Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\temp\asw.1654cc968887ead9\ecoo.edat
- %ALLUSERSPROFILE%\application data\avast software\persistent data\avast\logs\event_manager.log.tmp.5aafaf13-afcf-4900-aeeb-4ff499b1d08b
- %ALLUSERSPROFILE%\application data\avast software\persistent data\avast\logs\event_manager.log
- %TEMP%\_av_iup.tm~a00484\servers.def.lkg
- %TEMP%\_av_iup.tm~a00484\uat_1296.dll
- %TEMP%\_av_iup.tm~a00484\avbugreport_ais-934.vpx
- %TEMP%\_av_iup.tm~a00484\avdump_x64_ais-934.vpx
- %TEMP%\_av_iup.tm~a00484\avdump_x86_ais-934.vpx
- %TEMP%\_av_iup.tm~a00484\offertool_ais-934.vpx
- %TEMP%\_av_iup.tm~a00484\new_12080934\instup.dll
- %TEMP%\_av_iup.tm~a00484\new_12080934\instup.exe
- %TEMP%\_av_iup.tm~a00484\new_12080934\htmlayout.dll
- %TEMP%\_av_iup.tm~a00484\new_12080934\aswoffertool.exe
- %TEMP%\_av_iup.tm~a00484\new_12080934\avbugreport.exe
- %TEMP%\_av_iup.tm~a00484\new_12080934\avdump32.exe
- %TEMP%\_av_iup.tm~a00484\new_12080934\avdump64.exe
- %TEMP%\_av_iup.tm~a00484\uat_1928.dll
- %TEMP%\_av_iup.tm~a00484\part-jrog2-27.vpx
- %TEMP%\_av_iup.tm~a00484\part-vps_win32-20112905.vpx
- %TEMP%\_av_iup.tm~a00484\products.def
- %TEMP%\_av_iup.tm~a00484\config.def.new
- %TEMP%\_av_iup.tm~a00484\new_12080934\gtapi_1619876583500.dll
- %ALLUSERSPROFILE%\application data\avast software\persistent data\avast\logs\setup.log
- %TEMP%\_av_iup.tm~a00484\instup.dll
- %WINDIR%\temp\asw.1654cc968887ead9\avast_free_antivirus_setup_online.exe
- %ALLUSERSPROFILE%\application data\avast software\persistent data\avast\logs\setup.log.tmp.6673c3d6-0783-45bd-bcba-df373b5fce04
- \setup.log
- %TEMP%\_av_iup.tm~a00484\servers.def
- %TEMP%\_av_iup.tm~a00484\uat.vpx
- %TEMP%\_av_iup.tm~a00484\servers.def.vpx
- %TEMP%\_av_iup.tm~a00484\prod-vps.vpx
- %TEMP%\_av_iup.tm~a00484\prod-pgm.vpx
- %TEMP%\_av_iup.tm~a00484\part-vps_win32-18111504.vpx
- %TEMP%\_av_iup.tm~a00484\part-setup_ais-12080934.vpx
- %TEMP%\_av_iup.tm~a00484\part-prg_ais-12080934.vpx
- %TEMP%\_av_iup.tm~a00484\part-jrog2-1901.vpx
- %TEMP%\_av_iup.tm~a00484\part-iex-c.vpx
- %TEMP%\_av_iup.tm~a00484\config.def.vpx
- %TEMP%\_av_iup.tm~a00484\config.def
- %TEMP%\_av_iup.tm~a00484\instup.exe
- %TEMP%\_av_iup.tm~a00484\instcont_ais-934.vpx
- %TEMP%\_av_iup.tm~a00484\htmlayout.dll
- %TEMP%\_av_iup.tm~a00484\setgui_ais-934.vpx
- %TEMP%\_av_iup.tm~a00484\instup_ais-934.vpx
- %TEMP%\_av_iup.tm~a00484\new_12080934\gcapi_16198765842440.dll
Удаляет следующие файлы
- %TEMP%\_av_iup.tm~a00484\uat_1296.dll
- %TEMP%\_av_iup.tm~a00484\uat_1928.dll
- %TEMP%\_av_iup.tm~a00484\new_12080934\gtapi_1619876583500.dll
- %TEMP%\_av_iup.tm~a00484\new_12080934\gcapi_16198765842440.dll
Перемещает следующие файлы
- %ALLUSERSPROFILE%\application data\avast software\persistent data\avast\logs\setup.log.tmp.6673c3d6-0783-45bd-bcba-df373b5fce04 в \setup.log
- %TEMP%\_av_iup.tm~a00484\config.def.new в %TEMP%\_av_iup.tm~a00484\config.def
- %ALLUSERSPROFILE%\application data\avast software\persistent data\avast\logs\event_manager.log.tmp.5aafaf13-afcf-4900-aeeb-4ff499b1d08b в \event_manager.log
Подменяет следующие файлы
- %TEMP%\_av_iup.tm~a00484\uat_1928.dll
- %TEMP%\_av_iup.tm~a00484\config.def.new
Изменяет файл HOSTS.
Сетевая активность
Подключается к
- 'v7#####.stats.avast.com':80
- 'go#####analytics.com':80
- 'ia####.u.avast.com':443
- 'ia####.u.avast.com':80
- 'sh#####d.ff.avast.com':80
- 't1######.iavs9x.u.avast.com':80
- 'r9######.iavs9x.u.avast.com':80
- 'z4######.iavs9x.u.avast.com':80
- 's9######.iavs9x.u.avast.com':80
- 't1######.#psnitrotiny.u.avast.com':80
- 'al########nse-dealer.ff.avast.com':443
- 'al#####qs.ff.avast.com':443
- 'ss#.####le-analytics.com':443
- 'ip######ider.ff.avast.com':443
- 'ip####.avast.com':443
- 'an#####cs.ff.avast.com':443
TCP
Запросы HTTP GET
- http://g7######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://n8######.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
- http://n8######.iavs9x.u.avast.com/iavs9x/uat.vpx
- http://n8######.iavs9x.u.avast.com/iavs9x/avbugreport_ais-934.vpx
- http://n8######.iavs9x.u.avast.com/iavs9x/avdump_x64_ais-934.vpx
- http://n8######.iavs9x.u.avast.com/iavs9x/avdump_x86_ais-934.vpx
- http://n8######.iavs9x.u.avast.com/iavs9x/offertool_ais-934.vpx
- http://p9######.iavs9x.u.avast.com/iavs9x-xp/servers.def.vpx
- http://k7######.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
- http://r6######.#psnitrotiny.u.avast.com/vpsnitrotiny/prod-vps.vpx
- http://r6######.#psnitrotiny.u.avast.com/vpsnitrotiny/part-jrog2-27.vpx
- http://r6######.#psnitrotiny.u.avast.com/vpsnitrotiny/part-vps_win32-20112905.vpx
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
Запросы HTTP POST
- http://www.go#####analytics.com/collect
- http://v7#####.stats.avast.com/cgi-bin/iavsevents.cgi
UDP
- DNS ASK v7#####.stats.avast.com
- DNS ASK z4######.iavs9x.u.avast.com
- DNS ASK f0######.iavs9x.u.avast.com
- DNS ASK k7######.iavs9x.u.avast.com
- DNS ASK s9######.iavs9x.u.avast.com
- DNS ASK d1######.#psnitrotiny.u.avast.com
- DNS ASK m4######.#psnitrotiny.u.avast.com
- DNS ASK s-######rotiny.avcdn.net
- DNS ASK ip####.avast.com
- DNS ASK s6######.#psnitrotiny.u.avast.com
- DNS ASK t1######.#psnitrotiny.u.avast.com
- DNS ASK al########nse-dealer.ff.avast.com
- DNS ASK al#####qs.ff.avast.com
- DNS ASK ss#.####le-analytics.com
- DNS ASK ip######ider.ff.avast.com
- DNS ASK r6######.iavs9x.u.avast.com
- DNS ASK r6######.#psnitrotiny.u.avast.com
- DNS ASK p9######.iavs9x.u.avast.com
- DNS ASK s-####9x.avcdn.net
- DNS ASK go#####analytics.com
- DNS ASK ia####.u.avast.com
- DNS ASK sh#####d.ff.avast.com
- DNS ASK g7######.iavs9x.u.avast.com
- DNS ASK j6######.iavs9x.u.avast.com
- DNS ASK l9######.iavs9x.u.avast.com
- DNS ASK s6######.iavs9x.u.avast.com
- DNS ASK c3######.iavs9x.u.avast.com
- DNS ASK t1######.iavs9x.u.avast.com
- DNS ASK m0######.iavs9x.u.avast.com
- DNS ASK n4######.iavs9x.u.avast.com
- DNS ASK n8######.iavs9x.u.avast.com
- DNS ASK p1######.iavs9x.u.avast.com
- DNS ASK r9######.iavs9x.u.avast.com
- DNS ASK n2######.iavs9x.u.avast.com
- DNS ASK an#####cs.ff.avast.com
Другое
Создает и запускает на исполнение
- '%WINDIR%\temp\asw.1654cc968887ead9\avast_free_antivirus_setup_online.exe' /cookie:mmm_ava_012_999_f5d_m /ga_clientid:57c6d129-14bc-4783-80c0-f628d33f0fb4 /edat_dir:%WINDIR%\Temp\asw.1654cc968887ead9
- '%TEMP%\_av_iup.tm~a00484\instup.exe' /edition:1 /ga_clientid:57c6d129-14bc-4783-80c0-f628d33f0fb4 /guid:f341a450-d07d-41ae-8c00-1e5e5e65c650 /prod:ais /sfx:lite /sfxstorage:C:\DOCUME~1\user\LOCALS~1\Temp\_av_iup.tm~a00484 /cookie:...
- '%TEMP%\_av_iup.tm~a00484\new_12080934\instup.exe' /cookie:mmm_ava_012_999_f5d_m /edat_dir:%WINDIR%\Temp\asw.1654cc968887ead9 /edition:1 /ga_clientid:57c6d129-14bc-4783-80c0-f628d33f0fb4 /guid:f341a450-d07d-41ae-8c00-1e5e5e65c650 /online_instal...
- '%TEMP%\_av_iup.tm~a00484\new_12080934\aswoffertool.exe' -checkGToolbar -elevated
- '%TEMP%\_av_iup.tm~a00484\new_12080934\aswoffertool.exe' /check_secure_browser
- '%TEMP%\_av_iup.tm~a00484\new_12080934\aswoffertool.exe' -checkChromeReactivation -elevated -bc=AVFA
