After the malware is downloaded and files verified, the script will check in the C:\Program Files\ directory for the presence Avast antivirus, which happens to be the most common installed AV worldwide