| File name: | avg_secure_browser_setup.exe |
| Full analysis: | https://app.any.run/tasks/4ecdbb05-13e8-45d4-9e63-80d835505db2 |
| Verdict: | Malicious activity |
| Analysis date: | September 13, 2020, 01:39:18 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| MD5: | 58ED42711E8839A257755D4BD1BD3C0F |
| SHA1: | 5241E927C0E714EF33658D1F6F159FEEF7A6E98D |
| SHA256: | 09A3BF51B109AA28F0F444495B60D8B33DAA02BE1FD86282E8A8F782875BA926 |
| SSDEEP: | 98304:zTNvjzCgtTe4ZmxwIh4K5xTB7Gdmmt3nKTy:X5/NOxwRkVB7GBaG |
MALICIOUS
Loads dropped or rewritten executable
- ajDBE7.exe (PID: 2364)
- avg_secure_browser_setup.exe (PID: 2292)
- AVGBrowserUpdate.exe (PID: 3924)
- AVGBrowserUpdate.exe (PID: 3960)
- AVGBrowserUpdate.exe (PID: 3892)
- AVGBrowserUpdate.exe (PID: 3320)
- AVGBrowserUpdate.exe (PID: 2500)
- AVGBrowserUpdate.exe (PID: 700)
Application was dropped or rewritten from another process
- ajDBE7.exe (PID: 2364)
- AVGBrowserUpdate.exe (PID: 3960)
- AVGBrowserUpdate.exe (PID: 3320)
- AVGBrowserUpdate.exe (PID: 2500)
- AVGBrowserUpdate.exe (PID: 700)
- AVGBrowserUpdate.exe (PID: 3892)
- AVGBrowserUpdate.exe (PID: 3924)
- AVGBrowserUpdateSetup.exe (PID: 3648)
Actions looks like stealing of personal data
- ajDBE7.exe (PID: 2364)
Changes settings of System certificates
- ajDBE7.exe (PID: 2364)
- AVGBrowserUpdate.exe (PID: 700)
Loads the Task Scheduler COM API
- AVGBrowserUpdate.exe (PID: 3924)
SUSPICIOUS
Executable content was dropped or overwritten
- avg_secure_browser_setup.exe (PID: 2292)
- ajDBE7.exe (PID: 2364)
- AVGBrowserUpdateSetup.exe (PID: 3648)
- AVGBrowserUpdate.exe (PID: 3924)
Creates COM task schedule object
- AVGBrowserUpdate.exe (PID: 3960)
- AVGBrowserUpdate.exe (PID: 3924)
Low-level read access rights to disk partition
- ajDBE7.exe (PID: 2364)
- AVGBrowserUpdate.exe (PID: 3924)
- AVGBrowserUpdate.exe (PID: 700)
Adds / modifies Windows certificates
- ajDBE7.exe (PID: 2364)
- AVGBrowserUpdate.exe (PID: 700)
Reads Internet Cache Settings
- ajDBE7.exe (PID: 2364)
Creates files in the program directory
- AVGBrowserUpdateSetup.exe (PID: 3648)
- AVGBrowserUpdate.exe (PID: 3924)
Executed as Windows Service
- AVGBrowserUpdate.exe (PID: 700)
Starts itself from another location
- AVGBrowserUpdate.exe (PID: 3924)
Disables SEHOP
- AVGBrowserUpdate.exe (PID: 3924)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:12:16 01:50:53+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 26112 |
| InitializedDataSize: | 141824 |
| UninitializedDataSize: | 2048 |
| EntryPoint: | 0x350d |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 6.7.2.2911 |
| ProductVersionNumber: | 6.7.2.2911 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Arabic |
| CharacterSet: | Windows, Arabic |
| BuildDate: | 19700119T120213 |
| BuildTimestamp: | 1598533090 |
| BuildVersion: | 6.7.2.2911 |
| FileDescription: | إعداد AVG Secure Browser |
| FileVersion: | 6.7.2.2911 |
| InstallerCommit: | 3e9991374cb82d6bade02f3a0095229069eaba65 |
| InstallerEdition: | web |
| InstallerKeyword: | avg-securebrowser |
| InternalName: | AVG Secure Browser |
| JsisCommit: | 68f9d58e86e442134b0139b14f9a6a2510b069e7 |
| LegalCopyright: | (c) 2020 AVG Technologies |
| OmahaVersion: | 1.8.1066 |
| ProductName: | إعداد AVG Secure Browser |
| ProductVersion: | 6.7.2.2911 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 16-Dec-2019 00:50:53 |
| Detected languages: |
|
| BuildDate: | 19700119T120213 |
| BuildTimestamp: | 1598533090 |
| BuildVersion: | 6.7.2.2911 |
| FileDescription: | Podešavanje programa AVG Secure Browser |
| FileVersion: | 6.7.2.2911 |
| InstallerCommit: | 3e9991374cb82d6bade02f3a0095229069eaba65 |
| InstallerEdition: | web |
| InstallerKeyword: | avg-securebrowser |
| InternalName: | AVG Secure Browser |
| JsisCommit: | 68f9d58e86e442134b0139b14f9a6a2510b069e7 |
| LegalCopyright: | (c) 2020 AVG Technologies |
| OmahaVersion: | 1.8.1066 |
| ProductName: | Podešavanje programa AVG Secure Browser |
| ProductVersion: | 6.7.2.2911 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x000000C8 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 16-Dec-2019 00:50:53 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x0000647B | 0x00006600 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.42652 |
.rdata | 0x00008000 | 0x00001384 | 0x00001400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.13635 |
.data | 0x0000A000 | 0x00020358 | 0x00000600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.00585 |
.ndata | 0x0002B000 | 0x00072000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x0009D000 | 0x00021718 | 0x00021800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.66783 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.28666 | 1249 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 4.91525 | 9640 | UNKNOWN | English - United States | RT_ICON |
3 | 5.33705 | 4264 | UNKNOWN | English - United States | RT_ICON |
4 | 5.11052 | 3752 | UNKNOWN | English - United States | RT_ICON |
5 | 5.10581 | 2216 | UNKNOWN | English - United States | RT_ICON |
6 | 3.83709 | 1640 | UNKNOWN | English - United States | RT_ICON |
7 | 4.74131 | 1384 | UNKNOWN | English - United States | RT_ICON |
8 | 6.00508 | 1128 | UNKNOWN | English - United States | RT_ICON |
9 | 4.30117 | 744 | UNKNOWN | English - United States | RT_ICON |
10 | 4.53771 | 296 | UNKNOWN | English - United States | RT_ICON |
Imports
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
ole32.dll |
Total processes
48
Monitored processes
9
Malicious processes
8
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 700 | "C:\Program Files\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc | C:\Program Files\AVG\Browser\Update\AVGBrowserUpdate.exe | services.exe | ||||||||||||
User: SYSTEM Company: AVG Technologies Integrity Level: SYSTEM Description: AVG Browser Exit code: 0 Version: 1.8.1066.0 Modules
| |||||||||||||||
| 2292 | "C:\Users\admin\AppData\Local\Temp\avg_secure_browser_setup.exe" | C:\Users\admin\AppData\Local\Temp\avg_secure_browser_setup.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: AVG Secure Browser Setup Exit code: 0 Version: 6.7.2.2911 Modules
| |||||||||||||||
| 2364 | "C:\Users\admin\AppData\Local\Temp\ajDBE7.exe" /relaunch=9 /tagdata | C:\Users\admin\AppData\Local\Temp\ajDBE7.exe | avg_secure_browser_setup.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: AVG Secure Browser Setup Exit code: 0 Version: 6.7.2.2911 Modules
| |||||||||||||||
| 2500 | "C:\Program Files\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9205&ap=mv:85.0.5674.85&installargs=--reset-default-win10 --no-desktop-shortcut --no-taskbar-shortcut --private-browsing --default-search%3Dbing.com" /installsource otherinstallcmd /sessionid "{1998B2F7-6EC4-4F14-8963-7D17CED04224}" /silent | C:\Program Files\AVG\Browser\Update\AVGBrowserUpdate.exe | — | AVGBrowserUpdate.exe | |||||||||||
User: admin Company: AVG Technologies Integrity Level: HIGH Description: AVG Browser Exit code: 0 Version: 1.8.1066.0 Modules
| |||||||||||||||
| 3320 | "C:\Program Files\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTA2Ni4wIiBzaGVsbF92ZXJzaW9uPSIxLjguMTA2Ni4wIiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjAiIHNlc3Npb25pZD0iezE5OThCMkY3LTZFQzQtNEYxNC04OTYzLTdEMTdDRUQwNDIyNH0iIGNlcnRfZXhwX2RhdGU9IjIwMjIxMDIwIiB1c2VyaWQ9IntGNTg4MjE1Qi01Q0E1LTQ2ODItOTlCMC04NTZEMjY3NUY4NDN9IiB1c2VyaWRfZGF0ZT0iMjAyMDA5MTMiIG1hY2hpbmVpZD0iezFFMzkzOEUyLTgyNzYtQkJCNS0xNUQ0LTY5N0YwQ0I4RTY0Nn0iIG1hY2hpbmVpZF9kYXRlPSIyMDIwMDkxMyIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9Ins2NTgyQUU4Ny1DMTlDLTRBMEEtQThGRC01RDgwQkUwRDQ2QjV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjMiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjAiIHNwPSJTZXJ2aWNlIFBhY2sgMSIgYXJjaD0ieDg2Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xMDY2LjAiIGxhbmc9ImVuLVVTIiBicmFuZD0iOTIwNSIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMjE4NyIvPjwvYXBwPjwvcmVxdWVzdD4 | C:\Program Files\AVG\Browser\Update\AVGBrowserUpdate.exe | AVGBrowserUpdate.exe | ||||||||||||
User: admin Company: AVG Technologies Integrity Level: HIGH Description: AVG Browser Exit code: 0 Version: 1.8.1066.0 Modules
| |||||||||||||||
| 3648 | "C:\Users\admin\AppData\Local\Temp\nsfE1A3.tmp\AVGBrowserUpdateSetup.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9205&ap=mv:85.0.5674.85&installargs=--reset-default-win10 --no-desktop-shortcut --no-taskbar-shortcut --private-browsing --default-search%3Dbing.com" | C:\Users\admin\AppData\Local\Temp\nsfE1A3.tmp\AVGBrowserUpdateSetup.exe | ajDBE7.exe | ||||||||||||
User: admin Company: AVG Technologies Integrity Level: HIGH Description: AVG Browser Setup Exit code: 0 Version: 1.8.1066.0 Modules
| |||||||||||||||
| 3892 | "C:\Program Files\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc | C:\Program Files\AVG\Browser\Update\AVGBrowserUpdate.exe | — | AVGBrowserUpdate.exe | |||||||||||
User: admin Company: AVG Technologies Integrity Level: HIGH Description: AVG Browser Exit code: 0 Version: 1.8.1066.0 Modules
| |||||||||||||||
| 3924 | "C:\Program Files\GUM892.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9205&ap=mv:85.0.5674.85&installargs=--reset-default-win10 --no-desktop-shortcut --no-taskbar-shortcut --private-browsing --default-search%3Dbing.com" | C:\Program Files\GUM892.tmp\AVGBrowserUpdate.exe | AVGBrowserUpdateSetup.exe | ||||||||||||
User: admin Company: AVG Technologies Integrity Level: HIGH Description: AVG Browser Exit code: 0 Version: 1.8.1066.0 Modules
| |||||||||||||||
| 3960 | "C:\Program Files\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver | C:\Program Files\AVG\Browser\Update\AVGBrowserUpdate.exe | — | AVGBrowserUpdate.exe | |||||||||||
User: admin Company: AVG Technologies Integrity Level: HIGH Description: AVG Browser Exit code: 0 Version: 1.8.1066.0 Modules
| |||||||||||||||
Total events
2 600
Read events
916
Write events
1 673
Delete events
11
Modification events
| (PID) Process: | (2292) avg_secure_browser_setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2292) avg_secure_browser_setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2364) ajDBE7.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Browser |
| Operation: | write | Name: | installer_run_count |
Value: 1 | |||
| (PID) Process: | (2364) ajDBE7.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Browser |
| Operation: | write | Name: | machine_id |
Value: 1e3938e28276bbb515d4697f0cb8e646 | |||
| (PID) Process: | (2364) ajDBE7.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2364) ajDBE7.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2364) ajDBE7.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2364) ajDBE7.exe | Key: | HKEY_CURRENT_USER\Software\AVG\Browser |
| Operation: | write | Name: | user_id |
Value: f588215b5ca5468299b0856d2675f843 | |||
| (PID) Process: | (2364) ajDBE7.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (2364) ajDBE7.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 46000000A3000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
Executable files
182
Suspicious files
4
Text files
29
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2292 | avg_secure_browser_setup.exe | C:\Users\admin\AppData\Local\Temp\nscD8CA.tmp\Midex.dll | executable | |
MD5:— | SHA256:— | |||
| 2292 | avg_secure_browser_setup.exe | C:\Users\admin\AppData\Local\Temp\nscD8CA.tmp\StdUtils.dll | executable | |
MD5:— | SHA256:— | |||
| 2292 | avg_secure_browser_setup.exe | C:\Users\admin\AppData\Local\Temp\nscD8CA.tmp\thirdparty.dll | executable | |
MD5:— | SHA256:— | |||
| 2292 | avg_secure_browser_setup.exe | C:\Users\admin\AppData\Local\Temp\nscD8CA.tmp\jsisdl.dll | executable | |
MD5:— | SHA256:— | |||
| 2292 | avg_secure_browser_setup.exe | C:\Users\admin\AppData\Local\Temp\nscD8CA.tmp\ultimateSplash.dll | executable | |
MD5:— | SHA256:— | |||
| 2292 | avg_secure_browser_setup.exe | C:\Users\admin\AppData\Local\Temp\nscD8CA.tmp\inetc.dll | executable | |
MD5:— | SHA256:— | |||
| 2292 | avg_secure_browser_setup.exe | C:\Users\admin\AppData\Local\Temp\nscD8CA.tmp\metered.dll | executable | |
MD5:— | SHA256:— | |||
| 2292 | avg_secure_browser_setup.exe | C:\Users\admin\AppData\Local\Temp\nscD8CA.tmp\NotifyIcon.dll | executable | |
MD5:— | SHA256:— | |||
| 2292 | avg_secure_browser_setup.exe | C:\Users\admin\AppData\Local\Temp\nscD8CA.tmp\nsJSON.dll | executable | |
MD5:— | SHA256:— | |||
| 2292 | avg_secure_browser_setup.exe | C:\Users\admin\AppData\Local\Temp\nscD8CA.tmp\nsProcess.dll | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
5
DNS requests
4
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2364 | ajDBE7.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D | US | der | 471 b | whitelisted |
2364 | ajDBE7.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAUuR5bXg1ZRUP2R%2BXz9yoQ%3D | US | der | 471 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2364 | ajDBE7.exe | 52.205.140.71:443 | stats.avgbrowser.com | Amazon.com, Inc. | US | unknown |
2364 | ajDBE7.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3320 | AVGBrowserUpdate.exe | 3.87.84.72:443 | update.avgbrowser.com | — | US | unknown |
700 | AVGBrowserUpdate.exe | 3.87.84.72:443 | update.avgbrowser.com | — | US | unknown |
700 | AVGBrowserUpdate.exe | 2.16.177.105:443 | browser-update.avg.com | Akamai International B.V. | — | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
stats.avgbrowser.com |
| suspicious |
ocsp.digicert.com |
| whitelisted |
update.avgbrowser.com |
| suspicious |
browser-update.avg.com |
| whitelisted |