File name:

APInstaller.exe

Full analysis: https://app.any.run/tasks/344eaac7-430e-46a7-9c36-3697edbe1130
Verdict: Malicious activity
Analysis date: December 17, 2023, 11:40:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

3074DB81016323D638A2746E3656583C

SHA1:

AB8637D0116C74A077F26A313774F4C120C55600

SHA256:

0F0FA76ABE9971BCB653C333C569FF64BA336181E2F875853ABEBCD84BA757B6

SSDEEP:

24576:h6VnvKVkm+DNRCyvEY9SvD64x1n5L/Q3olBM:h6VnvKVh+DNRCyvEY9A64x15L/Q3olBM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • APInstaller.exe (PID: 548)
      • Adaware-Privacy-Installer.exe (PID: 784)

    • Creates a writable file in the system directory

      • rundll32.exe (PID: 376)

    • Starts NET.EXE for service management

      • Adaware-Privacy-Installer.exe (PID: 784)
      • net.exe (PID: 2892)

    • Actions looks like stealing of personal data

      • Adaware-Privacy.exe (PID: 3092)
      • Adaware-Privacy.exe (PID: 292)

    • Steals credentials from Web Browsers

      • Adaware-Privacy.exe (PID: 3092)

    • Changes the autorun value in the registry

      • Adaware-Privacy.exe (PID: 292)

  • SUSPICIOUS

    • Starts SC.EXE for service management

      • Adaware-Privacy-Installer.exe (PID: 784)
      • cmd.exe (PID: 2492)

    • Searches for installed software

      • Adaware-Privacy-Installer.exe (PID: 784)
      • Adaware-Privacy.exe (PID: 3092)
      • Adaware-Privacy.exe (PID: 292)

    • Reads settings of System Certificates

      • Adaware-Privacy-Installer.exe (PID: 784)
      • Adaware-Privacy.exe (PID: 3092)
      • Adaware-Privacy.exe (PID: 292)

    • Reads the Internet Settings

      • Adaware-Privacy-Installer.exe (PID: 784)
      • runonce.exe (PID: 2588)
      • Adaware-Privacy.exe (PID: 3092)
      • Adaware-Privacy.exe (PID: 292)

    • Drops a system driver (possible attempt to evade defenses)

      • Adaware-Privacy-Installer.exe (PID: 784)
      • rundll32.exe (PID: 376)

    • Uses RUNDLL32.EXE to load library

      • Adaware-Privacy-Installer.exe (PID: 784)

    • Starts CMD.EXE for commands execution

      • AP-Assistant-Service.exe (PID: 2640)
      • Adaware-Privacy-Installer.exe (PID: 784)

    • The process verifies whether the antivirus software is installed

      • rundll32.exe (PID: 376)
      • AP-Assistant-Service.exe (PID: 2640)
      • cmd.exe (PID: 2492)
      • sc.exe (PID: 2360)
      • DCIService.exe (PID: 2840)
      • Adaware-Privacy-Installer.exe (PID: 784)
      • Adaware-Privacy.exe (PID: 3092)
      • Adaware-Privacy.exe (PID: 292)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 2432)
      • cmd.exe (PID: 3000)

    • Executing commands from ".cmd" file

      • Adaware-Privacy-Installer.exe (PID: 784)

    • Executes as Windows Service

      • DCIService.exe (PID: 2840)
      • AP-Assistant-Service.exe (PID: 2640)

    • Changes internet zones settings

      • Adaware-Privacy-Installer.exe (PID: 784)

    • Process drops legitimate windows executable

      • Adaware-Privacy-Installer.exe (PID: 784)

    • The process drops C-runtime libraries

      • Adaware-Privacy-Installer.exe (PID: 784)

  • INFO

    • Checks supported languages

      • APInstaller.exe (PID: 548)
      • Adaware-Privacy-Installer.exe (PID: 784)
      • AP-Assistant-Service.exe (PID: 2640)
      • DCIService.exe (PID: 2840)
      • Adaware-Privacy.exe (PID: 3092)
      • Adaware-Privacy.exe (PID: 292)

    • Reads the computer name

      • Adaware-Privacy-Installer.exe (PID: 784)
      • AP-Assistant-Service.exe (PID: 2640)
      • DCIService.exe (PID: 2840)
      • Adaware-Privacy.exe (PID: 3092)
      • Adaware-Privacy.exe (PID: 292)

    • Reads the machine GUID from the registry

      • Adaware-Privacy-Installer.exe (PID: 784)
      • AP-Assistant-Service.exe (PID: 2640)
      • Adaware-Privacy.exe (PID: 3092)
      • DCIService.exe (PID: 2840)
      • Adaware-Privacy.exe (PID: 292)

    • Reads Environment values

      • Adaware-Privacy-Installer.exe (PID: 784)
      • AP-Assistant-Service.exe (PID: 2640)
      • Adaware-Privacy.exe (PID: 3092)
      • Adaware-Privacy.exe (PID: 292)

    • Create files in a temporary directory

      • APInstaller.exe (PID: 548)
      • Adaware-Privacy-Installer.exe (PID: 784)

    • Creates files in the program directory

      • Adaware-Privacy-Installer.exe (PID: 784)
      • AP-Assistant-Service.exe (PID: 2640)
      • Adaware-Privacy.exe (PID: 3092)
      • DCIService.exe (PID: 2840)
      • Adaware-Privacy.exe (PID: 292)

    • Drops the executable file immediately after the start

      • rundll32.exe (PID: 376)

    • Creates files in the driver directory

      • rundll32.exe (PID: 376)

    • Reads the time zone

      • runonce.exe (PID: 2588)

    • Creates files or folders in the user directory

      • DCIService.exe (PID: 2840)
      • Adaware-Privacy.exe (PID: 3092)
      • Adaware-Privacy-Installer.exe (PID: 784)
      • Adaware-Privacy.exe (PID: 292)

    • Reads product name

      • Adaware-Privacy.exe (PID: 3092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:04:18 20:54:06+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 104448
InitializedDataSize: 136704
UninitializedDataSize: -
EntryPoint: 0x148d4
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.9.0.324
ProductVersionNumber: 1.9.0.324
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileVersion: 1.9.0.324
ProductVersion: 1.9.0.324
OriginalFileName: Adaware Privacy
InternalName: Adaware Privacy
FileDescription: Adaware Privacy
CompanyName: Adaware
LegalCopyright: Adaware Software Canada. All Rights Reserved.
ProductName: Adaware Privacy
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
75
Monitored processes
24
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start apinstaller.exe adaware-privacy-installer.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs ap-assistant-service.exe no specs rundll32.exe no specs cmd.exe no specs netsh.exe no specs runonce.exe no specs grpconv.exe no specs net.exe no specs sc.exe no specs net1.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs dciservice.exe no specs cmd.exe no specs netsh.exe no specs adaware-privacy.exe adaware-privacy.exe apinstaller.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\Desktop\APInstaller.exe" C:\Users\admin\Desktop\APInstaller.exe—explorer.exe
User:
admin
Company:
Adaware
Integrity Level:
MEDIUM
Description:
Adaware Privacy
Exit code:
3221226540
Version:
1.9.0.324
Modules
Images
c:\users\admin\desktop\apinstaller.exe
c:\windows\system32\ntdll.dll
292"C:\Program Files\Adaware\Adaware Privacy\Application\Adaware-Privacy.exe" --afterinstall C:\Program Files\Adaware\Adaware Privacy\Application\Adaware-Privacy.exe
Adaware-Privacy-Installer.exe
User:
admin
Company:
Adaware
Integrity Level:
HIGH
Description:
Adaware Privacy
Exit code:
0
Version:
1.9.0.324
Modules
Images
c:\program files\adaware\adaware privacy\application\adaware-privacy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
376"C:\Windows\system32\RunDLL32.Exe" syssetup,SetupInfObjectInstallAction BootInstall 128 C:\Program Files\Adaware\Adaware Privacy\Service\Win32\bddci.infC:\Windows\System32\rundll32.exe—Adaware-Privacy-Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
548"C:\Users\admin\Desktop\APInstaller.exe" C:\Users\admin\Desktop\APInstaller.exe
explorer.exe
User:
admin
Company:
Adaware
Integrity Level:
HIGH
Description:
Adaware Privacy
Exit code:
0
Version:
1.9.0.324
Modules
Images
c:\users\admin\desktop\apinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
632"sc.exe" description "APAssistantService" "Adaware Privacy Internet security service"C:\Windows\System32\sc.exe—Adaware-Privacy-Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
664netsh http add urlacl url=http://+:8006/ user=EveryoneC:\Windows\System32\netsh.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
784.\Adaware-Privacy-Installer.exe --culture=pt --install --uniqueId=8118fe79-9c62-4dc0-825b-5dd12a92684c --prod --partner=adaware --version=1.9.0.324C:\Users\admin\AppData\Local\Temp\7zS422A461E\Adaware-Privacy-Installer.exe
APInstaller.exe
User:
admin
Company:
Adaware
Integrity Level:
HIGH
Description:
Adaware Privacy
Exit code:
0
Version:
1.9.0.324
Modules
Images
c:\users\admin\appdata\local\temp\7zs422a461e\adaware-privacy-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1220"sc.exe" description "DCIService" "Webprotection Bridge service"C:\Windows\System32\sc.exe—Adaware-Privacy-Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1992C:\Windows\system32\net1 start bddciC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
2096"sc.exe" failure APAssistantService reset= 30 actions= restart/60000C:\Windows\System32\sc.exe—Adaware-Privacy-Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
25 586
Read events
25 410
Write events
175
Delete events
1

Modification events

(PID) Process:(784) Adaware-Privacy-Installer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(784) Adaware-Privacy-Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Explorer.EXE
(PID) Process:(784) Adaware-Privacy-Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(784) Adaware-Privacy-Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(784) Adaware-Privacy-Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(784) Adaware-Privacy-Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2640) AP-Assistant-Service.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2640) AP-Assistant-Service.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2588) runonce.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:delete valueName:GrpConv
Value:
grpconv -o
(PID) Process:(664) netsh.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
188
Suspicious files
120
Text files
78
Unknown types
0

Dropped files

PID
Process
Filename
Type
548APInstaller.exeC:\Users\admin\AppData\Local\Temp\7zS422A461E\fr-CA\Adaware-Privacy-Installer.resources.dllexecutable
MD5:BC19C69C570E8566EF986AD642542508
SHA256:29A0E3C5336979BA707EB489A46513985D8A27E6E2877A160A46A003F6152F6E
548APInstaller.exeC:\Users\admin\AppData\Local\Temp\7zS422A461E\ja-JP\Adaware-Privacy-Installer.resources.dllexecutable
MD5:19645041D54B5A9B0AA15D5E22AD75B1
SHA256:5825A5FED5E264D6D5014DAF67F54AEBA828FB5BE3A2F7BC7C7D6E8FB81D02AF
548APInstaller.exeC:\Users\admin\AppData\Local\Temp\7zS422A461E\tr-TR\Adaware-Privacy-Installer.resources.dllexecutable
MD5:DDE89709D2A1F3B9B695F1B617E76CCB
SHA256:A6868A4535D9D9E09F6990755C8BAC5F13CBE387859289CCF86786F8EDA23CBF
548APInstaller.exeC:\Users\admin\AppData\Local\Temp\7zS422A461E\Adaware-Privacy-Installer.exe.configxml
MD5:507A0F6B4A28174B14CC9995CC212CC2
SHA256:B9171F9325E78517C086A1F0E4723EF6AAF75BB047252884D05FDC3A168B2040
548APInstaller.exeC:\Users\admin\AppData\Local\Temp\7zS422A461E\Newtonsoft.Json.dllexecutable
MD5:F4603EF5D9B8268796D9324873C55131
SHA256:254CBF014D0AB77B08FBE483F8F65D3B903A7B341B930B596C4806B49E1DED4B
548APInstaller.exeC:\Users\admin\AppData\Local\Temp\7zS422A461E\zh-CHS\Adaware-Privacy-Installer.resources.dllexecutable
MD5:C82AA7BA067A9182CB5479E9903BB9A0
SHA256:C8EAEDA368A64F7B6BE1DE33F1097DFD5D1DF04E08403CD2C4E6F09BA7E13E83
548APInstaller.exeC:\Users\admin\AppData\Local\Temp\7zS422A461E\ru-RU\Adaware-Privacy-Installer.resources.dllexecutable
MD5:906DF3550175A6A07844AEC13A621E14
SHA256:EF4B4306A231CDF908D4C9BE978E8A3D95BCEB70A15EAE6F26E81D61EE7EDFB7
784Adaware-Privacy-Installer.exeC:\Program Files\Adaware\Adaware Privacy\Application\Adaware-Privacy.exeexecutable
MD5:639C6C530F8DE5566C84DDFDACB20130
SHA256:58D2BE02D53BA3DE6846189127597586E541097EB40F4933CCD404646DE43815
784Adaware-Privacy-Installer.exeC:\Program Files\Adaware\Adaware Privacy\Application\Adaware-Privacy-Installer.exeexecutable
MD5:8087B2250B5BD3BDD12A739DD03BCBB7
SHA256:4F2F597697F51F0CEE2371B226DC5B6086AD8F33AE1745319896340C321BA847
784Adaware-Privacy-Installer.exeC:\Users\admin\AppData\Local\Temp\AdawarePrivacy.zipcompressed
MD5:309898CE0AD47767BF5F2D5054555F3E
SHA256:FD81DF168DE09BEDD165128A56E74E92E11DD4BE8628752969AA7E18C3C2A216
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
18
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
784
Adaware-Privacy-Installer.exe
GET
200
104.17.8.52:80
http://geo.lavasoft.com/
unknown
binary
50 b
unknown
784
Adaware-Privacy-Installer.exe
GET
200
104.17.8.52:80
http://geo.lavasoft.com/
unknown
binary
50 b
unknown
3092
Adaware-Privacy.exe
GET
302
104.18.68.73:80
http://adaware.com/version_logs?json=true&version=1.9.0.324
unknown
—
—
unknown
3092
Adaware-Privacy.exe
GET
200
104.17.9.52:80
http://geo.lavasoft.com/
unknown
binary
50 b
unknown
3092
Adaware-Privacy.exe
GET
200
104.17.9.52:80
http://geo.lavasoft.com/
unknown
binary
50 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
784
Adaware-Privacy-Installer.exe
104.18.27.149:443
flwadw.com
CLOUDFLARENET
—
shared
784
Adaware-Privacy-Installer.exe
104.18.68.73:443
download.adaware.com
CLOUDFLARENET
—
unknown
784
Adaware-Privacy-Installer.exe
104.17.8.52:80
geo.lavasoft.com
CLOUDFLARENET
—
shared
784
Adaware-Privacy-Installer.exe
104.17.8.52:443
geo.lavasoft.com
CLOUDFLARENET
—
shared
3092
Adaware-Privacy.exe
104.17.9.52:80
geo.lavasoft.com
CLOUDFLARENET
—
shared
3092
Adaware-Privacy.exe
104.17.8.52:443
geo.lavasoft.com
CLOUDFLARENET
—
shared
3092
Adaware-Privacy.exe
104.18.27.149:443
flwadw.com
CLOUDFLARENET
—
shared
3092
Adaware-Privacy.exe
104.18.67.73:443
download.adaware.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
flwadw.com
  • 104.18.27.149
  • 104.18.26.149
unknown
download.adaware.com
  • 104.18.68.73
  • 104.18.67.73
unknown
geo.lavasoft.com
  • 104.17.8.52
  • 104.17.9.52
unknown
featureflags.lavasoft.com
  • 104.17.8.52
  • 104.17.9.52
unknown
rt.adaware.com
  • 104.18.68.73
  • 104.18.67.73
unknown
acs.lavasoft.com
  • 104.17.8.52
  • 104.17.9.52
unknown
acscdn.lavasoft.com
  • 104.17.8.52
  • 104.17.9.52
unknown
sg-bitmask.adaware.com
  • 104.18.67.73
  • 104.18.68.73
unknown
adaware.com
  • 104.18.68.73
  • 104.18.67.73
whitelisted
www.adaware.com
  • 104.18.67.73
  • 104.18.68.73
unknown

Threats

No threats detected
Process
Message
Adaware-Privacy-Installer.exe
Detecting windows culture
Adaware-Privacy-Installer.exe
12/17/2023 11:40:20 AM :-> SendIPTracking: get uniqueId= 8118fe79-9c62-4dc0-825b-5dd12a92684c
Adaware-Privacy-Installer.exe
12/17/2023 11:40:20 AM :-> SendIPTracking:lastModified: 12/17/2023 11:40:19 AM
Adaware-Privacy-Installer.exe
12/17/2023 11:40:20 AM :-> SendIPTracking: file name: C:\Users\admin\Desktop\APInstaller.exe
Adaware-Privacy-Installer.exe
12/17/2023 11:40:20 AM :-> SendIPTracking: get modifiedDate= 2023-12-17T11:40:19.0141250Z
Adaware-Privacy-Installer.exe
12/17/2023 11:40:20 AM :-> SendIPTracking: Process found
Adaware-Privacy-Installer.exe
12/17/2023 11:40:20 AM :-> Preprare request for IPTracking. URL: https://download.adaware.com/Track?uniqueId=8118fe79-9c62-4dc0-825b-5dd12a92684c&downloadedDate=2023-12-17T11%3A40%3A19.0141250Z
Adaware-Privacy-Installer.exe
12/17/2023 11:40:22 AM :-> response for IPTracking. response: Status.Ok
Adaware-Privacy-Installer.exe
12/17/2023 11:40:23 AM :-> SendIPTracking: Send Tracking info
Adaware-Privacy-Installer.exe
Preparing request for featureflag: {"Geo":"DE","Partner":"adaware","Campaign":"NA","InstallDate":"20231217","TriggerType":"install","TriggerEvent":"installer","Version":"1.9.0.324","featurewp":true,"featureal":true}
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
APInstaller.exe