URL:

http://update.iobit.com/dl/ascu12/asc-ultimate-setup-beta.exe

Full analysis: https://app.any.run/tasks/3f3cbdf0-93e5-4dc7-861a-68fab4306687
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: December 10, 2018, 13:12:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
Indicators:
MD5:

CD2AFA72DC031FD1028A59A4429D8A6F

SHA1:

687E154CB638B8F64E2A40F37650EEDA9ED465A3

SHA256:

300F98DDF914B4F09C4C3C2509D61C1F8B492B55B46D50DD78D6BA94B5565E37

SSDEEP:

3:N1KLQRAMzP++WGtBCjAi0dA:CUnSp+wAi0dA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Setup.exe (PID: 2852)
      • IWsASC.exe (PID: 1596)
      • LocalLang.exe (PID: 3288)
      • IWsASC.exe (PID: 1768)
      • ascavsvc.exe (PID: 3916)
      • ASCInit.exe (PID: 2060)
      • ASCService.exe (PID: 2432)
      • ASCAvWsc.exe (PID: 2656)
      • ASCAntivirusFix.exe (PID: 3600)
      • Ransomware.exe (PID: 1148)
      • Suo12_StartupManager.exe (PID: 3996)
      • ASCAvWsc.exe (PID: 3436)
      • Display.exe (PID: 4044)
      • IWsASC.exe (PID: 3392)
      • Suo12_StartupManager.exe (PID: 2528)
      • LocalLang.exe (PID: 3488)
      • smBootTime.exe (PID: 3268)
      • LocalLang.exe (PID: 3216)
      • DiskDefrag.exe (PID: 1004)
      • PPUninstaller.exe (PID: 3052)
      • FWRules.exe (PID: 4028)
      • UninstallPromote.exe (PID: 3060)
      • Display.exe (PID: 2948)
      • IWsASC.exe (PID: 2648)
      • IWsASC.exe (PID: 3456)
      • BrowserProtect.exe (PID: 2776)
      • ASC.exe (PID: 3900)
      • Monitor.exe (PID: 1960)
      • IWsASC.exe (PID: 864)
      • smBootTime.exe (PID: 2704)
      • Suo12_StartupManager.exe (PID: 2556)
      • ASCAntivirusFix.exe (PID: 3136)
      • ASCTray.exe (PID: 2232)
      • IWsASC.exe (PID: 1080)
      • ASCFeature.exe (PID: 916)
      • AutoUpdate.exe (PID: 3356)
      • ASCFeature.exe (PID: 2492)
      • IWsASC.exe (PID: 3056)
      • AutoCare.exe (PID: 2860)
      • IWsASC.exe (PID: 2180)
      • IWsASC.exe (PID: 1428)
      • IWsASC.exe (PID: 2644)
      • IWsASC.exe (PID: 1900)
      • IWsASC.exe (PID: 4092)
      • IWsASC.exe (PID: 352)
      • IObitLiveUpdate.exe (PID: 3628)
      • AutoSweep.exe (PID: 3064)
      • startupInfo.exe (PID: 3012)
      • Suo12_StartupManager.exe (PID: 2652)
      • IWsASC.exe (PID: 3336)
      • IWsASC.exe (PID: 1864)
      • IWsASC.exe (PID: 3756)
      • display.exe (PID: 3992)
      • Suo12_StartupManager.exe (PID: 2732)
      • MonitorDisk.exe (PID: 3880)
      • ASCAntivirusFix.exe (PID: 2380)

    • Loads dropped or rewritten executable

      • ASCInit.exe (PID: 2060)
      • ASCAvWsc.exe (PID: 2656)
      • Ransomware.exe (PID: 1148)
      • ascavsvc.exe (PID: 3916)
      • ASCService.exe (PID: 2432)
      • ASCAntivirusFix.exe (PID: 3600)
      • ASCAvWsc.exe (PID: 3436)
      • Suo12_StartupManager.exe (PID: 3996)
      • regsvr32.exe (PID: 3124)
      • smBootTime.exe (PID: 3268)
      • Display.exe (PID: 4044)
      • UninstallPromote.exe (PID: 3060)
      • Suo12_StartupManager.exe (PID: 2528)
      • PPUninstaller.exe (PID: 3052)
      • Setup.exe (PID: 2852)
      • Display.exe (PID: 2948)
      • BrowserProtect.exe (PID: 2776)
      • ASC.exe (PID: 3900)
      • Monitor.exe (PID: 1960)
      • Suo12_StartupManager.exe (PID: 2556)
      • ASCAntivirusFix.exe (PID: 3136)
      • ASCFeature.exe (PID: 916)
      • smBootTime.exe (PID: 2704)
      • ASCTray.exe (PID: 2232)
      • AutoUpdate.exe (PID: 3356)
      • AutoSweep.exe (PID: 3064)
      • ASCFeature.exe (PID: 2492)
      • AutoCare.exe (PID: 2860)
      • startupInfo.exe (PID: 3012)
      • Suo12_StartupManager.exe (PID: 2652)
      • IObitLiveUpdate.exe (PID: 3628)
      • display.exe (PID: 3992)
      • Suo12_StartupManager.exe (PID: 2732)
      • ASCAntivirusFix.exe (PID: 2380)
      • MonitorDisk.exe (PID: 3880)

    • Loads the Task Scheduler COM API

      • ASCInit.exe (PID: 2060)
      • smBootTime.exe (PID: 3268)
      • Setup.exe (PID: 2852)
      • ASC.exe (PID: 3900)
      • smBootTime.exe (PID: 2704)
      • Suo12_StartupManager.exe (PID: 2652)
      • Suo12_StartupManager.exe (PID: 2732)

    • Changes the autorun value in the registry

      • ASCInit.exe (PID: 2060)

    • Registers / Runs the DLL via REGSVR32.EXE

      • ASCInit.exe (PID: 2060)

    • Starts NET.EXE for service management

      • ascavsvc.exe (PID: 3916)
      • ASCService.exe (PID: 2432)

    • Actions looks like stealing of personal data

      • ASC.exe (PID: 3900)

  • SUSPICIOUS

    • Reads the Windows organization settings

      • asc-ultimate-setup-beta[1].tmp (PID: 3496)
      • asc-ultimate-setup-beta[1].tmp (PID: 3372)

    • Creates files in the user directory

      • ASCUpgrade.exe (PID: 1544)
      • asc-ultimate-setup-beta[1].tmp (PID: 3372)
      • ASCInit.exe (PID: 2060)
      • ASCService.exe (PID: 2432)
      • ASC.exe (PID: 3900)
      • ASCTray.exe (PID: 2232)
      • PPUninstaller.exe (PID: 3052)
      • Suo12_StartupManager.exe (PID: 2652)
      • Suo12_StartupManager.exe (PID: 2732)

    • Executable content was dropped or overwritten

      • asc-ultimate-setup-beta[1].tmp (PID: 3496)
      • asc-ultimate-setup-beta[1].exe (PID: 3096)
      • asc-ultimate-setup-beta[1].exe (PID: 1776)
      • asc-ultimate-setup-beta[1].exe (PID: 3028)
      • ASCInit.exe (PID: 2060)
      • asc-ultimate-setup-beta[1].tmp (PID: 3372)
      • ascavsvc.exe (PID: 3916)
      • Monitor.exe (PID: 1960)

    • Reads Windows owner or organization settings

      • asc-ultimate-setup-beta[1].tmp (PID: 3496)
      • asc-ultimate-setup-beta[1].tmp (PID: 3372)

    • Creates files in the program directory

      • Setup.exe (PID: 2852)
      • ASCInit.exe (PID: 2060)
      • ascavsvc.exe (PID: 3916)
      • ASCAvWsc.exe (PID: 2656)
      • Ransomware.exe (PID: 1148)
      • ASCService.exe (PID: 2432)
      • smBootTime.exe (PID: 3268)
      • Suo12_StartupManager.exe (PID: 3996)
      • Display.exe (PID: 4044)
      • Suo12_StartupManager.exe (PID: 2528)
      • UninstallPromote.exe (PID: 3060)
      • BrowserProtect.exe (PID: 2776)
      • ASC.exe (PID: 3900)
      • AutoSweep.exe (PID: 3064)
      • AutoCare.exe (PID: 2860)
      • IObitLiveUpdate.exe (PID: 3628)
      • Suo12_StartupManager.exe (PID: 2652)
      • Suo12_StartupManager.exe (PID: 2732)
      • AutoUpdate.exe (PID: 3356)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • ASCInit.exe (PID: 2060)

    • Starts CMD.EXE for commands execution

      • ASCInit.exe (PID: 2060)
      • ASC.exe (PID: 3900)

    • Removes files from Windows directory

      • ascavsvc.exe (PID: 3916)
      • ASCService.exe (PID: 2432)
      • Suo12_StartupManager.exe (PID: 3996)
      • ASC.exe (PID: 3900)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3480)
      • cmd.exe (PID: 3784)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 3124)

    • Creates files in the driver directory

      • ascavsvc.exe (PID: 3916)

    • Creates or modifies windows services

      • ascavsvc.exe (PID: 3916)

    • Creates files in the Windows directory

      • ascavsvc.exe (PID: 3916)
      • ASCService.exe (PID: 2432)
      • Monitor.exe (PID: 1960)

    • Searches for installed software

      • ascavsvc.exe (PID: 3916)
      • IObitLiveUpdate.exe (PID: 3628)
      • ASCService.exe (PID: 2432)

    • Low-level read access rights to disk partition

      • Monitor.exe (PID: 1960)
      • ASC.exe (PID: 3900)
      • AutoUpdate.exe (PID: 3356)
      • ascavsvc.exe (PID: 3916)

    • Reads Environment values

      • Monitor.exe (PID: 1960)

    • Uses IPCONFIG.EXE to discover IP address

      • cmd.exe (PID: 4036)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2744)

    • Application was dropped or rewritten from another process

      • asc-ultimate-setup-beta[1].tmp (PID: 3496)
      • asc-ultimate-setup-beta[1].tmp (PID: 3176)
      • asc-ultimate-setup-beta[1].tmp (PID: 3372)
      • ASCUpgrade.exe (PID: 1544)
      • DownConfig.exe (PID: 1432)
      • ASCUpgrade.exe (PID: 3720)

    • Changes internet zones settings

      • iexplore.exe (PID: 2744)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3292)
      • iexplore.exe (PID: 2744)

    • Loads dropped or rewritten executable

      • ASCUpgrade.exe (PID: 1544)
      • asc-ultimate-setup-beta[1].tmp (PID: 3496)
      • asc-ultimate-setup-beta[1].tmp (PID: 3372)
      • ASCUpgrade.exe (PID: 3720)

    • Creates a software uninstall entry

      • asc-ultimate-setup-beta[1].tmp (PID: 3372)

    • Dropped object may contain Bitcoin addresses

      • asc-ultimate-setup-beta[1].tmp (PID: 3372)
      • ASC.exe (PID: 3900)
      • AutoUpdate.exe (PID: 3356)
      • Suo12_StartupManager.exe (PID: 2732)

    • Creates files in the program directory

      • asc-ultimate-setup-beta[1].tmp (PID: 3372)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
81
Malicious processes
21
Suspicious processes
17

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe asc-ultimate-setup-beta[1].exe asc-ultimate-setup-beta[1].tmp no specs asc-ultimate-setup-beta[1].exe asc-ultimate-setup-beta[1].tmp setup.exe asc-ultimate-setup-beta[1].exe asc-ultimate-setup-beta[1].tmp ascupgrade.exe no specs ascupgrade.exe locallang.exe no specs downconfig.exe no specs iwsasc.exe no specs iwsasc.exe no specs ascinit.exe ascavsvc.exe ransomware.exe cmd.exe no specs ascavwsc.exe no specs ascservice.exe ascantivirusfix.exe sc.exe no specs cmd.exe no specs suo12_startupmanager.exe no specs regsvr32.exe no specs sc.exe no specs ascavwsc.exe no specs display.exe iwsasc.exe no specs smboottime.exe locallang.exe no specs locallang.exe no specs SPPSurrogate no specs ppuninstaller.exe diskdefrag.exe no specs suo12_startupmanager.exe no specs fwrules.exe no specs iwsasc.exe no specs uninstallpromote.exe net.exe no specs display.exe iwsasc.exe no specs browserprotect.exe net1.exe no specs asc.exe monitor.exe net.exe no specs net1.exe no specs smboottime.exe iwsasc.exe no specs suo12_startupmanager.exe no specs ascantivirusfix.exe asctray.exe ascfeature.exe no specs iwsasc.exe no specs ascfeature.exe autoupdate.exe autosweep.exe no specs iwsasc.exe no specs iwsasc.exe no specs iwsasc.exe no specs iwsasc.exe no specs iwsasc.exe no specs iwsasc.exe no specs iwsasc.exe no specs autocare.exe no specs iobitliveupdate.exe startupinfo.exe iwsasc.exe no specs suo12_startupmanager.exe no specs iwsasc.exe no specs iwsasc.exe no specs ascantivirusfix.exe cmd.exe no specs ipconfig.exe no specs display.exe net.exe no specs net1.exe no specs suo12_startupmanager.exe monitordisk.exe

Process information

PID
CMD
Path
Indicators
Parent process
352"C:\Program Files\IObit\Advanced SystemCare Ultimate\IWsASC.exe" /onoutC:\Program Files\IObit\Advanced SystemCare Ultimate\IWsASC.exe—ASCAvWsc.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\program files\iobit\advanced systemcare ultimate\iwsasc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
864"C:\Program Files\IObit\Advanced SystemCare Ultimate\IWsASC.exe" /onoutC:\Program Files\IObit\Advanced SystemCare Ultimate\IWsASC.exe—ASCAvWsc.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\program files\iobit\advanced systemcare ultimate\iwsasc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
916"C:\Program Files\IObit\Advanced SystemCare Ultimate\ASCFeature.exe" /av /userC:\Program Files\IObit\Advanced SystemCare Ultimate\ASCFeature.exe—ASC.exe
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
IObit ASCFeature
Exit code:
0
Version:
12.1.0.450
Modules
Images
c:\program files\iobit\advanced systemcare ultimate\ascfeature.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\iobit\advanced systemcare ultimate\rtl120.bpl
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
992C:\Windows\system32\net1 start ASCAntivirusSrvC:\Windows\system32\net1.exe—net.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
1004"C:\Program Files\IObit\Advanced SystemCare Ultimate\DiskDefrag.exe" /installC:\Program Files\IObit\Advanced SystemCare Ultimate\DiskDefrag.exe—asc-ultimate-setup-beta[1].tmp
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
Advanced SystemCare Disk Defrag
Exit code:
0
Version:
1.0.0.11
Modules
Images
c:\program files\iobit\advanced systemcare ultimate\diskdefrag.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\iobit\advanced systemcare ultimate\rtl120.bpl
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1080C:\Windows\system32\net1 start AdvancedSystemCareService12C:\Windows\system32\net1.exe—net.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
1080"C:\Program Files\IObit\Advanced SystemCare Ultimate\IWsASC.exe" /onoutC:\Program Files\IObit\Advanced SystemCare Ultimate\IWsASC.exe—ASCAvWsc.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\windows\system32\nsi.dll
c:\windows\system32\ntdsapi.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\browcli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\systemroot\system32\ntdll.dll
1148"C:\Program Files\IObit\Advanced SystemCare Ultimate\Ransomware.exe" /initC:\Program Files\IObit\Advanced SystemCare Ultimate\Ransomware.exe
ascavsvc.exe
User:
SYSTEM
Company:
IObit
Integrity Level:
SYSTEM
Description:
Advanced SystemCare Ultimate - Anti-ransomware
Exit code:
0
Version:
12.0.0.63
Modules
Images
c:\program files\iobit\advanced systemcare ultimate\ransomware.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\iobit\advanced systemcare ultimate\rtl120.bpl
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
1376C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1428"C:\Program Files\IObit\Advanced SystemCare Ultimate\IWsASC.exe" /onoutC:\Program Files\IObit\Advanced SystemCare Ultimate\IWsASC.exe—ASCAvWsc.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\program files\iobit\advanced systemcare ultimate\iwsasc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
9 015
Read events
8 141
Write events
822
Delete events
52

Modification events

(PID) Process:(2744) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2744) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2744) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2744) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2744) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2744) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2744) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{504DE97B-FC7D-11E8-834A-5254004A04AF}
Value:
0
(PID) Process:(2744) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2744) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
3
(PID) Process:(2744) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E2070C0001000A000D000C003B004902
Executable files
190
Suspicious files
92
Text files
2 969
Unknown types
572

Dropped files

PID
Process
Filename
Type
2744iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFECD7965E748BEBEE.TMP —
MD5:—
SHA256:—
2744iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
2744iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3292iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\asc-ultimate-setup-beta[1].exe —
MD5:—
SHA256:—
2744iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\asc-ultimate-setup-beta[1].exe —
MD5:—
SHA256:—
2744iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF47194C79205CDC67.TMP —
MD5:—
SHA256:—
2744iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{504DE97B-FC7D-11E8-834A-5254004A04AF}.dat —
MD5:—
SHA256:—
2744iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{504DE97C-FC7D-11E8-834A-5254004A04AF}.datbinary
MD5:—
SHA256:—
3292iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012018121020181211\index.datdat
MD5:—
SHA256:—
2744iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018121020181211\index.datdat
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
2
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3292
iexplore.exe
GET
—
93.184.221.133:80
http://update.iobit.com/dl/ascu12/asc-ultimate-setup-beta.exe
US
—
—
whitelisted
2744
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2744
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3292
iexplore.exe
93.184.221.133:80
update.iobit.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
update.iobit.com
  • 93.184.221.133
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

PID
Process
Class
Message
3292
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3060
UninstallPromote.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.AdvancedSystemCare
3356
AutoUpdate.exe
A Network Trojan was detected
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3356
AutoUpdate.exe
A Network Trojan was detected
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3356
AutoUpdate.exe
A Network Trojan was detected
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3356
AutoUpdate.exe
A Network Trojan was detected
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3356
AutoUpdate.exe
A Network Trojan was detected
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3356
AutoUpdate.exe
A Network Trojan was detected
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3356
AutoUpdate.exe
A Network Trojan was detected
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3356
AutoUpdate.exe
A Network Trojan was detected
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
Process
Message
Setup.exe
************** Win32MinorVersion: 1
Setup.exe
C:\Users\admin\AppData\Roaming\IObit\Advanced SystemCare\
Setup.exe
********** FLanguageName: English
Setup.exe
GetDownloadPath: 1
Setup.exe
GetDownloadPath: 1
Setup.exe
CheckDiskSpace: 1
Setup.exe
CheckDiskSpace: 1
Setup.exe
CheckDiskSpace: 2
Setup.exe
CheckDiskSpace: 3
Setup.exe
CheckDiskSpace: 4
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://update.iobit.com/dl/ascu12/asc-ultimate-setup-beta.exe