Technical Information
Modifies file system
Creates the following files
- %WINDIR%\temp\asw.e0f09fb963ec93cd\ecoo.edat
- %WINDIR%\temp\asw.be0a7253934b9a34\setup.def
- %WINDIR%\temp\asw.be0a7253934b9a34\stats.ini.tmp
- %WINDIR%\temp\asw.be0a7253934b9a34\avbugreport_x64_ais-991.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\avdump_x64_ais-991.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\avdump_x86_ais-991.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\offertool_x64_ais-991.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\sbr_x64_ais-991.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\asweaf6bd1639c645de.tmp
- %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\asw3b2bcc00b5061fe1.tmp
- %WINDIR%\temp\asw.be0a7253934b9a34\servers.def.lkg
- %WINDIR%\temp\asw.be0a7253934b9a34\uat_1712.dll
- %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\asw1f9eb33c791790ad.tmp
- %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\aswc072620e04f7d9c4.tmp
- %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\asw2bf2886b01955c0a.tmp
- %WINDIR%\temp\asw.be0a7253934b9a34\uat_1676.dll
- %WINDIR%\temp\asw.be0a7253934b9a34\program.def
- %WINDIR%\temp\asw.be0a7253934b9a34\part-jrog2-19.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\part-vps_windows-21021799.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\vps.def
- %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\gcapi_16136457252596.dll
- %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\gcapi_1613645725188.dll
- %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\asw4c5d45ef028e6ff1.tmp
- %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\aswfc37fd766089f98d.tmp
- %ALLUSERSPROFILE%\avast software\persistent data\avast\logs\event_manager.log
- %ALLUSERSPROFILE%\avast software\persistent data\avast\logs\event_manager.log.tmp.d5833819-8a5f-4310-a747-c19d99bd8af2
- %WINDIR%\temp\asw.be0a7253934b9a34\config.ini
- %ALLUSERSPROFILE%\avast software\persistent data\avast\logs\setup.log.tmp.20b5df4a-ba3f-44c3-a0fe-7499f9a9bcf9
- %ALLUSERSPROFILE%\avast software\persistent data\avast\logs\setup.log
- %WINDIR%\temp\asw.be0a7253934b9a34\servers.def
- %WINDIR%\temp\asw.be0a7253934b9a34\config.def
- %WINDIR%\temp\asw.be0a7253934b9a34\config.def.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\instup.exe
- %WINDIR%\temp\asw.be0a7253934b9a34\instcont_x64_ais-991.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\instup.dll
- %WINDIR%\temp\asw.be0a7253934b9a34\instup_x64_ais-991.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\part-jrog2-80e.vpx
- %WINDIR%\temp\asw.e0f09fb963ec93cd\avast_free_antivirus_setup_online_x64.exe
- %WINDIR%\temp\asw.be0a7253934b9a34\part-prg_ais-15010991.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\part-vps_windows-21020702.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\prod-pgm.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\prod-vps.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\servers.def.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\htmlayout.dll
- %WINDIR%\temp\asw.be0a7253934b9a34\setgui_x64_ais-991.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\uat.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\uat64.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\uata64.vpx
- %WINDIR%\temp\asw.be0a7253934b9a34\config.def.new
- %WINDIR%\temp\asw.be0a7253934b9a34\part-setup_ais-15010991.vpx
- C:\users\public\documents\aswoffertool.exe
- C:\users\public\documents\gcapi_1613645725228.dll
Deletes the following files
- %WINDIR%\temp\asw.be0a7253934b9a34\uat_1712.dll
- %WINDIR%\temp\asw.be0a7253934b9a34\uat_1676.dll
- %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\gcapi_16136457252596.dll
- C:\users\public\documents\gcapi_1613645725228.dll
- C:\users\public\documents\aswoffertool.exe
- %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\gcapi_1613645725188.dll
Moves the following files
- from %ALLUSERSPROFILE%\avast software\persistent data\avast\logs\setup.log.tmp.20b5df4a-ba3f-44c3-a0fe-7499f9a9bcf9 to %ALLUSERSPROFILE%\avast software\persistent data\avast\logs\setup.log
- from %WINDIR%\temp\asw.e0f09fb963ec93cd\ecoo.edat to %WINDIR%\temp\asw.be0a7253934b9a34\cookie.bin
- from %WINDIR%\temp\asw.be0a7253934b9a34\config.def.new to %WINDIR%\temp\asw.be0a7253934b9a34\config.def
- from %ALLUSERSPROFILE%\avast software\persistent data\avast\logs\event_manager.log.tmp.d5833819-8a5f-4310-a747-c19d99bd8af2 to %ALLUSERSPROFILE%\avast software\persistent data\avast\logs\event_manager.log
- from %WINDIR%\temp\asw.be0a7253934b9a34\stats.ini.tmp to %WINDIR%\temp\asw.be0a7253934b9a34\stats.ini
- from %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\asweaf6bd1639c645de.tmp to %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\avbugreport.exe
- from %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\asw3b2bcc00b5061fe1.tmp to %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\avdump.exe
- from %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\asw1f9eb33c791790ad.tmp to %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\instup.exe
- from %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\asw4c5d45ef028e6ff1.tmp to %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\instup.dll
- from %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\aswfc37fd766089f98d.tmp to %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\aswoffertool.exe
- from %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\aswc072620e04f7d9c4.tmp to %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\sbr.exe
- from %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\asw2bf2886b01955c0a.tmp to %WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\htmlayout.dll
Substitutes the following files
- %WINDIR%\temp\asw.be0a7253934b9a34\config.def.new
Network activity
Connects to
- 'go#####analytics.com':80
- 'v7#####.stats.avast.com':80
- 'ia####.u.avast.com':443
- 'ia####.u.avast.com':80
- 'v7#####.stats.avast.com':443
- 'sh#####d.ff.avast.com':443
- 's1######.iavs9x.u.avast.com':80
- 'z4######.vps18tiny.u.avcdn.net':80
- 'al########nse-dealer.ff.avast.com':443
- 'al#####qs.ff.avast.com':443
- 'ss#.####le-analytics.com':443
TCP
HTTP GET requests
- http://r0######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://m0######.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
- http://m0######.iavs9x.u.avast.com/iavs9x/avbugreport_x64_ais-991.vpx
- http://m0######.iavs9x.u.avast.com/iavs9x/avdump_x64_ais-991.vpx
- http://m0######.iavs9x.u.avast.com/iavs9x/avdump_x86_ais-991.vpx
- http://m0######.iavs9x.u.avast.com/iavs9x/offertool_x64_ais-991.vpx
- http://m0######.iavs9x.u.avast.com/iavs9x/sbr_x64_ais-991.vpx
- http://n8######.vps18tiny.u.avcdn.net/vps18tiny/prod-vps.vpx
- http://n8######.vps18tiny.u.avcdn.net/vps18tiny/part-jrog2-19.vpx
- http://n8######.vps18tiny.u.avcdn.net/vps18tiny/part-vps_windows-21021799.vpx
HTTP POST requests
- http://www.go#####analytics.com/collect
- http://v7#####.stats.avast.com/cgi-bin/iavsevents.cgi
UDP
- DNS ASK go#####analytics.com
- DNS ASK n8######.vps18tiny.u.avcdn.net
- DNS ASK 3.###l.ntp.org
- DNS ASK 2.###l.ntp.org
- DNS ASK 1.###l.ntp.org
- DNS ASK 0.###l.ntp.org
- DNS ASK al#####qs.ff.avast.com
- DNS ASK al########nse-dealer.ff.avast.com
- DNS ASK z4######.vps18tiny.u.avcdn.net
- DNS ASK s-#####tiny.avcdn.net
- DNS ASK r6######.vps18tiny.u.avcdn.net
- DNS ASK p1######.vps18tiny.u.avcdn.net
- DNS ASK v7#####.stats.avast.com
- DNS ASK l4######.vps18tiny.u.avcdn.net
- DNS ASK ia####.u.avast.com
- DNS ASK sh#####d.ff.avast.com
- DNS ASK r6######.iavs9x.u.avast.com
- DNS ASK h4######.iavs9x.u.avast.com
- DNS ASK b8######.iavs9x.u.avast.com
- DNS ASK r0######.iavs9x.u.avast.com
- DNS ASK s-####9x.avcdn.net
- DNS ASK s1######.iavs9x.u.avast.com
- DNS ASK d3######.iavs9x.u.avast.com
- DNS ASK m0######.iavs9x.u.avast.com
- DNS ASK ss#.####le-analytics.com
- DNS ASK l7######.iavs9x.u.avast.com
- '1.###l.ntp.org':123
- '2.###l.ntp.org':123
- '0.###l.ntp.org':123
- '3.###l.ntp.org':123
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw.e0f09fb963ec93cd\avast_free_antivirus_setup_online_x64.exe' /cookie:mmm_ava_con_002_532_c /ga_clientid:4dec9ab4-751f-441e-8627-955e59eae51f /edat_dir:%WINDIR%\Temp\asw.e0f09fb963ec93cd
- '%WINDIR%\temp\asw.be0a7253934b9a34\instup.exe' /sfx:lite /sfxstorage:%WINDIR%\Temp\asw.be0a7253934b9a34 /edition:1 /prod:ais /guid:246974a6-7432-415f-a078-afe55b4de9ce /ga_clientid:4dec9ab4-751f-441e-8627-955e59eae51f /cookie:mmm_ava_con_00...
- '%WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\instup.exe' /sfx /sfxstorage:%WINDIR%\Temp\asw.be0a7253934b9a34 /edition:1 /prod:ais /guid:246974a6-7432-415f-a078-afe55b4de9ce /ga_clientid:4dec9ab4-751f-441e-8627-955e59eae51f /cookie:mmm_ava_con_002_532...
- '%WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\aswoffertool.exe' -checkChrome -elevated
- '%WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\aswoffertool.exe' -checkChromeReactivation -elevated -bc=AVFA
- 'C:\users\public\documents\aswoffertool.exe' -checkChromeReactivation -bc=AVFA
- '%WINDIR%\temp\asw.be0a7253934b9a34\new_15010991\aswoffertool.exe' -checkGToolbar -elevated
