Technical Information
Modifies file system
Creates the following files
- %ProgramFiles%\mozilla firefox\updated\firefox.exe
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-process-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-private-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-multibyte-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-math-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-locale-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-heap-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-filesystem-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-environment-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-convert-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-core-timezone-l1-1-0.dll
- %LOCALAPPDATA%\anvir\detectpr.dat
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-core-synch-l1-2-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-core-processthreads-l1-1-1.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-core-localization-l1-2-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-core-file-l2-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-core-file-l1-2-0.dll
- %ProgramFiles%\mozilla firefox\updated\accessiblemarshal.dll
- %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\active-update.xml.tmp
- %LOCALAPPDATA%\anvir\startup.dat
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\83aa4cc77f591dfc2374580bbd95f6ba_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-runtime-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-conio-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-stdio-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\crashreporter.exe
- %ProgramFiles%\mozilla firefox\updated\firefox.visualelementsmanifest.xml
- %ProgramFiles%\mozilla firefox\updated\dependentlibs.list
- %ProgramFiles%\mozilla firefox\updated\defaultagent_localized.ini
- %ProgramFiles%\mozilla firefox\updated\defaultagent.ini
- %ProgramFiles%\mozilla firefox\updated\default-browser-agent.exe
- %ProgramFiles%\mozilla firefox\updated\d3dcompiler_47.dll
- %TEMP%\anvir\portable.txt
- %TEMP%\anvir\anvir.ini
- %ProgramFiles%\mozilla firefox\updated\crashreporter.ini
- %TEMP%\anvir\anvir.exe
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\anvir\anvirrunserv.exe
- %TEMP%\anvir\virustotalupload.exe
- %TEMP%\anvir\anvirhook65.dll
- %TEMP%\anvir\msi.dll
- %ProgramFiles%\mozilla firefox\updated\browser\features\pictureinpicture@mozilla.org.xpi
- %ProgramFiles%\mozilla firefox\updated\browser\visualelements\privatebrowsing_70.png
- %ProgramFiles%\mozilla firefox\updated\browser\visualelements\privatebrowsing_150.png
- %ProgramFiles%\mozilla firefox\updated\application.ini
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-utility-l1-1-0.dll
- %ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-string-l1-1-0.dll
- %LOCALAPPDATA%low\sun\java\deployment\security\update.securitypack.timestamp
Modifies the following files
- %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\updates\0\update.log
- %ProgramFiles%\mozilla firefox\updated\browser\omni.ja
- %ProgramFiles%\mozilla firefox\updated\browser\features\webcompat@mozilla.org.xpi
- %ProgramFiles%\mozilla firefox\updated\browser\features\webcompat-reporter@mozilla.org.xpi
- %ProgramFiles%\mozilla firefox\updated\browser\features\screenshots@mozilla.org.xpi
- %ProgramFiles%\mozilla firefox\updated\browser\features\formautofill@mozilla.org.xpi
- %ProgramFiles%\mozilla firefox\updated\browser\crashreporter-override.ini
- %ProgramFiles%\mozilla firefox\updated\browser\visualelements\visualelements_70.png
- %ProgramFiles%\mozilla firefox\updated\browser\visualelements\visualelements_150.png
- %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\updates\0\update.status
Substitutes the following files
- %ALLUSERSPROFILE%\Mozilla\updates\308046B0AF4A39CB\active-update.xml
Network activity
TCP
HTTP POST requests
- http://oc##.#igicert.com/
Other
- 'ja#######d-secure.oracle.com':443
UDP
- DNS ASK ja#######d-secure.oracle.com
Miscellaneous
Searches for the following windows
- ClassName: 'AnVirMainFrame' WindowName: ''
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'SysPager' WindowName: ''
- ClassName: 'ToolbarWindow32' WindowName: ''
Creates and executes the following
- '%TEMP%\anvir\anvir.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c if exist <SYSTEM32>\Runscanner.exe (RunScanner.exe /ac /m+ /sd /ec /y /t 0 AnVir.exe) Else AnVir.exe
- '%WINDIR%\syswow64\cmd.exe' /c if exist <SYSTEM32>\Runscanner.exe (RunScanner.exe /ac /m+ /sd /ec /y /t 0 AnVir.exe) Else AnVir.exe' (with hidden window)
