....i...>P..+e&a...NH.Nu>o.....'..o..#...*..Y.....$.d.+`:.G?...C.V.~....Hm.d.I.u..c..>...rY..c.;. .k....%h.1....7Kh.....h...b.*-......0.... ..@.H.JA.na...s.e..Z'...+R...#.y..8\..YL;#...@.gq...%.}.B.#W......-./%...)...+`:.M....s.^.w..7.dc......^."D......] .@.w....f.8..)'..}.|..7B..Z8.+.B^4....N.....j.)C.|.Le.0Tq...l.5.bH....\R.....}...)_..9K&....rL..9D.....M.@..k......3...g..D.Q.F.SO7.r4...C.}.v3...ng.j...]....R...b.)I....5..sj.!...........]h....{*>f-..........O6.G.b.UO.hH=...u.b.Fr.,...?{.4.=......t...{.!...P`.{i.6.'.D.K..q..z...8...8..p.........R...VJ..-?Q.

                                                                C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):446
                                                                Entropy (8bit):7.5621702338634265
                                                                Encrypted:false
                                                                SSDEEP:12:n5WxB9bZOKLwwmxdQlszQDu+Hs5Clyk7R4n5Uaotx:5WvRIA2dwszQTiWV4n5Rotx
                                                                MD5:BF7B384A0C5ADC6FDB9E2369190E86B5
                                                                SHA1:B8E2B373EF62F420921E995FED5346BC62F07593
                                                                SHA-256:8F0DB66B2EAEBDFF244E28FBFA63FEB42CE740A10582896E017CACA30797671E
                                                                SHA-512:FBDEB6D30B84A4E64140071B179F5DC0DF3AD1B7EC2CDE5C529907D56DF9753C223A0010BE670D899658FB9C7A49A5BBA12A255C475BD42FA1E0DFC0063F3A4D
                                                                Malicious:false
                                                                Preview:...R..(3."..Q..[...RB.fH.%..M..-.....8K.V.......O.......Yhy..9...s.G+n.....2B..=....f....e.....t.....'..F-..].....n..Cm.ti1..s...Z.._.,.T=%~.I!...V=.h.....%T.&.O...Nb|.'7q......=.G..h.W.."..E].....>l..M:C.[\D........n\..u9E..iV.....&I......>C..<.Y........+.6L.......,.>Y..<y....w...^%.`.c..)......^-0..hBy.."..D.Vm.m...K..:K_...M.gFd>(..#.....v..<.......i.y \.L...{a...\E.j2>.Zh(...;...~v...u[....*.h...=+....._.....>

                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):1737
                                                                Entropy (8bit):7.852263705331577
                                                                Encrypted:false
                                                                SSDEEP:48:IrLVXGOMViDEH1mDn6Km6/v5GmLX+IMH47:5iDC+T1x
                                                                MD5:E2A24B872617DD7C60F752539BD07DA8
                                                                SHA1:98F61BAA9E10CC6835A2F9A06D63A3D2BFD15380
                                                                SHA-256:154DCA93097E762B192ADE88CB0685B0BEEF11C8DDEAA0E6426DBA704E979443
                                                                SHA-512:8630B00B5EF4253D803CC2D16393B5D061CF4AE3C6E6B89E7E83C682F36D38CC3FF7821C8FE74664E2BA40EF0F384EB45DFFA7EFB315E743CEE102A7D9A0B4FA
                                                                Malicious:false
                                                                Preview:..|.qj!.].k.Z...~.+.1..9.OQ..L_..0=%..M..i.....J....IL...].#5d......u.....X.....{..mC...S..s.G}T-.=.(..&U..._...u....h......9....H.kz...$a.qoL......rQ.....S.....TdC~........./.3....,...j.y.^0s.^..<..S....4..I.n..._..C..V.(lK.....m.....>H....{i.'......;}.LHg......$.1H\....9.H....a......%...-|.Sz...1c.rm.......\..N.....D..q.N.0.......*Z(R.../......B...%F.J.V...9Pdq.....I...?C....P.@..\.L.....=. n....<I.....3P.!.......x.[1},..!.6...j_.n...T...a.....1.....*q.bJ...6J.Sx.......P..j....D.o&.F.e,_.....,.A1.9N>.;%.._x|WB\..-...l1..4D5.Y..lX..q......!...F./vG...1..l...._.....\.0.......H.JIT!..U..9.&TQ..N.&.W....j.....m.)...<k.o.{..b..Zc........N2.......(b..RG&_......\...Q......k2....}C?]!V.T.{!6&5%L..3j.c....C..C..t.(l(...0..s....1Y.....%Y.'y......d..xv".6.'.."J[..n.H.].............z"..;`.T.%..=A.&_5......`.rL.....D.K+.2Wl,......Qf.>o.IS....K....?C...)5.D...B{f1.....)...v..#..C.._..qN......c.....=O.....P.:....*.0u.unx...2..H..d4..A.6.t.

                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):254579
                                                                Entropy (8bit):7.970560096340966
                                                                Encrypted:false
                                                                SSDEEP:6144:K1WUBCvV2Il44Fadg0Q0E/roezf+WRnRqxzvs3c7DJ:K1Ah4Tdu0E/rp1+A2t
                                                                MD5:9FFF092F664A7FFD5904978D01B5DDF9
                                                                SHA1:755869FD85B5C91EBCD5B76323756438A97927D6
                                                                SHA-256:469ADCDFC55748235BEDF2AEF1E957F40EB4570850639E7857AF63E841CF2E8D
                                                                SHA-512:E91C1F267A1675644229633DF5862C6EC6C5ED427CE160169B804BCEE2B4B9617D6E9233F8DA3E940CBDCD53EEB9D21BE7CA0FFBBD6E511BA3BC9E5DC03E81D7
                                                                Malicious:false
                                                                Preview:..7N.]C..o..~)..Vj.'.v ..X...J.=. .b........x....D.*....R..\..Y......!....GQ11....L..U.:.........xB...,7u{}.".*.o...._h...v..~...+.pm.. ..A.....$.#...j......(..T.l.e.T.>..>G..)..F.T..#.......Y7W..Y....'.8..@G....:.;~.......D...{.........}...#fS=8@......]....?....0.... "'XW.....5..t,<J...n..~jb. .ex7......j.....'..mm.@.....u.J.V.f.=)+..)...5...bj..L.\..j....u..gW....G...-5.!sp.]u...P`....U...L..C......@....9"d1/......1.K...O.5....c....*!X....,.l..?.0@....M..-5..+.ni..S....j....4...........e>.].A.(.,@...8...m.j%.....zj.M.Q..&...y.B\HyB.;b..+4.|...I..;........6..l.....I...;Ms"/....X.1.......9. 0.....*!X..S...h....!$...c..~.....A|.....?.......#.4%Y.q....&..v.O.2../7...|.......).h.I......r.....r.T-.....`...d..r).......{...v..L..,..a....."a$$........s..+../....0...*<ojV.%...d....o....h...5..=.>-D.1..A.#....u.!9K.@.....sO.~.N.F../c(.8P..o.I/J..FN>G.>.J...$...k4.z%|..=.."....v.\.............D......}.....G_13p..'.e.p.......\.e... $-@q.....x

                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):14984
                                                                Entropy (8bit):7.9578826198884
                                                                Encrypted:false
                                                                SSDEEP:384:MamjYRYkTxBCt3LW7QMYK5GV9DevvdZcU6FuDkX:MamjYRYgsta7QM35GVFevvdZn6UDkX
                                                                MD5:38E7AC104D0465F9E4CD72E040BEE425
                                                                SHA1:D50C8C19790A7E73D2742F0CE2CBD6A338392F48
                                                                SHA-256:3B9617BD91BD047FBEA8E5BF5CFEED9F1DF5ED562C8C5D75362C7C2FE3E0201E
                                                                SHA-512:BADC7316DA32514FC8202BB288A8A7473AB97F841229265E4EAE3A7EEAB9B60A99A4C952E15A5388454389CABB4AF9C3999C26D8A5D005753736A03389118180
                                                                Malicious:false
                                                                Preview:.....9X..,..7...*..%.}K....r0R/+j.n..../...Ez>...1...x..5..j.E.AM.._l.0.Cf.../.2...4..~..0@....r.2=.W..Q....e....w..K...y.?.#./..-!.q.c...h..y\p..f..........l,....{..b+".A.."P../......r..w>n...Ua.....2......n._.....Q.,.3.....a.j.?N..G%.{......!.d....L. .yx"...$A."X"S.2^....71..`.._...@ x.<..=.30RF./...L..}_r...;.H........v5......6.\.....K.so............1?........%....(z.T..f6./n.K.3..>....&.Rh..D"......9.>..../J.5.Ptl...][.(C.O........T8...d.../..r.\.5..S.8#RA.p..A...~g...j..J......J+....o.cD..L..fs.R.K.4..M..T...!.U(...e....+.5....d9.+.a..a...$..f.f..Yd#.F).].,<.:.>.3... [...|z`...%r.'C`r./o....t...d..c...h.A.a.Q..1!wW.e.......w|...l...........)i...Z..AN../....~/.N\......=.....0.....9E........N...$.....dQ.8..?=.a....[e..Yv.w....:.5.?..)L...vaV.....P.6=.{..s....T&..G..o3.zN.R.?.) .. TP.....@....@...\..;......v6...z..jDW....9v... ...e..|.P....!.....d.!.d.aE..W.....j..2..0.UI.o.i@..I)._....4.l....?Q.5.}IA....^.t..t.^x...{...b

                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):312178
                                                                Entropy (8bit):7.80082400736462
                                                                Encrypted:false
                                                                SSDEEP:3072:K3wb8jZLy3gP/1u6HZjsN9mYaiEE8F2lJEoWJ6IPtptzse+IHPPtzibudxUpHY4t:Bfjhs7j3T6HBrtBLScoxLcoQx5
                                                                MD5:AFBCB1BBA72240B6BBE25CCE65676522
                                                                SHA1:DBC92F3C8D0D14BD27DA96AB202B464D6BE95405
                                                                SHA-256:7594CD42BA3F9E3D595864B0BD18A93FDD3E6F58D03F3F70BB0EE8BE56E75704
                                                                SHA-512:19FD19FAC5DA5CD9B7CF4CAFE21CF67FE52C8B3DC6EF7426667523CCD37B1B43A942CD6361E97AB6B09DFD7309F96BC8F296F7DEEE04947055AE900FC6936F63
                                                                Malicious:false
                                                                Preview:A.U......7.......u?5=y..5.h...~..~..$s....ss.4. T.*...P..Q)..Wr..e..........#...........2...L>.c.....b...1....0.z.E.7I.J<..l.y....C....,.+t..PL.c[>.-....".....dh.e.p.R.7...........#.*.=...oEtT.^..`.....H3..........8..B..I.4.|4...%..d.....d...+..?o....+.7......L>|\.ct..aM..3.8.$...v>n.O.e..,.y....S....,.+t..PL.c[>.-....".....dhO......n|..s.L..8....5.2..Y..9.....%.!.._D[.......l.BLu.Po...7.B...V./... /..e`e\/o....+.7......L>|\..(T.4*..3.8.$4..v.n.O.e..|.y......_..g..?^...(.>.-....".....dh.e.p.R.|....L./R.^.I*.L.....o?.]...`._.g&?.$.j..U.#y..)..M.g.....7.B.....d.....d...+..?o....`.'...nJ..".u7<..(T.4*..Tx.s.o.B.=.n.O*e....2.'...S....,.+t..PL.c[>.-....i..../.O...R.7........H:..b.u..@......_b......3.Ht...q.....?E.n..?.4.|4...%V./... /...+..?o....+.7......L>|\..(T.4*..3.8.$4B.=.%I.J...l.y......_b.g..t..PL.c[>.-....".....dh.e.p.R.7....L.{\]R...>.>.7a...>.....v.to..?...j....9.o.H.K..o.:..7....%..d.....d...+..?$4.>.`.........L>|\..(T.4*..Tx.s.o.B.=

                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):3946
                                                                Entropy (8bit):7.9136686142848145
                                                                Encrypted:false
                                                                SSDEEP:48:s6efn+w3DlUYwczz3eBPWXCQcAkcep0/E3Sj1cEGwOZtOcPw6tpmlsAB5eMeOTSm:s6o+wNzz3eeCTxp0cRECgqwo4pWN8
                                                                MD5:85FB49011AB2AA4685B5F5198D41D0D5
                                                                SHA1:57DF1D6162BAE68BBE33E2F612C766988486CC30
                                                                SHA-256:CDC9CB9D58C3F1765F8EE6880FF3907476CB985241BC1ADF3CBE03C90C8C83F6
                                                                SHA-512:133C76CB9A1F16ABA7A102FBC5548659DD28A600241018B27D0A7424547441933937BC5CFA06A8F1606F5CA0F5E49EBA69EBAE2CBFD8B2E38DDB307182D0CDDC
                                                                Malicious:false
                                                                Preview:ys.Q.TISvC.8q.....C.. |...;.w...%....C.]_;.p.G.z......L....)..J.).S.`|.)..+].sl.u..;.$....kJ.m.......V..o.Z..b.|....NA......C..u5...h.F..T.........T.....G=../.A...W.Z...[.%.G.n...5.N.g.d.c.)z7xF..g....0*+....Kl.Y..T...Kw.u....y...J.$...]O.Y..)Q.I..:...8V.t.&..\.....F.[?RH..=.`....AV..N.A.GHD.....bup-......K......\...xH.R..AR..?.....x.2..5...U.....g.ebAp2+..~X...(...Q.-.A.3.-Iv.J.f.RV......L..o...Z.a...@..Y...j.M@.j.........Ud.A.........l4...b.9_..YX....N...."0...z...VU.....U......D._%H.3..E...z.`...".T.%.U..C.i,,...5....A=i......(....a;.tG..aS;*.....J.......).....o.K....L.w.....-...j..u..;..........V..mBB....I\....+...G.z.Ted...zGLB.7....E......D..zH.E...J..{.....x.9..a.........O#j...M-4#K....6..]|.nq..2.....*H8....5..J..H.o...)...+.p`.>...j$ae.L..(.!....Oo.......Q.N.@m.Z..p.....JF...N....ub...>....V.......B..%.?^>.".d#..E.f....^...c.u.r.[.S....4..M8............7.....Ef...RY:.{.j...XH.bS....(.S.BV....mK.VA."..BqV.5.;..........D..%.Z..b.9}...>

                                                                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):91806
                                                                Entropy (8bit):7.955694243213174
                                                                Encrypted:false
                                                                SSDEEP:1536:bJRdjly2/J6ENz3SwfeKfOHJiU5w3PdJq+hMrlz8m/1TIidOO/:bndhymiQdWYJ3OAMrlVFdr
                                                                MD5:FEBC710390E8A3560DAA74C9EFE0C9F3
                                                                SHA1:E0994BDB101EF77DFC9515F6EEBC1168B3A455AE
                                                                SHA-256:5864B21C96160A405ED746F7A7E41C172772F1403C80660E30C1D7FFB1CD2A2B
                                                                SHA-512:8E401B0B573334F6081C93A518BBFE78022F20DD88C74CE3CEF925C233D0185749B4C5DA52F2BE4E76FED9F76E7F9C9F06C0251168E4A7D4B1C1591ADFAA07CA
                                                                Malicious:false
                                                                Preview:.E........gD.)....F......S........A.5..%OX..q?FP%...C....>....S..H....E....a.X...."....8..P..B..D0..=.p..'....F.W%......Z.F....e`QuB...R..q@.sH.<...ZP.-.~=..K.w,......t-.....wY..xG*.'.wm...?.!...R....U....\.\.R\..Qmv...>.mb..O..o....;....I....#.4.R.A.....[.....'....X.X....f..c.X.0@.q..W.Z.F..y.KRk.x...p..0'..*w.;..M(..C.gC...?D...."..t-"^....7}..p.....HF..0.}w....+.%o.....m.:...`...[....`.... ..c......x......1....d.......(.&....Z.X...[..(...6W.}..A.../...q...&u..7.p..0'...1.z..(.h.-.7y..s.ok....y..:LA,..17L.;..H=6...<)....7]..]..Y8..z....T..M....f.g.o....D.Q..;...*....[.b..w.....,.f..N..D0..1.........B.#D.{..].~.F...?..e`QuB..{q...'...3.X..i(..A.y....M.......0..d....7}X.;.DP......n&~N.q..y..t.i.5.[..)..5..z8.e.%6.......%..s....K....#.4.N.%......`.....xnZ.b....l..A.b.W%...}..Z.F..=..#Z..+...>.BH..31.K..n.-...XC..q.M-..."..5_Z?..`E.g#..PiKe...>ds..5n.[..$D........X..q._.....n..O..d....h...k..../.*..i.&..../..{.k....Z.X....a..A.bPU%...

                                                                C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):862
                                                                Entropy (8bit):7.673756075413374
                                                                Encrypted:false
                                                                SSDEEP:24:i1joqxH79EF6F328Ti88etko+SFzu78Jjgp7Nuvr1o2+:YjoqxH7gG32Yi88s+6u78JMHuho2+
                                                                MD5:2A39A968F74B247C311649E5A2DABF68
                                                                SHA1:F36937693C6917843B5C00222B0D2CAAD34BC4D7
                                                                SHA-256:000B61715ED9DF3C79E9B90CED4C4EC59A92A1461B52ECF37E67621272921085
                                                                SHA-512:323358B7C94CE4F98BE5EB285EB190E6D22D2DDE6E05E8F963B552C45D6BF4C5052D1BF6AB1139BEAF6F2A8FFCDB6814CB6F5467E473F1492BA052BE8BA2C861
                                                                Malicious:false
                                                                Preview:$...O..&.(@6..(kF._.o.&...wb..7h....Q3..W}.I^....9"9B/E.`..@t.=...]..u?..1...wX\...A+|.!....H.S.*..\.v.jq..._..t../...Z.g.C......bJK.....D].........!.........Q...-4?....byD.:n....>..4tX>. .(z.U.V..wa.{`..e.;...Lq....,...;.|..d...'.H...9~._.i.^{...6?...v6.e.>..._.D..M./....-...)i....wC.....(.m.......eJB.....D].........!.............OUs....euD..#Z..O.\M..E.Wc....i.4..|1d.[.uK......_gZ0........d..At.=...]..<.h.^{...wXmO.L.B..N....;.e..).@....-...5.n..4..q.M.^......v9.0....v.>.u..IA....y.....k..=:.............S..M....i.W..a.^..ge*....P[....'...L.n......m..[t.=...]..<.i.^{.z.6.o..DbH....x<.6..K.....Rk...)i.c..C.....:.?.....,Tst....4D].........3..R....9...bg]...euD.....2..5.U.....|..,. \N.K9l......v9.....9.d~*.....d..@t.=...]..<.i.^{...wXmO.L.B..N....;.6..M......-...)i...2Y...ah7.w..$.....RiJB.uT.J$V.a2.cV...

                                                                C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.funksec

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:data
                                                                Category:modified
                                                                Size (bytes):1441816
                                                                Entropy (8bit):7.44301555909737
                                                                Encrypted:false
                                                                SSDEEP:12288:m35ia9GLr8UBiG3Ajs8HtuEndZ25mQVSVGXUuBoceO2szV2Zy:moaELY5G3WsauEni5LYVGkuVeOj0y
                                                                MD5:1FA4E6BB8522406ECDE11176DDE56A3F
                                                                SHA1:76ECED2078D37BC895F2AFE9765D7D8D18D57321
                                                                SHA-256:EFD49C80808285A6FA62B9ED6261949B99B24AE9083464A199B697D16383D39F
                                                                SHA-512:FDB5DCBD7CDDA83E51FF5A209977DFAAE04335B6E62771355D0FEA7244719F321C6F5AEB0971488E87B8FD3FC73F004632CE7DD3E55A9563B250BADFB1E1B4EB
                                                                Malicious:false
                                                                Preview:6...s..-.Il../A,.R.$@h.,...m...t.....3Y..M.OS...9..G......-...c.o~....*\...Xv..[C*.N.z3..CB......!..*...)2..M..&.9.]..c..d.(...zk!@70Ap.+@.3=..k.n`._4B."...*...P..H....r..T..XYX?...J.=.UD.P.#CH....Y.y6.$...[=}.o..?AE...b..>.P.....n...:.\...Xv..[C*.N.z3..C[......!..*...)3..M..&.9.]..c..d.(...zk!@70Ap..W.H(...q..&,E..A..D.y.Yi06.......Y...S.i......1...)...... p.....::m..27.._..l.p..?...>..."..p!..;._{..4...+.O.:..T`.3+.p}...F..i....l.......}.I...)w...c9.sA....6..rh.P.y...Yl8..FO!.....y....^.Cd;)(....o.t`."..=..3.N.%..J.u....b.>u.o...*..a.G..p..5.q.."........o.4/^....Vo./..."....E.!.K.".c..M]...'.[....MV..<...C.X...4m...O%.XS....F3h....x ..b[..z.baYHqm....K.h.Ty<82....=.l4..2.....=.z.p....yR.\..#.eP...".....Vq.......'..."...@....Lc(v..=...2,D...?rG.c..QL..`.fC....fC..,...H.|.../b...~9.f ....W)CI...Y$..d[E.0Z..7-U6.Z..L.h..VXIL.....>..u.^.|.L.a..e.....}.&$..c|r1)e..:".&n]$..........6...:...\....TU....9...5.R.'..Gz.-..xl...U.dC....YV..9.

                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Download File
                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):64
                                                                Entropy (8bit):1.1628158735648508
                                                                Encrypted:false
                                                                SSDEEP:3:Nlllulzh8//h:NllUu
                                                                MD5:2D936C9957097D6631C64386010C648E
                                                                SHA1:AD0125A442F7BD53E9959CB996B58A685B09B85E
                                                                SHA-256:C93CB35DFCB4C1F5BD3B665C67D749E585887E56B9081D0E9FC47F54909E7119
                                                                SHA-512:27B07DBB385D27EF522ED09079877C6EBE9444FBE1E4401AF8BABB4B2EE4FC1CF7BC1A09B31A3A52ACA217B40E2B8207A5441D04F1C6D9A44C05E51C4D49E4AB
                                                                Malicious:false
                                                                Preview:@...e................................................@..........

                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3n4lgsnc.ct4.psm1

                                                                Download File
                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                File Type:ASCII text, with no line terminators
                                                                Category:dropped
                                                                Size (bytes):60
                                                                Entropy (8bit):4.038920595031593
                                                                Encrypted:false
                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                Malicious:false
                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5fqcxjge.haz.psm1

                                                                Download File
                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                File Type:ASCII text, with no line terminators
                                                                Category:dropped
                                                                Size (bytes):60
                                                                Entropy (8bit):4.038920595031593
                                                                Encrypted:false
                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                Malicious:false
                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5pxmktjd.00s.psm1

                                                                Download File
                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                File Type:ASCII text, with no line terminators
                                                                Category:dropped
                                                                Size (bytes):60
                                                                Entropy (8bit):4.038920595031593
                                                                Encrypted:false
                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                Malicious:false
                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_avd0jzrl.oxj.ps1

                                                                Download File
                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                File Type:ASCII text, with no line terminators
                                                                Category:dropped
                                                                Size (bytes):60
                                                                Entropy (8bit):4.038920595031593
                                                                Encrypted:false
                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                Malicious:false
                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fttbb3jy.jn2.ps1

                                                                Download File
                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                File Type:ASCII text, with no line terminators
                                                                Category:dropped
                                                                Size (bytes):60
                                                                Entropy (8bit):4.038920595031593
                                                                Encrypted:false
                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                Malicious:false
                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_injrmuio.35u.ps1

                                                                Download File
                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                File Type:ASCII text, with no line terminators
                                                                Category:dropped
                                                                Size (bytes):60
                                                                Entropy (8bit):4.038920595031593
                                                                Encrypted:false
                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                Malicious:false
                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jlzushqg.11q.ps1

                                                                Download File
                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                File Type:ASCII text, with no line terminators
                                                                Category:dropped
                                                                Size (bytes):60
                                                                Entropy (8bit):4.038920595031593
                                                                Encrypted:false
                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                Malicious:false
                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ktrhgup0.033.psm1

                                                                Download File
                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                File Type:ASCII text, with no line terminators
                                                                Category:dropped
                                                                Size (bytes):60
                                                                Entropy (8bit):4.038920595031593
                                                                Encrypted:false
                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                Malicious:false
                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o4vx0f0h.s54.ps1

                                                                Download File
                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                File Type:ASCII text, with no line terminators
                                                                Category:dropped
                                                                Size (bytes):60
                                                                Entropy (8bit):4.038920595031593
                                                                Encrypted:false
                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                Malicious:false
                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r0yrqhfb.mia.psm1

                                                                Download File
                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                File Type:ASCII text, with no line terminators
                                                                Category:dropped
                                                                Size (bytes):60
                                                                Entropy (8bit):4.038920595031593
                                                                Encrypted:false
                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                Malicious:false
                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tjcvkg2z.cox.ps1

                                                                Download File
                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                File Type:ASCII text, with no line terminators
                                                                Category:dropped
                                                                Size (bytes):60
                                                                Entropy (8bit):4.038920595031593
                                                                Encrypted:false
                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                Malicious:false
                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u0yqf1qu.rqa.psm1

                                                                Download File
                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                File Type:ASCII text, with no line terminators
                                                                Category:dropped
                                                                Size (bytes):60
                                                                Entropy (8bit):4.038920595031593
                                                                Encrypted:false
                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                Malicious:false
                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                C:\Users\user\Desktop\I5iANwxNsA.exe

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):5485056
                                                                Entropy (8bit):6.239621597157414
                                                                Encrypted:false
                                                                SSDEEP:49152:gNrjLXqz4aEXEMvTR4CY6C74bC6xxXjWe/l+XYq7p4BFt277t19sJpoc74P8TKWQ:dMvTRdxAG5/TuIx5f3
                                                                MD5:E099255EA4AA8EB41E26E5D94737FC26
                                                                SHA1:2C13D842E788E6C981B2FAE65834B1220D55F5A8
                                                                SHA-256:89B9F7499D59D0D308F5AD02CD6FDDD55B368190C37F6C5413C4CFCD343EEFF3
                                                                SHA-512:45963F430CDDE2C63CB4ED8660FD76ED193AE0BD4EA4012654E459F0C2E761D4EB724DCBA810D4D1144E78A03E752EA53880884DEE956EBF1A81F2B6EAB35766
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 3%
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...o...o...o...o...o.G.n...o.G.n...o.G.n...o.G.n...ok..n...o...o...o...o...o/G.n...oRich...o........PE..d.....{g.........."....*..7.........\.6........@..............................S.......S...`.................................................t.P.|.....S.h.....P.(............pS.La...zG.T....................{G.(...PyG.@.............7.`............................text...O.7.......7................. ..`.rdata........7.......7.............@..@.data....3....P..2....P.............@....pdata..(.....P.......P.............@..@.reloc..La...pS..b...FS.............@..B.rsrc...h.....S.......S.............@..@........................................................................................................................................................................................................................................................................

                                                                C:\Users\user\Desktop\I5iANwxNsA.exe:Zone.Identifier

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:ASCII text, with CRLF line terminators
                                                                Category:dropped
                                                                Size (bytes):26
                                                                Entropy (8bit):3.95006375643621
                                                                Encrypted:false
                                                                SSDEEP:3:ggPYV:rPYV
                                                                MD5:187F488E27DB4AF347237FE461A079AD
                                                                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                Malicious:false
                                                                Preview:[ZoneTransfer]....ZoneId=0

                                                                C:\Users\user\Desktop\README-I7PHWsRfJK.md

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:Unicode text, UTF-8 text
                                                                Category:dropped
                                                                Size (bytes):1636
                                                                Entropy (8bit):5.202597135655108
                                                                Encrypted:false
                                                                SSDEEP:48:WXufmCFpWyj/E2RUFKUn1R7ARj7qQXPHrHATBbB:W4mOp7o2SFKUn1WeQfLATB9
                                                                MD5:2C97DAB34E4AB7F089F0811866C7784D
                                                                SHA1:7C526F204D066FC5E1C59EB765F42F7B363F74BC
                                                                SHA-256:3583C0EB329CA6499C64EF5E84F7F888AEF5BF2892F73145DA9A75E336D56657
                                                                SHA-512:AE8B3E3083098E124397DA4E0DF6779A6D745FB1388D656F530C052906B06B6C1B895D01AAD371EAB24988F4E379E98379959F9966EE9631200D5C6937AAA0E3
                                                                Malicious:false
                                                                Preview:.# .. Funksec V1.5 ..... **Congratulations** . Your organization, device has been successfully infiltrated by funksec ransomware!..## .. **Stop**.- Do NOT attempt to tamper with files or systems..- Do NOT contact law enforcement or seek third-party intervention..- Do NOT attempt to trace funksec's activities...## .. **What happened**.- your files encrypted by funksec ransomware, becarfull to play or try dercrypt the files becouse you just will lose it more..- We stole all your data..- No anti-virus will restore it; this is an advanced ransomware..- your data will be leaked if you don't pay ransom..## .. **Ransom Details**.- Decryptor exe fee: **0.1 BTC**.- Bitcoin wallet address: `bc1qrghnt6cqdsxt0qmlcaq0wcavq6pmfm82vtxfeq`.- Payment instructions:. 1. Buy 0.1 bitcoin.. 2. Install session from: https://getsession.org/. 3. Contact us with this ID to receive the decryptor: 0538d726ae3cc264c1bd8e66c6c6fa366a3dfc589567944170001e6fdbea9efb3d..## .. **How to buy bitcoin**.-

                                                                C:\Users\user\Desktop\downloaded_wallpaper.jpg

                                                                Download File
                                                                Process:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 696x516, components 3
                                                                Category:dropped
                                                                Size (bytes):25447
                                                                Entropy (8bit):7.009816137563603
                                                                Encrypted:false
                                                                SSDEEP:384:icpk7sPEFPLY2xiy7JDk0Ot+A+AedexytJ0e:i5NLY20y75fO8A+HexyL
                                                                MD5:D10E302877008B2567890DE25F6D3711
                                                                SHA1:318D25D53DCD8765D79C6CEF07A6AEA72A4BF76F
                                                                SHA-256:EA627D5499996BDA0BDEF215B41FF4353BC9E9C6886AF45115D5EC5E170EAD93
                                                                SHA-512:173A2F5F2357E44D9A7C7E29D089AB81CC61495830CFBD40506B66992F41652CC7691E64CB7D4597F323C4B12EC96B0B5BD61BEDE4D0A69CACDCE56D0E4AE761
                                                                Malicious:false
                                                                Preview:......JFIF................................C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222.....................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(

                                                                Static File Info

                                                                General

                                                                File type:PE32+ executable (console) x86-64, for MS Windows
                                                                Entropy (8bit):6.239621597157414
                                                                TrID:
                                                                • Win64 Executable Console (202006/5) 92.65%
                                                                • Win64 Executable (generic) (12005/4) 5.51%
                                                                • Generic Win/DOS Executable (2004/3) 0.92%
                                                                • DOS Executable Generic (2002/1) 0.92%
                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                File name:setup-avast-premium-x64.exe
                                                                File size:5'485'056 bytes
                                                                MD5:e099255ea4aa8eb41e26e5d94737fc26
                                                                SHA1:2c13d842e788e6c981b2fae65834b1220d55f5a8
                                                                SHA256:89b9f7499d59d0d308f5ad02cd6fddd55b368190c37f6c5413c4cfcd343eeff3
                                                                SHA512:45963f430cdde2c63cb4ed8660fd76ed193ae0bd4ea4012654e459f0c2e761d4eb724dcba810d4d1144e78a03e752ea53880884dee956ebf1a81f2b6eab35766
                                                                SSDEEP:49152:gNrjLXqz4aEXEMvTR4CY6C74bC6xxXjWe/l+XYq7p4BFt277t19sJpoc74P8TKWQ:dMvTRdxAG5/TuIx5f3
                                                                TLSH:3E462922BB5A99ADC49AC0B083564B72697134CB0B35B9FF44C446783E6DAF42F3C758
                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........<...o...o...o...o...o.G.n...o.G.n...o.G.n...o.G.n...ok..n...o...o...o...o...o/G.n...oRich...o........PE..d.....{g.........."

                                                                File Icon

                                                                Icon Hash:1733716dd80c330f

                                                                Static PE Info

                                                                General

                                                                Entrypoint:0x14036b55c
                                                                Entrypoint Section:.text
                                                                Digitally signed:false
                                                                Imagebase:0x140000000
                                                                Subsystem:windows cui
                                                                Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                Time Stamp:0x677B011F [Sun Jan 5 22:01:03 2025 UTC]
                                                                TLS Callbacks:0x40352510, 0x1
                                                                CLR (.Net) Version:
                                                                OS Version Major:6
                                                                OS Version Minor:0
                                                                File Version Major:6
                                                                File Version Minor:0
                                                                Subsystem Version Major:6
                                                                Subsystem Version Minor:0
                                                                Import Hash:de46efa2ebc1886f978c8fb5ad471f48

                                                                Entrypoint Preview

                                                                Instruction
                                                                dec eax
                                                                sub esp, 28h
                                                                call 00007F55746E3338h
                                                                dec eax
                                                                add esp, 28h
                                                                jmp 00007F55746E2F57h
                                                                int3
                                                                int3
                                                                jmp 00007F55746E36D8h
                                                                int3
                                                                int3
                                                                int3
                                                                dec eax
                                                                sub esp, 28h
                                                                call 00007F55746E39A0h
                                                                test eax, eax
                                                                je 00007F55746E3103h
                                                                dec eax
                                                                mov eax, dword ptr [00000030h]
                                                                dec eax
                                                                mov ecx, dword ptr [eax+08h]
                                                                jmp 00007F55746E30E7h
                                                                dec eax
                                                                cmp ecx, eax
                                                                je 00007F55746E30F6h
                                                                xor eax, eax
                                                                dec eax
                                                                cmpxchg dword ptr [001A1CECh], ecx
                                                                jne 00007F55746E30D0h
                                                                xor al, al
                                                                dec eax
                                                                add esp, 28h
                                                                ret
                                                                mov al, 01h
                                                                jmp 00007F55746E30D9h
                                                                int3
                                                                int3
                                                                int3
                                                                dec eax
                                                                sub esp, 28h
                                                                test ecx, ecx
                                                                jne 00007F55746E30E9h
                                                                mov byte ptr [001A1CD5h], 00000001h
                                                                call 00007F55746E368Dh
                                                                call 00007F55746E33A0h
                                                                test al, al
                                                                jne 00007F55746E30E6h
                                                                xor al, al
                                                                jmp 00007F55746E30F6h
                                                                call 00007F55746E3393h
                                                                test al, al
                                                                jne 00007F55746E30EBh
                                                                xor ecx, ecx
                                                                call 00007F55746E3388h
                                                                jmp 00007F55746E30CCh
                                                                mov al, 01h
                                                                dec eax
                                                                add esp, 28h
                                                                ret
                                                                int3
                                                                int3
                                                                inc eax
                                                                push ebx
                                                                dec eax
                                                                sub esp, 20h
                                                                cmp byte ptr [001A1C9Ch], 00000000h
                                                                mov ebx, ecx
                                                                jne 00007F55746E3149h
                                                                cmp ecx, 01h
                                                                jnbe 00007F55746E314Ch
                                                                call 00007F55746E3916h
                                                                test eax, eax
                                                                je 00007F55746E310Ah
                                                                test ebx, ebx
                                                                jne 00007F55746E3106h
                                                                dec eax
                                                                lea ecx, dword ptr [001A1C86h]
                                                                call 00007F55746E39E8h
                                                                test eax, eax
                                                                jne 00007F55746E30F2h

                                                                Rich Headers

                                                                Programming Language:
                                                                • [IMP] VS2008 SP1 build 30729

                                                                Data Directories

                                                                NameVirtual AddressVirtual Size Is in Section
                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x5083740x17c.rdata
                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x53e0000x968.rsrc
                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x50e0000x28d28.pdata
                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x5370000x614c.reloc
                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x477a900x54.rdata
                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_TLS0x477b000x28.rdata
                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x4779500x140.rdata
                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_IAT0x37e0000x660.rdata
                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                Sections

                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                .text0x10000x37c44f0x37c6003cdde8ad736cadc7039e4157f0c0fe4cunknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                .rdata0x37e0000x18bb000x18bc00335d454e8d9a0d332e3231970c7ea839False0.26264781072331017DIY-Thermocam raw data (Lepton 2.x), scale 10757-14400, spot sensor temperature 0.000000, unit celsius, color scheme 7, calibration: offset 512.000000, slope 3250994570218613914771524346183680.0000005.394928298151681IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                .data0x50a0000x33100x3200e60990d6d7b6eb8bba2215cafa78a1ffFalse0.1609375data2.37717939628913IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                .pdata0x50e0000x28d280x28e004f7f16fc2ad7661ce5aa9b4bbc34086dFalse0.49999402714067276data6.413335908883142IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                .reloc0x5370000x614c0x6200e39eed23d057020af7ca276a61a11d9dFalse0.4321986607142857data5.452874903711012IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                                                .rsrc0x53e0000x9680xa002c3807f0c8a9080031e0919bb5c31f1aFalse0.316015625data2.9436328937029965IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                Resources

                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                RT_ICON0x53e0ac0x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors0.33212996389891697
                                                                RT_GROUP_ICON0x53e9540x14data1.15

                                                                Imports

                                                                DLLImport
                                                                api-ms-win-core-synch-l1-2-0.dllWaitOnAddress, WakeByAddressAll, WakeByAddressSingle
                                                                bcryptprimitives.dllProcessPrng
                                                                kernel32.dllGetOverlappedResult, ReadFile, SetFileCompletionNotificationModes, Sleep, GetModuleHandleA, GetCurrentThreadId, FreeEnvironmentStringsW, DeleteProcThreadAttributeList, CompareStringOrdinal, GetLastError, AddVectoredExceptionHandler, SetThreadStackGuarantee, GetCurrentThread, SwitchToThread, PostQueuedCompletionStatus, SetWaitableTimer, WaitForSingleObject, QueryPerformanceCounter, GetSystemInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetLastError, GetCurrentDirectoryW, GetEnvironmentStringsW, GetEnvironmentVariableW, GetQueuedCompletionStatusEx, GetCommandLineW, SetFileInformationByHandle, SetFilePointerEx, CreateIoCompletionPort, IsProcessorFeaturePresent, GetStdHandle, GetCurrentProcessId, WriteFileEx, SleepEx, GetExitCodeProcess, GetModuleHandleW, QueryPerformanceFrequency, GetProcAddress, HeapFree, HeapReAlloc, ReleaseMutex, FindNextFileW, FindClose, CreateFileW, GetFileInformationByHandle, GetFileInformationByHandleEx, FindFirstFileW, DeleteFileW, GetFinalPathNameByHandleW, CopyFileExW, CreateEventW, CancelIo, GetConsoleMode, FormatMessageW, GetModuleFileNameW, ExitProcess, CreateNamedPipeW, ReadFileEx, WaitForMultipleObjects, GetFullPathNameW, GetSystemDirectoryW, GetWindowsDirectoryW, CreateProcessW, GetFileAttributesW, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, MultiByteToWideChar, WriteConsoleW, WideCharToMultiByte, CreateThread, GetProcessHeap, HeapAlloc, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, SetHandleInformation, GetSystemTimeAsFileTime, InitializeSListHead, lstrlenW, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, DuplicateHandle, CreateWaitableTimerExW
                                                                ws2_32.dllsend, recv, shutdown, ioctlsocket, connect, bind, WSASocketW, getsockname, getpeername, getsockopt, setsockopt, WSAIoctl, WSAGetLastError, WSAStartup, WSACleanup, getaddrinfo, closesocket, WSASend, freeaddrinfo
                                                                user32.dllSystemParametersInfoW
                                                                shell32.dllSHGetKnownFolderPath
                                                                ole32.dllCoTaskMemFree
                                                                advapi32.dllRegOpenKeyExW, RegCloseKey, RegQueryValueExW, SystemFunction036
                                                                secur32.dllAcquireCredentialsHandleA, DeleteSecurityContext, DecryptMessage, QueryContextAttributesW, FreeContextBuffer, AcceptSecurityContext, InitializeSecurityContextW, ApplyControlToken, EncryptMessage, FreeCredentialsHandle
                                                                crypt32.dllCertDuplicateCertificateContext, CertVerifyCertificateChainPolicy, CertFreeCertificateContext, CertFreeCertificateChain, CertDuplicateCertificateChain, CertEnumCertificatesInStore, CertAddCertificateContextToStore, CertDuplicateStore, CertGetCertificateChain, CertCloseStore, CertOpenStore
                                                                ntdll.dllNtCancelIoFileEx, NtCreateFile, NtReadFile, NtDeviceIoControlFile, RtlNtStatusToDosError, NtWriteFile
                                                                bcrypt.dllBCryptGenRandom
                                                                VCRUNTIME140.dllmemcmp, __current_exception_context, memmove, __current_exception, memset, __CxxFrameHandler3, memcpy, _CxxThrowException, __C_specific_handler
                                                                api-ms-win-crt-math-l1-1-0.dllroundf, pow, round, exp2f, truncf, ceil, powf, __setusermatherr
                                                                api-ms-win-crt-runtime-l1-1-0.dll_crt_atexit, _initialize_narrow_environment, _get_initial_narrow_environment, _configure_narrow_argv, _set_app_type, _initterm, _initterm_e, _register_onexit_function, terminate, _initialize_onexit_table, exit, _exit, _seh_filter_exe, __p___argc, __p___argv, _cexit, _c_exit, _register_thread_local_exe_atexit_callback
                                                                api-ms-win-crt-stdio-l1-1-0.dll__p__commode, _set_fmode
                                                                api-ms-win-crt-locale-l1-1-0.dll_configthreadlocale
                                                                api-ms-win-crt-heap-l1-1-0.dllfree, _set_new_mode

                                                                Network Behavior

                                                                Network Port Distribution

                                                                TCP Packets

                                                                TimestampSource PortDest PortSource IPDest IP
                                                                Jan 7, 2025 06:15:46.111948013 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.111977100 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.112055063 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.121006966 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.121021986 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.672075987 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.672185898 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.685480118 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.685503006 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.685856104 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.735074997 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.735913038 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.779335022 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.829464912 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.829551935 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.829596043 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.829608917 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.829900980 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.829936981 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.829942942 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.829948902 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.829988956 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.830467939 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.830522060 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.830560923 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.830564022 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.830576897 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.830615044 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.831366062 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.843317986 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.843370914 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.843378067 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.891423941 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.916076899 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.916136980 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.916178942 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.916188002 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.916588068 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.916618109 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.916640997 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.916646957 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.916690111 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.916695118 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.917211056 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.917253017 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.917262077 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.917267084 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.917303085 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.917309999 CET44349704199.232.192.193192.168.2.5
                                                                Jan 7, 2025 06:15:46.917350054 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.917664051 CET49704443192.168.2.5199.232.192.193
                                                                Jan 7, 2025 06:15:46.917676926 CET44349704199.232.192.193192.168.2.5

                                                                UDP Packets

                                                                TimestampSource PortDest PortSource IPDest IP
                                                                Jan 7, 2025 06:15:46.096992016 CET5365153192.168.2.51.1.1.1
                                                                Jan 7, 2025 06:15:46.104598999 CET53536511.1.1.1192.168.2.5

                                                                DNS Queries

                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                Jan 7, 2025 06:15:46.096992016 CET192.168.2.51.1.1.10xb116Standard query (0)i.imgur.comA (IP address)IN (0x0001)false

                                                                DNS Answers

                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                Jan 7, 2025 06:15:46.104598999 CET1.1.1.1192.168.2.50xb116No error (0)i.imgur.comipv4.imgur.map.fastly.netCNAME (Canonical name)IN (0x0001)false
                                                                Jan 7, 2025 06:15:46.104598999 CET1.1.1.1192.168.2.50xb116No error (0)ipv4.imgur.map.fastly.net199.232.192.193A (IP address)IN (0x0001)false
                                                                Jan 7, 2025 06:15:46.104598999 CET1.1.1.1192.168.2.50xb116No error (0)ipv4.imgur.map.fastly.net199.232.196.193A (IP address)IN (0x0001)false

                                                                HTTP Request Dependency Graph

                                                                • i.imgur.com

                                                                HTTPS Proxied Packets

                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                0192.168.2.549704199.232.192.1934435732C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                TimestampBytes transferredDirectionData
                                                                2025-01-07 05:15:46 UTC62OUTGET /HCYQoVR.jpeg HTTP/1.1
                                                                accept: */*
                                                                host: i.imgur.com
                                                                2025-01-07 05:15:46 UTC761INHTTP/1.1 200 OK
                                                                Connection: close
                                                                Content-Length: 28864
                                                                Content-Type: image/jpeg
                                                                Last-Modified: Mon, 30 Dec 2024 19:23:51 GMT
                                                                ETag: "70f83e99427ac54b92283eaecb69c5df"
                                                                x-amz-server-side-encryption: AES256
                                                                X-Amz-Cf-Pop: IAD89-P1
                                                                X-Amz-Cf-Id: w1veLHWiaEcBL8caleHyCc4jlmIU2__N_q7NNoWzZBqTAalmsqn0vA==
                                                                cache-control: public, max-age=31536000
                                                                Accept-Ranges: bytes
                                                                Date: Tue, 07 Jan 2025 05:15:46 GMT
                                                                Age: 591509
                                                                X-Served-By: cache-iad-kjyo7100042-IAD, cache-ewr-kewr1740052-EWR
                                                                X-Cache: Miss from cloudfront, HIT, HIT
                                                                X-Cache-Hits: 41, 2
                                                                X-Timer: S1736226947.785473,VS0,VE0
                                                                Strict-Transport-Security: max-age=300
                                                                Access-Control-Allow-Methods: GET, OPTIONS
                                                                Access-Control-Allow-Origin: *
                                                                Server: cat factory 1.0
                                                                X-Content-Type-Options: nosniff
                                                                2025-01-07 05:15:46 UTC1371INData Raw: ff d8 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 02 04 02 b8 03 01 22 00 02 11 01 03 11 01 ff c4 00 1d 00 01 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 08 09 06 07 0a 05 04 02 03 ff c4 00 49 10 00 01 03 02 05 03 03 02 03 06 03 06 03 05 09 00 00 02 03 04 05 06 01 07 08 09 12 0a 13 22 11 14 32 23 42 15 21 52 16 31 33 41 62 72 24 43 82 17 34 51 53 61 63 19 25 73 18 44 92 93
                                                                Data Ascii: CC"I"2#B!R13Abr$C4QSac%sD
                                                                2025-01-07 05:15:46 UTC1371INData Raw: a2 55 8f 88 1a d4 13 43 74 ed 90 35 3f b4 3d bb 67 dc 3a 97 cd ac b0 ac 2a f7 9d 32 35 12 97 65 56 a7 c9 95 8a 62 b6 da 9e 79 69 97 06 3a 70 6d 3d e6 53 c9 2a 56 3c 9c 4f 89 0b c0 00 00 02 43 ed b5 b6 f6 7c ee 99 a8 c7 34 c7 a7 6a ed b1 4e ae 31 6f ca ad 3f 50 bb a6 c8 8f 09 a8 b1 d4 d3 6a e4 a8 f1 de 73 96 2a 79 b4 a7 c3 ee fb 4f bb 73 ad b0 f3 c3 6a 3c f6 a4 e9 e3 50 57 f5 95 5e af 56 2d 76 6b ed 2e c7 9f 32 4b 11 e2 bb 22 44 74 25 c5 4a 8b 1d 5d cc 55 19 cc 78 a5 2a f1 e3 e5 e4 04 6a 05 89 eb 17 a6 9b 5d 5a 19 d1 8d 63 5c 59 df 9b 19 4c 9b 62 87 06 9e fc da 3d 2a bd 54 76 a9 ca 64 88 f1 da 65 2d aa 9c 96 54 e2 5c 90 8e 5f 57 8a 78 ab c9 5c 7f 3a ec 00 00 00 00 00 01 23 76 d4 db 1b 53 5b a8 e7 a4 ac 86 d3 23 34 36 27 52 e8 8e 55 ab 35 ab a2 6b d1 a9 d4
                                                                Data Ascii: UCt5?=g:*25eVbyi:pm=S*V<OC|4jN1o?Pjs*yOsj<PW^V-vk.2K"Dt%J]Ux*j]Zc\YLb=*Tvde-T\_Wx\:#vS[#46'RU5k
                                                                2025-01-07 05:15:46 UTC1371INData Raw: 1c 85 c7 5c 97 54 a7 1f e2 b7 b9 27 b9 8a 94 9e e7 1e 5c 78 a5 3c e6 6e 63 4c b6 e8 7b 8e 67 fd 0a cd 8c cc 7a 3c 3c ec ba d8 a4 b1 1b 0f 46 9b 8a 8a c4 a4 b4 94 7f 4e 09 c1 3e 80 62 1a 61 d3 bd fd ab 4d 43 d9 3a 67 ca e5 42 45 c1 7d dc 90 e8 b4 a7 aa 4e ad 11 a3 b9 21 c4 b7 de 7d 4d a5 6a 4b 2d f2 c5 6b 52 52 a5 71 4a b8 a5 58 f8 93 e3 39 3a 4e f7 44 ca 5c c6 b1 72 ae 9b 54 cb 4b c2 ab 7d 4c 94 dc 7f d9 4b 82 76 2d 52 22 c6 4b 4a 7e 74 e7 25 c1 8e 96 63 a3 bc d2 7d 53 dc 71 4a 71 29 4b 6a 52 92 93 cc e9 42 c8 c7 b3 8b 79 5b 32 e5 71 cf 48 f9 79 6d 56 6e 69 6d e2 9f 5e e6 18 46 f6 0d e1 ff 00 4e 2f 4f 65 5f e9 2c 53 aa ff 00 79 8d 45 e9 32 ef b4 f4 29 a4 6c c6 a9 d9 75 9a d5 b5 fb 41 7b dd b4 45 a9 8a 82 22 bc f3 8c c4 87 16 4a 55 ce 32 95 8c 77 dc 71 4d
                                                                Data Ascii: \T'\x<ncL{gz<<FN>baMC:gBE}N!}MjK-kRRqJX9:ND\rTK}LKv-R"KJ~t%c}SqJq)KjRBy[2qHymVnim^FN/Oe_,SyE2)luA{E"JU2wqM
                                                                2025-01-07 05:15:46 UTC1371INData Raw: 6a 90 69 c8 b3 99 b8 5f 7e b6 d4 a9 29 52 d2 ca 90 98 be db 15 25 2d b8 a5 60 99 0a e2 96 d5 f2 f4 3a 3f cc 9c ef a1 ec 9f b2 4d 12 f7 bb 29 0d d5 a6 65 26 52 d1 28 b1 29 98 f2 69 35 4a d7 b6 8f 0d a6 d5 c5 3c 92 87 25 2f 93 8a f9 25 3d c5 7f 23 99 0d 7f ef 65 b8 0e e6 76 13 79 55 aa dc c9 a4 54 ed a8 77 62 6e 1a 3d 16 95 6d 45 82 dd 3a 4a 63 bd 1d 2d b6 b6 93 dc 71 b4 b6 fb bf c6 5b 8a f2 f9 01 11 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e 9c 76 09 d6 ae df 1a 01 d9 46 83 1f 30 f5 8d 93 b4 cb e9 e8 55 db b6 e0 b4 55 98 b4 b4 d5 1c 94 b7 9e c6 34 75 c5 ef 25 e5 4a 54 56 22 37 db e3 dc e5 c5 1f a4 e6 38 01 64 fd
                                                                Data Ascii: ji_~)R%-`:?M)e&R()i5J<%/%=#evyUTwbn=mE:Jc-q[vF0UU4u%JTV"78d
                                                                2025-01-07 05:15:46 UTC1371INData Raw: 4e b0 ab 7b 2f 5e af 52 e8 a8 a6 23 17 1c 5d 0e d3 6a 67 27 11 8a 98 4a 9c 71 ce db d2 5f 57 6d 2a 57 71 e5 76 f0 f8 a4 b7 bc dc db 47 a4 cb 55 d9 87 1f 51 94 7d 74 d8 56 0c 79 cf fb fa 8d a5 69 e7 55 22 8d 06 72 95 c5 6a 4b 90 66 a5 52 22 27 d3 fc b8 fe df 8f 25 78 a5 5f 10 9b fb 19 e4 9e dd b9 23 a6 ab 92 df db 42 35 52 af 64 33 79 3b 06 7e 63 d6 a4 f7 df bc 2a 11 d9 6d 2f 4a 6d de db 69 76 3b 6a 57 65 2b 69 b6 d9 52 9b 77 b6 9f de a5 51 66 50 6f 41 6f e9 c3 a8 df 32 37 02 bc 5d c2 ab 60 dc d7 95 6a da ad c9 a2 a3 17 dc 5d b7 dc 4c 58 52 98 f2 fa 8a 42 61 c0 79 5f bf 9a 5b 5a 52 9f 24 f1 9d 1b 99 75 04 6d fb a0 cd 11 bd b7 f6 cf 95 5a 55 56 b6 dd 09 da 0d 22 ad 69 a1 c5 d1 ad 58 af 60 ae f4 a6 e5 ab fd f6 62 bb 8b 52 54 da 9c 4f 79 6a 71 c7 31 52 78 39
                                                                Data Ascii: N{/^R#]jg'Jq_Wm*WqvGUQ}tVyiU"rjKfR"'%x_#B5Rd3y;~c*m/Jmiv;jWe+iRwQfPoAo27]`j]LXRBay_[ZR$umZUV"iX`bRTOyjq1Rx9
                                                                2025-01-07 05:15:46 UTC1371INData Raw: ae 5d bf 2f 15 25 5a 1f 79 7d 20 e9 df 41 1b 86 5e ba 43 d3 45 c1 75 d5 a8 36 5b 34 f6 24 54 af 2a 84 59 32 9e 9a f4 36 65 3b e8 a8 cc 32 df 6d 3d f4 b7 c7 b7 cb 93 6a 02 2a 03 d6 b3 2d 4b 8a fd bb 29 76 3d a1 4a 5c ea ad 6a a2 cc 0a 5c 26 d4 9c 15 22 43 ce 25 b6 db 4f 2f cb 92 94 a4 a7 ff 00 d4 ba 2d ed fa 73 f6 f1 da df 6f 4a 96 a5 ec 8c ee cd 29 f7 c2 ab 74 aa 35 bb 02 e6 b8 29 6b a7 4d 99 21 dc 14 fa 7b 4c d3 59 79 7e 91 5a 96 e2 52 97 30 c5 3d be 58 f2 c1 2a 4a 82 91 c0 00 00 00 01 b7 b4 1b a6 99 3a c9 d6 8e 57 69 71 9c 26 60 cd ef 7b d3 e9 55 47 e9 ee b6 db f1 e0 b9 21 3e ee 43 6a 71 2a 4f 26 e3 f7 9c f2 4a bf 87 f1 57 c4 b1 0e a2 2d 8f 34 17 b4 56 46 65 fd d1 90 19 b5 99 55 7b c6 f6 bb 1f 88 9a 5d ef 5d a6 c8 63 1a 64 58 aa 54 97 9b 6e 3c 18 ee 77
                                                                Data Ascii: ]/%Zy} A^CEu6[4$T*Y26e;2m=j*-K)v=J\j\&"C%O/-soJ)t5)kM!{LYy~ZR0=X*J:Wiq&`{UG!>Cjq*O&JW-4VFeU{]]cdXTn<w
                                                                2025-01-07 05:15:46 UTC1371INData Raw: 2e 1b b2 24 c9 75 2d 47 8e c3 78 ad c7 16 ac 70 4a 52 94 e1 f2 56 38 ff 00 20 3b 49 db 53 49 ba 1d db 0f 42 df b3 da 66 ce 56 2a 59 59 8b b3 2f 09 f9 91 71 dc d0 1f 62 63 2e b6 95 39 50 7a 7c 66 d9 8a a6 51 1d 86 d3 dd e2 94 a5 a6 53 c9 5e 3c 8a 67 b8 36 49 da ff 00 56 db ba 58 1a 7a d2 9e bc ee ec d4 a4 5d 96 dd cb 7d 67 75 e7 44 cc 4a 15 5e 64 37 12 e2 53 17 db 49 83 07 db b3 21 c9 8f 72 71 0e 25 c5 76 d4 95 27 06 fd 53 8a ac 3b 7c 39 8c ed f9 d3 a7 5e c8 eb 19 d6 a2 2e 15 81 6e 65 dd 31 0f 2b 97 26 56 a8 b0 e4 a7 d7 d7 c9 4a 86 89 3e 5f ab cb 1e 5f 99 05 ba 22 72 2a 2c fc cb cf 6d 4b d4 68 e9 c5 da 55 0e 93 6c 52 2a 38 e3 f9 f1 94 f3 d2 a5 b6 9c 3f fd a4 25 2b fb 93 fd 40 46 4e a8 2d 32 5b 3a 32 d4 3e 59 e9 d6 91 ac 5c f9 cd 99 c8 b2 5d ad cd 56 76 66
                                                                Data Ascii: .$u-GxpJRV8 ;ISIBfV*YY/qbc.9Pz|fQS^<g6IVXz]}guDJ^d7SI!rq%v'S;|9^.ne1+&VJ>__"r*,mKhUlR*8?%+@FN-2[:2>Y\]Vvf
                                                                2025-01-07 05:15:46 UTC1371INData Raw: 61 ac 70 6d aa b5 d7 5b a7 fd fe 4a 6a 1c 27 3f a5 3e 35 04 ff 00 d7 fd 25 03 16 49 d5 6b 9e 92 73 9b 79 7b de db 4b 7f e1 32 f2 dd a3 db 10 1c e5 8e 3c d2 98 b8 4e 7b 1f 4c 70 f1 f4 91 3d f4 ff 00 a7 97 dc 56 d8 16 91 b2 c7 4d 4e 68 ee 5b 97 ec ea 87 3f b3 12 46 5c e5 1b b2 1d 45 2e 44 38 69 76 ab 70 25 95 29 2e b9 1b b9 f4 e3 47 4a 92 a4 fb 87 12 e7 aa 9b 52 52 da b0 f2 27 2c 6e 91 cd a7 75 0b 97 d7 0a 34 59 b8 6d e1 5c b8 68 92 9c a6 cc aa 35 74 d0 ae 1a 7d 36 a6 94 f9 47 96 c4 08 ac b8 da d3 f7 36 a7 92 a4 e0 a2 7f ee 31 52 d1 46 85 f6 95 7e c5 d4 5e 4c de 97 4e 46 db f6 ed 22 d7 ac db 99 65 50 5c 69 4a a6 f2 66 3b 3c 9e 6a 6c 37 3d ba 94 96 d0 e7 17 b0 ee 25 dc 52 a4 a9 2a 52 4a b2 b3 3a 92 b4 8d a5 ac 8d b9 72 bb 64 3d a6 eb b4 67 9b a5 c8 ab dc 15
                                                                Data Ascii: apm[Jj'?>5%Iksy{K2<N{Lp=VMNh[?F\E.D8ivp%).GJRR',nu4Ym\h5t}6G61RF~^LNF"eP\iJf;<jl7=%R*RJ:rd=g
                                                                2025-01-07 05:15:46 UTC1371INData Raw: bf 61 1d 31 d6 f7 53 cd cd 00 ee 27 a9 e8 b4 69 59 65 2a 9a c5 9d 4b a1 dc b4 fa 54 eb e2 44 ce 33 22 e2 c3 13 52 f3 8f 36 a8 3e 8e 3d 1d 94 a9 c6 d5 21 b4 f7 3c 7c a4 bf 44 fe 99 73 56 8a f6 70 6a d6 bd 42 99 06 d0 ad 40 81 6e db f2 de 47 16 aa d2 9a 79 c7 a4 a9 bf 5f 92 59 fa 48 e5 87 8f 27 54 9f 92 55 c7 dc d3 f5 46 d3 d7 77 59 05 eb 99 36 cd 4a 3d 42 89 92 d6 dc bf 6c f4 54 7a a1 e7 a0 53 a3 d1 df c1 cc 71 f9 76 ea 13 de e2 a4 f1 fe 0b 7f 2f b8 2c 93 78 8c 9f d0 1e a4 b4 cd 0f 4b ba fe d6 2d 3f 27 2d 8b 92 b2 cc d8 72 5c bf a8 f4 09 15 65 41 52 55 8b 2d ae a8 db 8d ba db 6a 75 97 16 96 d3 c9 2a ed f9 27 d7 cb 9f 5d bb 3a 79 6e 2d cf 75 37 99 93 32 1b 34 5f b7 b4 ed 64 66 1d 46 8d 46 cc 7a c6 0d d4 66 d7 22 b3 25 58 30 98 b8 32 96 59 90 f2 a3 f6 5c 71
                                                                Data Ascii: a1S'iYe*KTD3"R6>=!<|DsVpjB@nGy_YH'TUFwY6J=BlTzSqv/,xK-?'-r\eARU-ju*']:yn-u724_dfFFzf"%X02Y\q
                                                                2025-01-07 05:15:46 UTC1371INData Raw: c9 c8 df 97 15 7d 4a 11 3a 0d e8 86 c8 d9 b1 ed 8c f8 d4 b5 42 0b 58 b1 36 7d 1a d9 a4 c8 f4 f3 4a 99 44 89 52 d3 fd b8 f7 e1 7f f0 ff 00 d0 09 31 d4 a1 92 1b 60 ea 3f 29 26 d6 f5 7f ad e5 5b 17 f6 4f 58 75 ca d5 8d 95 54 5c cc a2 d3 a6 d6 a6 48 8e 97 18 4a e0 cb 65 e9 0f 29 e7 22 32 d3 6a 6f 8f 8a 95 c4 83 f9 f9 d3 4d a1 8d 32 ec bf 27 70 2c e5 cd 7c d5 a5 e6 35 3f 27 29 f5 e9 b4 47 2b f4 b4 d2 d9 b8 a6 47 65 2c c1 52 30 a7 a9 cc 59 f7 92 5b 67 8e 0f 72 57 af f1 3e e2 21 ee 9d 54 8d b8 7f 51 6d d9 96 88 ac 49 f6 37 46 79 52 72 f1 87 b9 62 af 6e 88 f2 22 d1 56 a6 bf e0 9e e3 4e 38 9e 3f 2e 5c be e2 e2 fa c2 f3 8f fd 95 6d 39 4c ca 4a 2c 54 60 9b f3 32 69 54 97 9a 4e 3c 70 66 1c 56 64 4e f5 4f e5 fc 9d 89 19 3c 7f e0 a5 7e 90 2a 97 a7 4f 64 ac 8a dd ee b3
                                                                Data Ascii: }J:BX6}JDR1`?)&[OXuT\HJe)"2joM2'p,|5?')G+Ge,R0Y[grW>!TQmI7FyRrbn"VN8?.\m9LJ,T`2iTN<pfVdNO<~*Od


                                                                Statistics

                                                                CPU Usage

                                                                Click to jump to process

                                                                Memory Usage

                                                                Click to jump to process

                                                                High Level Behavior Distribution

                                                                Click to dive into process behavior distribution

                                                                Behavior

                                                                Click to jump to process

                                                                System Behavior

                                                                General

                                                                Target ID:0
                                                                Start time:00:15:34
                                                                Start date:07/01/2025
                                                                Path:C:\Users\user\Desktop\setup-avast-premium-x64.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:"C:\Users\user\Desktop\setup-avast-premium-x64.exe"
                                                                Imagebase:0x7ff6a6c20000
                                                                File size:5'485'056 bytes
                                                                MD5 hash:E099255EA4AA8EB41E26E5D94737FC26
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:low
                                                                Has exited:true

                                                                General

                                                                Target ID:1
                                                                Start time:00:15:34
                                                                Start date:07/01/2025
                                                                Path:C:\Windows\System32\conhost.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                Imagebase:0x7ff6d64d0000
                                                                File size:862'208 bytes
                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:high
                                                                Has exited:true

                                                                General

                                                                Target ID:2
                                                                Start time:00:15:35
                                                                Start date:07/01/2025
                                                                Path:C:\Windows\System32\net.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:"net" session
                                                                Imagebase:0x7ff7dacb0000
                                                                File size:59'904 bytes
                                                                MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:high
                                                                Has exited:true

                                                                General

                                                                Target ID:3
                                                                Start time:00:15:35
                                                                Start date:07/01/2025
                                                                Path:C:\Windows\System32\net1.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:C:\Windows\system32\net1 session
                                                                Imagebase:0x7ff76e520000
                                                                File size:183'808 bytes
                                                                MD5 hash:55693DF2BB3CBE2899DFDDF18B4EB8C9
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:moderate
                                                                Has exited:true

                                                                General

                                                                Target ID:4
                                                                Start time:00:15:35
                                                                Start date:07/01/2025
                                                                Path:C:\Windows\System32\tasklist.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:"tasklist" /fi "IMAGENAME eq vmware"
                                                                Imagebase:0x7ff6c9c50000
                                                                File size:106'496 bytes
                                                                MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:moderate
                                                                Has exited:true

                                                                General

                                                                Target ID:6
                                                                Start time:00:15:35
                                                                Start date:07/01/2025
                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:"powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
                                                                Imagebase:0x7ff7be880000
                                                                File size:452'608 bytes
                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:high
                                                                Has exited:true

                                                                General

                                                                Target ID:7
                                                                Start time:00:15:35
                                                                Start date:07/01/2025
                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:"powershell" -Command "wevtutil sl Security /e:false"
                                                                Imagebase:0x7ff7be880000
                                                                File size:452'608 bytes
                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:high
                                                                Has exited:true

                                                                General

                                                                Target ID:8
                                                                Start time:00:15:35
                                                                Start date:07/01/2025
                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:"powershell" -Command "wevtutil sl Application /e:false"
                                                                Imagebase:0x7ff7be880000
                                                                File size:452'608 bytes
                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:high
                                                                Has exited:true

                                                                General

                                                                Target ID:9
                                                                Start time:00:15:35
                                                                Start date:07/01/2025
                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:"powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"
                                                                Imagebase:0x7ff7be880000
                                                                File size:452'608 bytes
                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:high
                                                                Has exited:true

                                                                General

                                                                Target ID:10
                                                                Start time:00:15:37
                                                                Start date:07/01/2025
                                                                Path:C:\Windows\System32\wevtutil.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:"C:\Windows\system32\wevtutil.exe" sl Application /e:false
                                                                Imagebase:0x7ff6498b0000
                                                                File size:278'016 bytes
                                                                MD5 hash:1AAE26BD68B911D0420626A27070EB8D
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:moderate
                                                                Has exited:true

                                                                General

                                                                Target ID:11
                                                                Start time:00:15:37
                                                                Start date:07/01/2025
                                                                Path:C:\Windows\System32\wevtutil.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:"C:\Windows\system32\wevtutil.exe" sl Security /e:false
                                                                Imagebase:0x7ff6498b0000
                                                                File size:278'016 bytes
                                                                MD5 hash:1AAE26BD68B911D0420626A27070EB8D
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Has exited:true

                                                                General

                                                                Target ID:12
                                                                Start time:00:15:39
                                                                Start date:07/01/2025
                                                                Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                Imagebase:0x7ff6ef0c0000
                                                                File size:496'640 bytes
                                                                MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                Has elevated privileges:true
                                                                Has administrator privileges:false
                                                                Programmed in:C, C++ or other language
                                                                Has exited:true

                                                                Disassembly

                                                                Reset < >

                                                                  Non-executed Functions

                                                                  Function 00007FF6A6F8B7B8 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.2192569168.00007FF6A6C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A6C20000, based on PE: true
                                                                  • Associated: 00000000.00000002.2192550784.00007FF6A6C20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.2192752865.00007FF6A6F9E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.2192752865.00007FF6A703D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.2192752865.00007FF6A704C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.2192752865.00007FF6A7059000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.2192752865.00007FF6A7079000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.2192890012.00007FF6A712A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.2192903341.00007FF6A712B000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.2192916348.00007FF6A712C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.2192928928.00007FF6A712E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_7ff6a6c20000_setup-avast-premium-x64.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                  • String ID:
                                                                  • API String ID: 2933794660-0
                                                                  • Opcode ID: eaa2e2806d0817fad0b552ccf9bef788826787fd9c98dcef92834be61a6c05dc
                                                                  • Instruction ID: 63ba608e24b90990dd3180bbf2e53a304730142edf37648b9e676860ed292248
                                                                  • Opcode Fuzzy Hash: eaa2e2806d0817fad0b552ccf9bef788826787fd9c98dcef92834be61a6c05dc
                                                                  • Instruction Fuzzy Hash: 0B118E22B15F068AEB10CF70E8446B833A4FB59B58F440E31EA6D877A8DF3CD1558380

                                                                  Executed Functions

                                                                  Function 00007FF848F333B5 Relevance: .0, Instructions: 49COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000009.00000002.2193636914.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_9_2_7ff848f30000_powershell.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
                                                                  • Instruction ID: 1fde1e7c06bd8ad01fde8fdacf519f27676798cf7977af127a8e772823c5939c
                                                                  • Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
                                                                  • Instruction Fuzzy Hash: 9501677111CB0C4FD744EF0CE451AA5B7E0FB95364F10056EE58AC3695DB36E882CB45