| File name: | avast_premium_security_setup_online.exe |
| Full analysis: | https://app.any.run/tasks/6bf1463f-53a1-4d6d-9545-864f8d84f54e |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | September 30, 2021, 01:48:20 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | E7ABE631A4E6BA8C79F05F3856319143 |
| SHA1: | F77765CCC6827F7B4EF448FF8EAD45A330F01564 |
| SHA256: | 4371F1ACCA7B1DD376F236394701193ABAE29FA53EFF108EAEEEB213FE88AB1C |
| SSDEEP: | 3072:QJ8pnDfKTzlowcqcotOMFFp9t19Ty0Vf9f3pH6VV7rfA6wYkh9dQDUCjhhIoob7q:Q4nDSkqxtOAtTTyOf9vwVpfOjX1zMx |
MALICIOUS
Application was dropped or rewritten from another process
- avast_premium_security_setup_online.exe (PID: 2292)
- instup.exe (PID: 3048)
- instup.exe (PID: 2928)
- aswOfferTool.exe (PID: 3560)
- aswOfferTool.exe (PID: 3764)
- aswOfferTool.exe (PID: 3184)
- aswOfferTool.exe (PID: 4028)
- sbr.exe (PID: 2460)
- SetupInf.exe (PID: 3712)
- SetupInf.exe (PID: 3772)
- SetupInf.exe (PID: 3164)
- SetupInf.exe (PID: 1120)
- SetupInf.exe (PID: 3232)
- AvEmUpdate.exe (PID: 2916)
- SetupInf.exe (PID: 2372)
- AvEmUpdate.exe (PID: 2724)
- AvEmUpdate.exe (PID: 904)
- AvEmUpdate.exe (PID: 3924)
- avBugReport.exe (PID: 2968)
- avBugReport.exe (PID: 2756)
- SetupInf.exe (PID: 3572)
- SetupInf.exe (PID: 3760)
- RegSvr.exe (PID: 908)
- RegSvr.exe (PID: 2528)
- AvastNM.exe (PID: 2688)
- overseer.exe (PID: 460)
- engsup.exe (PID: 772)
- wsc_proxy.exe (PID: 3364)
- wsc_proxy.exe (PID: 2008)
- afwServ.exe (PID: 3772)
- AvastSvc.exe (PID: 2232)
- engsup.exe (PID: 2572)
- aswEngSrv.exe (PID: 3480)
- aswToolsSvc.exe (PID: 992)
- instup.exe (PID: 3492)
- instup.exe (PID: 556)
Drops executable file immediately after starts
- avast_premium_security_setup_online.exe (PID: 2292)
- aswOfferTool.exe (PID: 3184)
- aswOfferTool.exe (PID: 3764)
- aswOfferTool.exe (PID: 4028)
- SetupInf.exe (PID: 3760)
- DrvInst.exe (PID: 3920)
Loads dropped or rewritten executable
- instup.exe (PID: 2928)
- instup.exe (PID: 3048)
- aswOfferTool.exe (PID: 3184)
- aswOfferTool.exe (PID: 4028)
- AvEmUpdate.exe (PID: 2724)
- AvEmUpdate.exe (PID: 904)
- AvEmUpdate.exe (PID: 3924)
- avBugReport.exe (PID: 2968)
- RegSvr.exe (PID: 908)
- RegSvr.exe (PID: 2528)
- avBugReport.exe (PID: 2756)
- engsup.exe (PID: 772)
- wsc_proxy.exe (PID: 3364)
- afwServ.exe (PID: 3772)
- AvastSvc.exe (PID: 2232)
- aswToolsSvc.exe (PID: 992)
- engsup.exe (PID: 2572)
- aswEngSrv.exe (PID: 3480)
- instup.exe (PID: 3492)
Changes the autorun value in the registry
- instup.exe (PID: 3048)
Loads the Task Scheduler COM API
- AvEmUpdate.exe (PID: 2916)
- AvEmUpdate.exe (PID: 2724)
- overseer.exe (PID: 460)
Changes settings of System certificates
- SetupInf.exe (PID: 3760)
- AvastSvc.exe (PID: 2232)
Steals credentials from Web Browsers
- engsup.exe (PID: 2572)
Actions looks like stealing of personal data
- engsup.exe (PID: 2572)
Disables Windows Defender
- wsc_proxy.exe (PID: 2008)
SUSPICIOUS
Checks supported languages
- avast_premium_security_setup_online.exe (PID: 3496)
- avast_premium_security_setup_online.exe (PID: 2292)
- instup.exe (PID: 2928)
- instup.exe (PID: 3048)
- aswOfferTool.exe (PID: 3184)
- aswOfferTool.exe (PID: 3560)
- aswOfferTool.exe (PID: 3764)
- aswOfferTool.exe (PID: 4028)
- sbr.exe (PID: 2460)
- SetupInf.exe (PID: 3712)
- SetupInf.exe (PID: 3772)
- SetupInf.exe (PID: 3164)
- SetupInf.exe (PID: 1120)
- SetupInf.exe (PID: 2372)
- AvEmUpdate.exe (PID: 2916)
- SetupInf.exe (PID: 3232)
- AvEmUpdate.exe (PID: 2724)
- AvEmUpdate.exe (PID: 904)
- AvEmUpdate.exe (PID: 3924)
- avBugReport.exe (PID: 2968)
- avBugReport.exe (PID: 2756)
- SetupInf.exe (PID: 3572)
- SetupInf.exe (PID: 3760)
- DrvInst.exe (PID: 3920)
- RegSvr.exe (PID: 908)
- RegSvr.exe (PID: 2528)
- AvastNM.exe (PID: 2688)
- overseer.exe (PID: 460)
- engsup.exe (PID: 772)
- wsc_proxy.exe (PID: 3364)
- wsc_proxy.exe (PID: 2008)
- afwServ.exe (PID: 3772)
- AvastSvc.exe (PID: 2232)
- aswToolsSvc.exe (PID: 992)
- engsup.exe (PID: 2572)
- instup.exe (PID: 3492)
- aswEngSrv.exe (PID: 3480)
- instup.exe (PID: 556)
Reads the computer name
- avast_premium_security_setup_online.exe (PID: 3496)
- avast_premium_security_setup_online.exe (PID: 2292)
- instup.exe (PID: 2928)
- instup.exe (PID: 3048)
- aswOfferTool.exe (PID: 3764)
- SetupInf.exe (PID: 3712)
- SetupInf.exe (PID: 3772)
- SetupInf.exe (PID: 3164)
- SetupInf.exe (PID: 1120)
- SetupInf.exe (PID: 3232)
- AvEmUpdate.exe (PID: 2916)
- AvEmUpdate.exe (PID: 2724)
- SetupInf.exe (PID: 2372)
- AvEmUpdate.exe (PID: 904)
- AvEmUpdate.exe (PID: 3924)
- avBugReport.exe (PID: 2756)
- avBugReport.exe (PID: 2968)
- SetupInf.exe (PID: 3572)
- SetupInf.exe (PID: 3760)
- DrvInst.exe (PID: 3920)
- RegSvr.exe (PID: 908)
- RegSvr.exe (PID: 2528)
- overseer.exe (PID: 460)
- wsc_proxy.exe (PID: 2008)
- afwServ.exe (PID: 3772)
- wsc_proxy.exe (PID: 3364)
- AvastSvc.exe (PID: 2232)
- aswToolsSvc.exe (PID: 992)
- engsup.exe (PID: 2572)
- instup.exe (PID: 3492)
- instup.exe (PID: 556)
Creates files in the Windows directory
- avast_premium_security_setup_online.exe (PID: 3496)
- avast_premium_security_setup_online.exe (PID: 2292)
- instup.exe (PID: 2928)
- instup.exe (PID: 3048)
- aswOfferTool.exe (PID: 3764)
- aswOfferTool.exe (PID: 3184)
- AvEmUpdate.exe (PID: 2724)
- SetupInf.exe (PID: 3760)
- DrvInst.exe (PID: 3920)
- AvastSvc.exe (PID: 2232)
Creates files in the program directory
- avast_premium_security_setup_online.exe (PID: 2292)
- instup.exe (PID: 2928)
- instup.exe (PID: 3048)
- AvEmUpdate.exe (PID: 2916)
- AvEmUpdate.exe (PID: 2724)
- avBugReport.exe (PID: 2968)
- engsup.exe (PID: 772)
- AvastNM.exe (PID: 2688)
- wsc_proxy.exe (PID: 3364)
- afwServ.exe (PID: 3772)
- aswToolsSvc.exe (PID: 992)
- engsup.exe (PID: 2572)
- instup.exe (PID: 3492)
- AvastSvc.exe (PID: 2232)
Executable content was dropped or overwritten
- avast_premium_security_setup_online.exe (PID: 3496)
- avast_premium_security_setup_online.exe (PID: 2292)
- instup.exe (PID: 2928)
- aswOfferTool.exe (PID: 3184)
- aswOfferTool.exe (PID: 3764)
- aswOfferTool.exe (PID: 4028)
- instup.exe (PID: 3048)
- AvEmUpdate.exe (PID: 2724)
- SetupInf.exe (PID: 3760)
- DrvInst.exe (PID: 3920)
- AvastSvc.exe (PID: 2232)
Drops a file with a compile date too recent
- avast_premium_security_setup_online.exe (PID: 3496)
- avast_premium_security_setup_online.exe (PID: 2292)
- instup.exe (PID: 2928)
- instup.exe (PID: 3048)
- aswOfferTool.exe (PID: 3764)
- AvEmUpdate.exe (PID: 2724)
- AvastSvc.exe (PID: 2232)
Drops a file that was compiled in debug mode
- avast_premium_security_setup_online.exe (PID: 3496)
- avast_premium_security_setup_online.exe (PID: 2292)
- instup.exe (PID: 2928)
- aswOfferTool.exe (PID: 3184)
- instup.exe (PID: 3048)
- aswOfferTool.exe (PID: 3764)
- aswOfferTool.exe (PID: 4028)
- AvEmUpdate.exe (PID: 2724)
- SetupInf.exe (PID: 3760)
- DrvInst.exe (PID: 3920)
- AvastSvc.exe (PID: 2232)
Creates or modifies windows services
- instup.exe (PID: 2928)
- instup.exe (PID: 3048)
- AvastSvc.exe (PID: 2232)
Reads Environment values
- instup.exe (PID: 2928)
- instup.exe (PID: 3048)
- AvEmUpdate.exe (PID: 2724)
- AvEmUpdate.exe (PID: 2916)
- AvEmUpdate.exe (PID: 3924)
- AvEmUpdate.exe (PID: 904)
- afwServ.exe (PID: 3772)
- AvastSvc.exe (PID: 2232)
- instup.exe (PID: 3492)
- instup.exe (PID: 556)
Reads CPU info
- instup.exe (PID: 2928)
- instup.exe (PID: 3048)
- SetupInf.exe (PID: 3712)
- SetupInf.exe (PID: 3772)
- SetupInf.exe (PID: 3164)
- SetupInf.exe (PID: 1120)
- SetupInf.exe (PID: 2372)
- SetupInf.exe (PID: 3232)
- AvEmUpdate.exe (PID: 2724)
- AvEmUpdate.exe (PID: 2916)
- AvEmUpdate.exe (PID: 904)
- AvEmUpdate.exe (PID: 3924)
- avBugReport.exe (PID: 2968)
- avBugReport.exe (PID: 2756)
- SetupInf.exe (PID: 3572)
- SetupInf.exe (PID: 3760)
- RegSvr.exe (PID: 2528)
- RegSvr.exe (PID: 908)
- wsc_proxy.exe (PID: 2008)
- afwServ.exe (PID: 3772)
- wsc_proxy.exe (PID: 3364)
- AvastSvc.exe (PID: 2232)
- aswToolsSvc.exe (PID: 992)
- instup.exe (PID: 3492)
- instup.exe (PID: 556)
Removes files from Windows directory
- instup.exe (PID: 2928)
- instup.exe (PID: 3048)
- aswOfferTool.exe (PID: 3184)
- aswOfferTool.exe (PID: 3764)
- AvEmUpdate.exe (PID: 2724)
- DrvInst.exe (PID: 3920)
- SetupInf.exe (PID: 3760)
- avast_premium_security_setup_online.exe (PID: 2292)
Starts itself from another location
- instup.exe (PID: 2928)
- aswOfferTool.exe (PID: 3764)
Creates a directory in Program Files
- instup.exe (PID: 3048)
- AvEmUpdate.exe (PID: 2724)
- engsup.exe (PID: 772)
- AvastSvc.exe (PID: 2232)
Drops a file with too old compile date
- instup.exe (PID: 3048)
Creates files in the driver directory
- instup.exe (PID: 3048)
- AvEmUpdate.exe (PID: 2724)
- DrvInst.exe (PID: 3920)
- SetupInf.exe (PID: 3760)
Creates a software uninstall entry
- instup.exe (PID: 3048)
Changes default file association
- instup.exe (PID: 3048)
Creates/Modifies COM task schedule object
- instup.exe (PID: 3048)
- RegSvr.exe (PID: 2528)
- RegSvr.exe (PID: 908)
Application launched itself
- AvEmUpdate.exe (PID: 2724)
Executed via COM
- DrvInst.exe (PID: 3920)
Searches for installed software
- overseer.exe (PID: 460)
Executed as Windows Service
- wsc_proxy.exe (PID: 2008)
- afwServ.exe (PID: 3772)
- AvastSvc.exe (PID: 2232)
- aswToolsSvc.exe (PID: 992)
Reads the cookies of Google Chrome
- engsup.exe (PID: 2572)
Reads the cookies of Mozilla Firefox
- engsup.exe (PID: 2572)
Reads the date of Windows installation
- instup.exe (PID: 3048)
Reads Windows Product ID
- instup.exe (PID: 3048)
INFO
Reads settings of System Certificates
- avast_premium_security_setup_online.exe (PID: 3496)
- avast_premium_security_setup_online.exe (PID: 2292)
- instup.exe (PID: 2928)
- instup.exe (PID: 3048)
- AvEmUpdate.exe (PID: 904)
- AvEmUpdate.exe (PID: 2724)
- AvEmUpdate.exe (PID: 3924)
- DrvInst.exe (PID: 3920)
- avBugReport.exe (PID: 2756)
- avBugReport.exe (PID: 2968)
Reads the hosts file
- instup.exe (PID: 2928)
- instup.exe (PID: 3048)
- overseer.exe (PID: 460)
- AvastSvc.exe (PID: 2232)
Dropped object may contain Bitcoin addresses
- instup.exe (PID: 3048)
Checks Windows Trust Settings
- DrvInst.exe (PID: 3920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| ProductVersion: | 2.1.67.0 |
|---|---|
| ProductName: | Avast |
| OriginalFileName: | microstub.exe |
| LegalCopyright: | Copyright (c) 2021 AVAST Software |
| InternalName: | microstub |
| FileVersion: | 2.1.67.0 |
| FileDescription: | Avast Installer |
| Edition: | 12 |
| CompanyName: | AVAST Software |
| CharacterSet: | Unicode |
| LanguageCode: | English (U.S.) |
| FileSubtype: | - |
| ObjectFileType: | Executable application |
| FileOS: | Windows NT 32-bit |
| FileFlags: | (none) |
| FileFlagsMask: | 0x003f |
| ProductVersionNumber: | 2.1.67.0 |
| FileVersionNumber: | 2.1.67.0 |
| Subsystem: | Windows GUI |
| SubsystemVersion: | 5.1 |
| ImageVersion: | - |
| OSVersion: | 5.1 |
| EntryPoint: | 0x1020 |
| UninitializedDataSize: | - |
| InitializedDataSize: | 94208 |
| CodeSize: | 135168 |
| LinkerVersion: | 14.16 |
| PEType: | PE32 |
| TimeStamp: | 2021:09:07 17:04:58+02:00 |
| MachineType: | Intel 386 or later, and compatibles |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 07-Sep-2021 15:04:58 |
| Detected languages: |
|
| Debug artifacts: |
|
| CompanyName: | AVAST Software |
| Edition: | 12 |
| FileDescription: | Avast Installer |
| FileVersion: | 2.1.67.0 |
| InternalName: | microstub |
| LegalCopyright: | Copyright (c) 2021 AVAST Software |
| OriginalFilename: | microstub.exe |
| ProductName: | Avast |
| ProductVersion: | 2.1.67.0 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000118 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 6 |
| Time date stamp: | 07-Sep-2021 15:04:58 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x00020E7A | 0x00021000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.54961 |
.rdata | 0x00022000 | 0x00009F0E | 0x0000A000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.39995 |
.data | 0x0002C000 | 0x000015B0 | 0x00000A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.78681 |
.didat | 0x0002E000 | 0x0000003C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.590415 |
.rsrc | 0x0002F000 | 0x00009948 | 0x00009A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.54009 |
.reloc | 0x00039000 | 0x00001C30 | 0x00001E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.4944 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.32507 | 1079 | UNKNOWN | English - United States | RT_MANIFEST |
63 | 3.13805 | 1396 | UNKNOWN | English - United States | RT_STRING |
64 | 2.93066 | 298 | UNKNOWN | English - United States | RT_STRING |
76 | 3.18649 | 352 | UNKNOWN | English - United States | RT_STRING |
100 | 1.91924 | 20 | UNKNOWN | English - United States | RT_GROUP_ICON |
126 | 2.57629 | 148 | UNKNOWN | English - United States | RT_STRING |
132 | 2.85598 | 324 | UNKNOWN | English - United States | RT_STRING |
133 | 2.5242 | 136 | UNKNOWN | English - United States | RT_STRING |
138 | 2.82216 | 310 | UNKNOWN | English - United States | RT_STRING |
139 | 2.85024 | 352 | UNKNOWN | English - United States | RT_STRING |
Imports
ADVAPI32.dll |
COMCTL32.dll |
CRYPT32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll (delay-loaded) |
USER32.dll |
WindowsCodecs.dll |
ole32.dll |
Total processes
77
Monitored processes
39
Malicious processes
29
Suspicious processes
4
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 460 | "C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe" /skip_uptime /skip_remediations | C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe | instup.exe | ||||||||||||
User: admin Company: Avast Software Integrity Level: HIGH Description: Avast Overseer Exit code: 0 Version: 1.0.426.0 Modules
| |||||||||||||||
| 556 | "C:\Program Files\Avast Software\Avast\setup\instup.exe" /wait /instop:update_configdef | C:\Program Files\Avast Software\Avast\setup\instup.exe | — | AvastSvc.exe | |||||||||||
User: SYSTEM Company: AVAST Software Integrity Level: SYSTEM Description: Avast Antivirus Installer Exit code: 0 Version: 21.8.6586.0 Modules
| |||||||||||||||
| 772 | "C:\Program Files\Avast Software\Avast\defs\21092807\engsup.exe" /prepare_definitions_folder | C:\Program Files\Avast Software\Avast\defs\21092807\engsup.exe | — | instup.exe | |||||||||||
User: admin Company: Avast Software Integrity Level: HIGH Description: Avast Antivirus vps tool Exit code: 0 Version: 18.0.1109.0 Modules
| |||||||||||||||
| 904 | AvEmUpdate.exe /installer1 /emupdater /applydll "C:\Program Files\Avast Software\Avast\Setup\fe919e10-bd36-4aaf-b96c-a185e98d1ab8.dll" | C:\Program Files\Avast Software\Avast\AvEmUpdate.exe | AvEmUpdate.exe | ||||||||||||
User: admin Company: AVAST Software Integrity Level: HIGH Description: Avast Emergency Update Exit code: 0 Version: 21.8.6586.0 Modules
| |||||||||||||||
| 908 | "C:\Program Files\Avast Software\Avast\RegSvr.exe" "C:\Program Files\Avast Software\Avast\aswAMSI.dll" | C:\Program Files\Avast Software\Avast\RegSvr.exe | — | instup.exe | |||||||||||
User: admin Company: AVAST Software Integrity Level: HIGH Description: Avast Antivirus Installer Exit code: 0 Version: 21.8.6586.0 Modules
| |||||||||||||||
| 992 | "C:\Program Files\Avast Software\Avast\aswToolsSvc.exe" /runassvc | C:\Program Files\Avast Software\Avast\aswToolsSvc.exe | — | services.exe | |||||||||||
User: SYSTEM Company: AVAST Software Integrity Level: SYSTEM Description: Avast Antivirus Exit code: 0 Version: 21.8.6586.0 Modules
| |||||||||||||||
| 1120 | "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswHwid.cat | C:\Program Files\Avast Software\Avast\SetupInf.exe | — | instup.exe | |||||||||||
User: admin Company: AVAST Software Integrity Level: HIGH Description: Avast Antivirus Installer Exit code: 0 Version: 21.8.6586.0 Modules
| |||||||||||||||
| 2008 | "C:\Program Files\Avast Software\Avast\wsc_proxy.exe" /runassvc /rpcserver | C:\Program Files\Avast Software\Avast\wsc_proxy.exe | — | services.exe | |||||||||||
User: SYSTEM Company: AVAST Software Integrity Level: SYSTEM Description: Avast remediation exe Exit code: 0 Version: 21.4.6162.0 Modules
| |||||||||||||||
| 2232 | "C:\Program Files\Avast Software\Avast\AvastSvc.exe" /runassvc | C:\Program Files\Avast Software\Avast\AvastSvc.exe | services.exe | ||||||||||||
User: SYSTEM Company: AVAST Software Integrity Level: SYSTEM Description: Avast Service Exit code: 0 Version: 21.8.6586.0 Modules
| |||||||||||||||
| 2292 | "C:\Windows\Temp\asw.5f7a3f969717cb89\avast_premium_security_setup_online.exe" /ga_clientid:d52026c7-3d29-48d8-8cd6-01d4473d7157 /edat_dir:C:\Windows\Temp\asw.5f7a3f969717cb89 | C:\Windows\Temp\asw.5f7a3f969717cb89\avast_premium_security_setup_online.exe | avast_premium_security_setup_online.exe | ||||||||||||
User: admin Company: AVAST Software Integrity Level: HIGH Description: Avast Antivirus Exit code: 0 Version: 21.8.6586.0 Modules
| |||||||||||||||
Total events
46 878
Read events
41 664
Write events
5 176
Delete events
38
Modification events
| (PID) Process: | (3496) avast_premium_security_setup_online.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager |
| Operation: | write | Name: | PendingFileRenameOperations |
Value: \??\C:\Windows\Temp\asw.5f7a3f969717cb89 | |||
| (PID) Process: | (3496) avast_premium_security_setup_online.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\171\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2292) avast_premium_security_setup_online.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage |
| Operation: | write | Name: | SfxInstProgress |
Value: 0 | |||
| (PID) Process: | (2292) avast_premium_security_setup_online.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\171\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2928) instup.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\partmgr |
| Operation: | write | Name: | EnableCounterForIoctl |
Value: 1 | |||
| (PID) Process: | (2928) instup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\Avast |
| Operation: | write | Name: | SetupLog |
Value: C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\Setup.log | |||
| (PID) Process: | (2928) instup.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\171\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2928) instup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage |
| Operation: | write | Name: | InstupProgress_UpdateSetup_Syncer |
Value: 0 | |||
| (PID) Process: | (2928) instup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage |
| Operation: | write | Name: | InstupProgress_UpdateSetup_Main |
Value: 0 | |||
| (PID) Process: | (2928) instup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage |
| Operation: | write | Name: | InstupProgress_Description |
Value: DNS resolving | |||
Executable files
489
Suspicious files
304
Text files
278
Unknown types
49
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2292 | avast_premium_security_setup_online.exe | C:\Windows\Temp\asw.113b94f3666725eb\servers.def.vpx | binary | |
MD5:— | SHA256:— | |||
| 2292 | avast_premium_security_setup_online.exe | C:\Windows\Temp\asw.113b94f3666725eb\instup_ais-9b7.vpx | — | |
MD5:— | SHA256:— | |||
| 2292 | avast_premium_security_setup_online.exe | C:\Windows\Temp\asw.113b94f3666725eb\prod-pgm.vpx | binary | |
MD5:— | SHA256:— | |||
| 3496 | avast_premium_security_setup_online.exe | C:\Windows\Temp\asw.5f7a3f969717cb89\avast_premium_security_setup_online.exe | executable | |
MD5:— | SHA256:— | |||
| 2292 | avast_premium_security_setup_online.exe | C:\Windows\Temp\asw.113b94f3666725eb\servers.def | text | |
MD5:— | SHA256:— | |||
| 2292 | avast_premium_security_setup_online.exe | C:\Windows\Temp\asw.113b94f3666725eb\config.def.vpx | binary | |
MD5:— | SHA256:— | |||
| 2292 | avast_premium_security_setup_online.exe | C:\Windows\Temp\asw.113b94f3666725eb\part-prg_ais-150809b7.vpx | binary | |
MD5:— | SHA256:— | |||
| 2292 | avast_premium_security_setup_online.exe | C:\Windows\Temp\asw.113b94f3666725eb\prod-vps.vpx | binary | |
MD5:— | SHA256:— | |||
| 2292 | avast_premium_security_setup_online.exe | C:\Windows\Temp\asw.113b94f3666725eb\uat64.vpx | binary | |
MD5:— | SHA256:— | |||
| 2292 | avast_premium_security_setup_online.exe | C:\Windows\Temp\asw.113b94f3666725eb\instcont_ais-9b7.vpx | binary | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
92
TCP/UDP connections
85
DNS requests
141
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2928 | instup.exe | GET | 200 | 80.67.82.104:80 | http://s1843811.iavs9x.u.avast.com/iavs9x/offertool_ais-9b7.vpx | US | binary | 339 Kb | whitelisted |
2928 | instup.exe | GET | 200 | 80.67.82.104:80 | http://y9830512.iavs9x.u.avast.com/iavs9x/servers.def.vpx | US | binary | 2.39 Kb | whitelisted |
3496 | avast_premium_security_setup_online.exe | POST | 204 | 5.62.40.213:80 | http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi | DE | — | — | whitelisted |
3496 | avast_premium_security_setup_online.exe | GET | 200 | 92.123.225.75:80 | http://iavs9x.u.avast.com/iavs9x/avast_premium_security_setup_online.exe | unknown | executable | 7.98 Mb | whitelisted |
3496 | avast_premium_security_setup_online.exe | POST | 204 | 5.62.40.213:80 | http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi | DE | — | — | whitelisted |
2928 | instup.exe | GET | 200 | 80.67.82.104:80 | http://s1843811.iavs9x.u.avast.com/iavs9x/avdump_x86_ais-9b7.vpx | US | binary | 267 Kb | whitelisted |
2928 | instup.exe | GET | 200 | 80.67.82.104:80 | http://s1843811.iavs9x.u.avast.com/iavs9x/avbugreport_ais-9b7.vpx | US | binary | 1.18 Mb | whitelisted |
3048 | instup.exe | GET | 200 | 80.67.82.81:80 | http://n2833777.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx | US | binary | 572 b | whitelisted |
3048 | instup.exe | GET | 200 | 80.67.82.96:80 | http://b7210692.vps18tiny.u.avcdn.net/vps18tiny/prod-vps.vpx | US | binary | 340 b | whitelisted |
2928 | instup.exe | GET | 200 | 80.67.82.104:80 | http://s1843811.iavs9x.u.avast.com/iavs9x/sbr_x86_ais-9b7.vpx | US | binary | 7.42 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2928 | instup.exe | 80.67.82.104:80 | b7210692.iavs9x.u.avast.com | Akamai International B.V. | US | suspicious |
3048 | instup.exe | 80.67.82.96:80 | b7210692.vps18tiny.u.avcdn.net | Akamai International B.V. | US | unknown |
3048 | instup.exe | 80.67.82.81:80 | b7210692.iavs9x.u.avast.com | Akamai International B.V. | US | suspicious |
— | — | 80.67.82.96:80 | b7210692.vps18tiny.u.avcdn.net | Akamai International B.V. | US | unknown |
3048 | instup.exe | 5.62.40.202:443 | shepherd.ff.avast.com | AVAST Software s.r.o. | DE | suspicious |
3048 | instup.exe | 5.62.38.13:443 | alpha-license-dealer.ff.avast.com | AVAST Software s.r.o. | NL | unknown |
3048 | instup.exe | 5.62.40.213:443 | v7event.stats.avast.com | AVAST Software s.r.o. | DE | unknown |
3048 | instup.exe | 80.67.82.104:80 | b7210692.iavs9x.u.avast.com | Akamai International B.V. | US | suspicious |
3496 | avast_premium_security_setup_online.exe | 5.62.40.213:80 | v7event.stats.avast.com | AVAST Software s.r.o. | DE | unknown |
3496 | avast_premium_security_setup_online.exe | 142.250.185.206:80 | www.google-analytics.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
iavs9x.u.avast.com |
| whitelisted |
v7event.stats.avast.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |
shepherd.ff.avast.com |
| whitelisted |
b7210692.iavs9x.u.avast.com |
| whitelisted |
h4444966.iavs9x.u.avast.com |
| whitelisted |
n2833777.iavs9x.u.avast.com |
| whitelisted |
s-iavs9x.avcdn.net |
| whitelisted |
s1843811.iavs9x.u.avast.com |
| whitelisted |
y9830512.iavs9x.u.avast.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
— | — | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
Process | Message |
|---|---|
overseer.exe | Unable to perform cURL request!
Couldn't resolve host name (Could not resolve: yesno.ff.avast.com (DNS server returned answer with no data)) (0x00000006) |
AvastSvc.exe | [2021-09-30 01:51:38.818] [error ] [ring_client] [ 2232: 2092] asw::ring_client::NetworkStatus::isInternetAvailable::<lambda_2>::operator () call anen failed
|
AvastSvc.exe | [2021-09-30 01:51:38.818] [error ] [ring_client] [ 2232: 2092] asw::ring_client::call_anen_exception failed reason: Request app.anen.global.get_connectivity was not processed. Routing parameters:
|
AvastSvc.exe | [2021-09-30 01:51:39.724] [error ] [SecureDNS ] [ 2232: 3840] [vpn-virtgw-prod-065_sfo2_ff_avast_com_53] Unable to retrieve server certificates (error: 3)
|
AvastSvc.exe | [2021-09-30 01:51:39.724] [error ] [SecureDNS ] [ 2232: 3840] [vpn-gw-prod-006_zrh0-tgb_ff_avast_com_53] Unable to retrieve server certificates (error: 3)
|
AvastSvc.exe | [2021-09-30 01:51:39.724] [error ] [SecureDNS ] [ 2232: 3840] [vpn-gw-prod-005_zrh0-tgb_ff_avast_com_53] Unable to retrieve server certificates (error: 3)
|
AvastSvc.exe | [2021-09-30 01:51:39.724] [error ] [SecureDNS ] [ 2232: 3840] [vpn-gw-prod-005_mil0-h1p_ff_avast_com_53] Unable to retrieve server certificates (error: 3)
|
AvastSvc.exe | The filename, directory name, or volume label syntax is incorrect. |
AvastSvc.exe | [2021-09-30 01:51:40.131] [error ] [av_pp_prov ] [ 2232: 2972] Exception: get_file_content 'C:\Program Files\Avast Software\Avast\gui_resources\default_av\updatefile.json'
Code: 0x00000003 (3)
|
AvastSvc.exe | [2021-09-30 01:51:40.584] [error ] [ffl2 ] [ 2232: 2916] failed to load key 0 (error 2)
|