File name:

bloodshed-dev-c_QI-JOJ1.exe

Full analysis: https://app.any.run/tasks/17bc8f4b-3979-4048-9337-711d68959abb
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: April 14, 2025, 10:01:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
inno
installer
adware
innosetup
stealer
evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

420892AAD975D6F15CD31BFC900B59E2

SHA1:

D93014598AE871B4A58E971A3803BC4A1F16A0F8

SHA256:

36D846B726B75F18A6FAAC652A3D0EF0DDB92E131802C1CCE0DA3224FB043D5D

SSDEEP:

98304:7rq3BdwBpSn/pNE1dJ3Hnbfc1zEnxBy3XwqhZOYcSSZRrY+04eMZmyMXecaJsB6R:177lNGl5wdP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • INNOSETUP has been detected (SURICATA)

      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)

    • Actions looks like stealing of personal data

      • servicehost.exe (PID: 7320)
      • uihost.exe (PID: 7580)
      • aswEngSrv.exe (PID: 9040)
      • AVGSvc.exe (PID: 4244)

    • Steals credentials from Web Browsers

      • servicehost.exe (PID: 7320)
      • AVGSvc.exe (PID: 4244)

    • Changes the autorun value in the registry

      • icarus.exe (PID: 7296)

    • Antivirus name has been found in the command line (generic signature)

      • AVGUI.exe (PID: 9124)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • bloodshed-dev-c_QI-JOJ1.exe (PID: 4776)
      • bloodshed-dev-c_QI-JOJ1.exe (PID: 7280)
      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)
      • avg_antivirus_free_setup.exe (PID: 7976)
      • saBSI.exe (PID: 7908)
      • avg_antivirus_free_online_setup.exe (PID: 8060)
      • saBSI.exe (PID: 8108)
      • installer.exe (PID: 2100)
      • icarus.exe (PID: 6252)
      • icarus.exe (PID: 7296)
      • Embarcadero_Dev-Cpp_6.3_TDM-GCC 9.2_Setup.exe (PID: 7188)
      • installer.exe (PID: 208)
      • icarus.exe (PID: 7364)
      • engsup.exe (PID: 7968)
      • AvEmUpdate.exe (PID: 3332)
      • AVGSvc.exe (PID: 4244)

    • Reads security settings of Internet Explorer

      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 2140)
      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)
      • saBSI.exe (PID: 7908)
      • saBSI.exe (PID: 8108)
      • WinRAR.exe (PID: 8160)
      • installer.exe (PID: 208)
      • uihost.exe (PID: 7580)
      • AVGSvc.exe (PID: 4244)

    • Reads the Windows owner or organization settings

      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)

    • Access to an unwanted program domain was detected

      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)

    • There is functionality for taking screenshot (YARA)

      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)
      • avg_antivirus_free_setup.exe (PID: 7976)
      • Embarcadero_Dev-Cpp_6.3_TDM-GCC 9.2_Setup.exe (PID: 7188)

    • Adds/modifies Windows certificates

      • saBSI.exe (PID: 7908)
      • servicehost.exe (PID: 7320)
      • AVGSvc.exe (PID: 4244)

    • The process verifies whether the antivirus software is installed

      • saBSI.exe (PID: 8108)
      • installer.exe (PID: 2100)
      • installer.exe (PID: 208)
      • icarus.exe (PID: 7296)
      • servicehost.exe (PID: 7320)
      • uihost.exe (PID: 7580)
      • cmd.exe (PID: 8812)
      • icarus.exe (PID: 7364)
      • updater.exe (PID: 8720)
      • cmd.exe (PID: 8880)
      • engsup.exe (PID: 7968)
      • SetupInf.exe (PID: 7880)
      • SetupInf.exe (PID: 4436)
      • SetupInf.exe (PID: 8408)
      • SetupInf.exe (PID: 8528)
      • AvEmUpdate.exe (PID: 8968)
      • SetupInf.exe (PID: 7532)
      • SetupInf.exe (PID: 8504)
      • AvEmUpdate.exe (PID: 3332)
      • msedge.exe (PID: 8124)
      • msedge.exe (PID: 7536)
      • RegSvr.exe (PID: 7592)
      • RegSvr.exe (PID: 8696)
      • SetupInf.exe (PID: 856)
      • wsc_proxy.exe (PID: 7236)
      • avgToolsSvc.exe (PID: 8336)
      • wsc_proxy.exe (PID: 7124)
      • AVGSvc.exe (PID: 4244)
      • aswEngSrv.exe (PID: 9040)
      • aswidsagent.exe (PID: 6712)
      • icarus.exe (PID: 5544)
      • AVGUI.exe (PID: 9124)
      • icarus.exe (PID: 7500)
      • afwServ.exe (PID: 8148)

    • Executes application which crashes

      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)

    • Starts itself from another location

      • icarus.exe (PID: 6252)

    • The process creates files with name similar to system file names

      • installer.exe (PID: 208)
      • icarus.exe (PID: 7296)
      • Embarcadero_Dev-Cpp_6.3_TDM-GCC 9.2_Setup.exe (PID: 7188)

    • Creates/Modifies COM task schedule object

      • installer.exe (PID: 208)
      • icarus.exe (PID: 7296)
      • RegSvr.exe (PID: 7592)
      • RegSvr.exe (PID: 8696)

    • Process drops legitimate windows executable

      • icarus.exe (PID: 7296)
      • installer.exe (PID: 208)
      • engsup.exe (PID: 7968)

    • Creates a software uninstall entry

      • installer.exe (PID: 208)
      • Embarcadero_Dev-Cpp_6.3_TDM-GCC 9.2_Setup.exe (PID: 7188)
      • servicehost.exe (PID: 7320)
      • icarus.exe (PID: 7296)

    • Process drops python dynamic module

      • Embarcadero_Dev-Cpp_6.3_TDM-GCC 9.2_Setup.exe (PID: 7188)

    • Executes as Windows Service

      • servicehost.exe (PID: 7320)
      • wsc_proxy.exe (PID: 7124)
      • afwServ.exe (PID: 8148)
      • AVGSvc.exe (PID: 4244)
      • avgToolsSvc.exe (PID: 8336)
      • aswidsagent.exe (PID: 6712)

    • The process drops C-runtime libraries

      • icarus.exe (PID: 7296)
      • engsup.exe (PID: 7968)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Embarcadero_Dev-Cpp_6.3_TDM-GCC 9.2_Setup.exe (PID: 7188)

    • Reads Mozilla Firefox installation path

      • servicehost.exe (PID: 7320)
      • uihost.exe (PID: 7580)

    • Starts CMD.EXE for commands execution

      • updater.exe (PID: 8720)

    • Drops a system driver (possible attempt to evade defenses)

      • icarus.exe (PID: 7296)
      • engsup.exe (PID: 7968)
      • AvEmUpdate.exe (PID: 3332)

    • Searches for installed software

      • updater.exe (PID: 8720)

    • Creates files in the driver directory

      • engsup.exe (PID: 7968)
      • icarus.exe (PID: 7296)
      • AvEmUpdate.exe (PID: 3332)

    • Process checks presence of unattended files

      • icarus.exe (PID: 7296)

    • Creates or modifies Windows services

      • icarus.exe (PID: 7296)

    • Checks for external IP

      • AvEmUpdate.exe (PID: 3332)
      • avgToolsSvc.exe (PID: 8336)
      • AVGSvc.exe (PID: 4244)

    • Modifies hosts file to alter network resolution

      • AVGSvc.exe (PID: 4244)

    • Reads the date of Windows installation

      • aswidsagent.exe (PID: 6712)

    • Read startup parameters

      • aswidsagent.exe (PID: 6712)

    • Checks for Java to be installed

      • AVGSvc.exe (PID: 4244)

  • INFO

    • Reads the computer name

      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 2140)
      • bloodshed-dev-c_QI-JOJ1.exe (PID: 7280)
      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)
      • saBSI.exe (PID: 7908)
      • avg_antivirus_free_setup.exe (PID: 7976)
      • avg_antivirus_free_online_setup.exe (PID: 8060)
      • saBSI.exe (PID: 8108)
      • icarus.exe (PID: 6252)
      • icarus.exe (PID: 7364)
      • icarus.exe (PID: 7296)
      • Embarcadero_Dev-Cpp_6.3_TDM-GCC 9.2_Setup.exe (PID: 7188)
      • installer.exe (PID: 208)
      • identity_helper.exe (PID: 6712)
      • servicehost.exe (PID: 7320)
      • uihost.exe (PID: 7580)
      • updater.exe (PID: 8720)
      • engsup.exe (PID: 7968)
      • SetupInf.exe (PID: 7880)
      • SetupInf.exe (PID: 4436)
      • SetupInf.exe (PID: 8408)
      • SetupInf.exe (PID: 7532)
      • SetupInf.exe (PID: 8504)
      • SetupInf.exe (PID: 8528)
      • AvEmUpdate.exe (PID: 8968)
      • AvEmUpdate.exe (PID: 3332)
      • RegSvr.exe (PID: 7592)
      • RegSvr.exe (PID: 8696)
      • SetupInf.exe (PID: 856)
      • wsc_proxy.exe (PID: 7236)
      • afwServ.exe (PID: 8148)
      • AVGSvc.exe (PID: 4244)
      • avgToolsSvc.exe (PID: 8336)
      • aswidsagent.exe (PID: 6712)
      • icarus.exe (PID: 7500)
      • icarus.exe (PID: 5544)
      • AVGUI.exe (PID: 9124)
      • wsc_proxy.exe (PID: 7124)

    • Checks supported languages

      • bloodshed-dev-c_QI-JOJ1.exe (PID: 4776)
      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 2140)
      • bloodshed-dev-c_QI-JOJ1.exe (PID: 7280)
      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)
      • saBSI.exe (PID: 7908)
      • avg_antivirus_free_setup.exe (PID: 7976)
      • avg_antivirus_free_online_setup.exe (PID: 8060)
      • saBSI.exe (PID: 8108)
      • icarus.exe (PID: 6252)
      • Embarcadero_Dev-Cpp_6.3_TDM-GCC 9.2_Setup.exe (PID: 7188)
      • icarus.exe (PID: 7296)
      • icarus.exe (PID: 7364)
      • installer.exe (PID: 2100)
      • installer.exe (PID: 208)
      • identity_helper.exe (PID: 6712)
      • servicehost.exe (PID: 7320)
      • uihost.exe (PID: 7580)
      • updater.exe (PID: 8720)
      • engsup.exe (PID: 7968)
      • SetupInf.exe (PID: 7880)
      • SetupInf.exe (PID: 8408)
      • SetupInf.exe (PID: 4436)
      • SetupInf.exe (PID: 7532)
      • SetupInf.exe (PID: 8504)
      • SetupInf.exe (PID: 8528)
      • AvEmUpdate.exe (PID: 8968)
      • AvEmUpdate.exe (PID: 3332)
      • RegSvr.exe (PID: 7592)
      • RegSvr.exe (PID: 8696)
      • SetupInf.exe (PID: 856)
      • wsc_proxy.exe (PID: 7236)
      • wsc_proxy.exe (PID: 7124)
      • afwServ.exe (PID: 8148)
      • AVGSvc.exe (PID: 4244)
      • avgToolsSvc.exe (PID: 8336)
      • aswEngSrv.exe (PID: 9040)
      • aswidsagent.exe (PID: 6712)
      • icarus.exe (PID: 7500)
      • AVGUI.exe (PID: 9124)
      • overseer.exe (PID: 7712)

    • Create files in a temporary directory

      • bloodshed-dev-c_QI-JOJ1.exe (PID: 4776)
      • bloodshed-dev-c_QI-JOJ1.exe (PID: 7280)
      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)
      • avg_antivirus_free_online_setup.exe (PID: 8060)
      • saBSI.exe (PID: 8108)
      • Embarcadero_Dev-Cpp_6.3_TDM-GCC 9.2_Setup.exe (PID: 7188)
      • installer.exe (PID: 208)

    • Process checks computer location settings

      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 2140)
      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)
      • servicehost.exe (PID: 7320)

    • The sample compiled with english language support

      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)
      • saBSI.exe (PID: 7908)
      • avg_antivirus_free_online_setup.exe (PID: 8060)
      • avg_antivirus_free_setup.exe (PID: 7976)
      • installer.exe (PID: 2100)
      • icarus.exe (PID: 6252)
      • saBSI.exe (PID: 8108)
      • icarus.exe (PID: 7296)
      • installer.exe (PID: 208)
      • Embarcadero_Dev-Cpp_6.3_TDM-GCC 9.2_Setup.exe (PID: 7188)
      • icarus.exe (PID: 7364)
      • engsup.exe (PID: 7968)
      • AvEmUpdate.exe (PID: 3332)
      • AVGSvc.exe (PID: 4244)
      • msedge.exe (PID: 8720)

    • Reads the machine GUID from the registry

      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)
      • saBSI.exe (PID: 7908)
      • avg_antivirus_free_setup.exe (PID: 7976)
      • avg_antivirus_free_online_setup.exe (PID: 8060)
      • saBSI.exe (PID: 8108)
      • icarus.exe (PID: 6252)
      • icarus.exe (PID: 7364)
      • icarus.exe (PID: 7296)
      • installer.exe (PID: 208)
      • servicehost.exe (PID: 7320)
      • uihost.exe (PID: 7580)
      • updater.exe (PID: 8720)
      • wsc_proxy.exe (PID: 7236)
      • afwServ.exe (PID: 8148)
      • AVGSvc.exe (PID: 4244)
      • avgToolsSvc.exe (PID: 8336)
      • aswidsagent.exe (PID: 6712)
      • icarus.exe (PID: 7500)

    • Reads the software policy settings

      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)
      • avg_antivirus_free_setup.exe (PID: 7976)
      • saBSI.exe (PID: 7908)
      • avg_antivirus_free_online_setup.exe (PID: 8060)
      • saBSI.exe (PID: 8108)
      • slui.exe (PID: 7380)
      • servicehost.exe (PID: 7320)
      • uihost.exe (PID: 7580)
      • installer.exe (PID: 208)
      • slui.exe (PID: 6620)
      • updater.exe (PID: 8720)
      • AvEmUpdate.exe (PID: 3332)
      • AVGSvc.exe (PID: 4244)

    • Checks proxy server information

      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)
      • saBSI.exe (PID: 7908)
      • avg_antivirus_free_online_setup.exe (PID: 8060)
      • saBSI.exe (PID: 8108)
      • slui.exe (PID: 6620)
      • AvEmUpdate.exe (PID: 8968)
      • AvEmUpdate.exe (PID: 3332)
      • AVGUI.exe (PID: 9124)

    • Compiled with Borland Delphi (YARA)

      • bloodshed-dev-c_QI-JOJ1.exe (PID: 4776)
      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 2140)
      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)
      • bloodshed-dev-c_QI-JOJ1.exe (PID: 7280)

    • Detects InnoSetup installer (YARA)

      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 2140)
      • bloodshed-dev-c_QI-JOJ1.exe (PID: 4776)
      • bloodshed-dev-c_QI-JOJ1.exe (PID: 7280)
      • bloodshed-dev-c_QI-JOJ1.tmp (PID: 7328)

    • Creates files in the program directory

      • avg_antivirus_free_online_setup.exe (PID: 8060)
      • saBSI.exe (PID: 7908)
      • saBSI.exe (PID: 8108)
      • icarus.exe (PID: 6252)
      • installer.exe (PID: 2100)
      • icarus.exe (PID: 7296)
      • installer.exe (PID: 208)
      • servicehost.exe (PID: 7320)
      • Embarcadero_Dev-Cpp_6.3_TDM-GCC 9.2_Setup.exe (PID: 7188)
      • uihost.exe (PID: 7580)
      • icarus.exe (PID: 7364)
      • engsup.exe (PID: 7968)
      • AvEmUpdate.exe (PID: 3332)
      • AvEmUpdate.exe (PID: 8968)
      • wsc_proxy.exe (PID: 7236)
      • afwServ.exe (PID: 8148)
      • AVGSvc.exe (PID: 4244)
      • avgToolsSvc.exe (PID: 8336)
      • aswidsagent.exe (PID: 6712)
      • AVGUI.exe (PID: 9124)

    • Manual execution by a user

      • msedge.exe (PID: 1228)
      • AVGUI.exe (PID: 9124)

    • Application launched itself

      • msedge.exe (PID: 1228)
      • msedge.exe (PID: 4880)
      • msedge.exe (PID: 6564)

    • Reads CPU info

      • icarus.exe (PID: 6252)
      • icarus.exe (PID: 7364)
      • icarus.exe (PID: 7296)
      • engsup.exe (PID: 7968)
      • SetupInf.exe (PID: 7880)
      • SetupInf.exe (PID: 4436)
      • SetupInf.exe (PID: 8408)
      • SetupInf.exe (PID: 7532)
      • SetupInf.exe (PID: 8504)
      • SetupInf.exe (PID: 8528)
      • AvEmUpdate.exe (PID: 8968)
      • AvEmUpdate.exe (PID: 3332)
      • RegSvr.exe (PID: 7592)
      • RegSvr.exe (PID: 8696)
      • SetupInf.exe (PID: 856)
      • wsc_proxy.exe (PID: 7236)
      • wsc_proxy.exe (PID: 7124)
      • afwServ.exe (PID: 8148)
      • AVGSvc.exe (PID: 4244)
      • avgToolsSvc.exe (PID: 8336)
      • uihost.exe (PID: 7580)
      • aswidsagent.exe (PID: 6712)
      • servicehost.exe (PID: 7320)
      • icarus.exe (PID: 7500)
      • AVGUI.exe (PID: 9124)
      • aswEngSrv.exe (PID: 9040)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7864)
      • WerFault.exe (PID: 5188)

    • Reads Environment values

      • icarus.exe (PID: 7296)
      • identity_helper.exe (PID: 6712)
      • AvEmUpdate.exe (PID: 8968)
      • AvEmUpdate.exe (PID: 3332)
      • afwServ.exe (PID: 8148)
      • AVGSvc.exe (PID: 4244)
      • avgToolsSvc.exe (PID: 8336)
      • aswidsagent.exe (PID: 6712)

    • The sample compiled with czech language support

      • icarus.exe (PID: 7296)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 8720)

    • Reads the time zone

      • aswidsagent.exe (PID: 6712)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • aswidsagent.exe (PID: 6712)

    • Reads product name

      • aswidsagent.exe (PID: 6712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 07:26:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 159744
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 2.4.0.9160
ProductVersionNumber: 2.4.0.9160
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: Parlem Installazione
FileVersion: 2.4.0.9160
LegalCopyright:
OriginalFileName:
ProductName: Nerkato
ProductVersion: 2.4.0.9160
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
252
Monitored processes
111
Malicious processes
37
Suspicious processes
3

Behavior graph

Click at the process to see the details
start bloodshed-dev-c_qi-joj1.exe bloodshed-dev-c_qi-joj1.tmp no specs bloodshed-dev-c_qi-joj1.exe #INNOSETUP bloodshed-dev-c_qi-joj1.tmp sppextcomobj.exe no specs slui.exe sabsi.exe avg_antivirus_free_setup.exe avg_antivirus_free_online_setup.exe sabsi.exe winrar.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs icarus.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs werfault.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs installer.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs embarcadero_dev-cpp_6.3_tdm-gcc 9.2_setup.exe icarus.exe icarus.exe slui.exe werfault.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs installer.exe msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs servicehost.exe uihost.exe updater.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs engsup.exe setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs msedge.exe no specs setupinf.exe no specs avemupdate.exe no specs avemupdate.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs regsvr.exe no specs regsvr.exe no specs setupinf.exe no specs wsc_proxy.exe no specs wsc_proxy.exe no specs afwserv.exe no specs avgsvc.exe avgtoolssvc.exe msedge.exe aswengsrv.exe aswidsagent.exe no specs wpr.exe no specs conhost.exe no specs unsecapp.exe no specs icarus.exe overseer.exe no specs avgui.exe no specs icarus.exe

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Program Files\McAfee\Temp2022884514\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade C:\Program Files\McAfee\Temp2022884514\installer.exe
installer.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(installer)
Exit code:
0
Version:
4,1,1,1020
Modules
Images
c:\program files\mcafee\temp2022884514\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
540"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5444 --field-trial-handle=2212,i,16431228814744400498,9992417066299413115,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
744"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4268 --field-trial-handle=2412,i,297364634436750240,11481939458612857466,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856"C:\Program Files\AVG\Antivirus\SetupInf.exe" /catinstall:"C:\Program Files\AVG\Antivirus\crts.cat" /basename:pkg_{af98c830-528a-46b9-a60e-2db5d9a76b77}.cat /crtid:EB1AFCB314DD423D9ECE8F83BF16793824D0EA79C:\Program Files\AVG\Antivirus\SetupInf.exe—icarus.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
AVG Antivirus Installer
Exit code:
0
Version:
25.3.9983.0
Modules
Images
c:\program files\avg\antivirus\setupinf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1040"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3676 --field-trial-handle=2412,i,297364634436750240,11481939458612857466,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1096"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3452 --field-trial-handle=2412,i,297364634436750240,11481939458612857466,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1164"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=2212,i,16431228814744400498,9992417066299413115,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate --single-argument https://en.download.it/typC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1660"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5792 --field-trial-handle=2412,i,297364634436750240,11481939458612857466,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2100"C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
saBSI.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\mcafee\webadvisor\sabsi\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
82 437
Read events
80 870
Write events
1 441
Delete events
126

Modification events

(PID) Process:(7328) bloodshed-dev-c_QI-JOJ1.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000E907040001000E000A0002003000D502010000001E768127E028094199FEB9D127C57AFE
(PID) Process:(7328) bloodshed-dev-c_QI-JOJ1.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
01000000000000001D04846024ADDB01
(PID) Process:(7908) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:UUID
Value:
{D21CB17C-3DEB-4429-837F-0A8C84AE4A35}
(PID) Process:(7908) saBSI.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\WebAdvisor
Operation:writeName:InstallerFlags
Value:
1
(PID) Process:(8060) avg_antivirus_free_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:5FD38555-4B16-40AE-9A09-E2C969CB74AF
Value:
F6D4F52220BB5A3D7246A004278BB23F
(PID) Process:(8060) avg_antivirus_free_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F
Operation:writeName:7CCD586D-2ABC-42FF-A23B-3731F4F183D9
Value:
F6D4F52220BB5A3D7246A004278BB23F
(PID) Process:(8060) avg_antivirus_free_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:8C5CFDF4-AB05-4EB0-8EF6-7B4620DC2CF3
Value:
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAR92LTIogXEiHAlJiiEWlLgQAAAACAAAAAAAQZgAAAAEAACAAAAChJUyt6on3D38U1YE7swzvLppVeA3eZ1K8R9jS855yIQAAAAAOgAAAAAIAACAAAAASJkqXmLD8gD/UKeR3BE38Wp0Fcd0MnuAZElwkKNAsPlAAAADLzm1WvB4RGd2/cyPwKz+NUo5Ib8ODfc8apZKqD/XHl7IWb1pMgZJx+JDa6SzJWXfT1zb0WrPMPcw+P2LbGysVX+m3inzFSpafkcqODZfCzUAAAAA4tKOTziLPAZ9iWbkypn/UEA4TCvdlLokZFl3MeZTGhsm8PbDDEs5Wc607IdI4mOXOQ/jbcOeYRIDMRrjz5WjY
(PID) Process:(8060) avg_antivirus_free_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F
Operation:writeName:5E1D6A55-0134-486E-A166-38C2E4919BB1
Value:
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAR92LTIogXEiHAlJiiEWlLgQAAAACAAAAAAAQZgAAAAEAACAAAAChJUyt6on3D38U1YE7swzvLppVeA3eZ1K8R9jS855yIQAAAAAOgAAAAAIAACAAAAASJkqXmLD8gD/UKeR3BE38Wp0Fcd0MnuAZElwkKNAsPlAAAADLzm1WvB4RGd2/cyPwKz+NUo5Ib8ODfc8apZKqD/XHl7IWb1pMgZJx+JDa6SzJWXfT1zb0WrPMPcw+P2LbGysVX+m3inzFSpafkcqODZfCzUAAAAA4tKOTziLPAZ9iWbkypn/UEA4TCvdlLokZFl3MeZTGhsm8PbDDEs5Wc607IdI4mOXOQ/jbcOeYRIDMRrjz5WjY
(PID) Process:(8060) avg_antivirus_free_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:144807F0-DE37-4C62-9C05-EB4CC64A7A2F
Value:
03d180c1-24c5-4456-b382-079bf21cdcf3
(PID) Process:(8060) avg_antivirus_free_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F
Operation:writeName:56C7A9DA-4B11-406A-8B1A-EFF157C294D6
Value:
03d180c1-24c5-4456-b382-079bf21cdcf3
Executable files
1 076
Suspicious files
2 281
Text files
3 664
Unknown types
1

Dropped files

PID
Process
Filename
Type
7328bloodshed-dev-c_QI-JOJ1.tmpC:\Users\admin\AppData\Local\Temp\is-N6D3R.tmp\is-PO9FB.tmp —
MD5:—
SHA256:—
7328bloodshed-dev-c_QI-JOJ1.tmpC:\Users\admin\AppData\Local\Temp\is-N6D3R.tmp\bloodshed-dev-c.zip —
MD5:—
SHA256:—
7328bloodshed-dev-c_QI-JOJ1.tmpC:\Users\admin\AppData\Local\Temp\is-N6D3R.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
4776bloodshed-dev-c_QI-JOJ1.exeC:\Users\admin\AppData\Local\Temp\is-OFLE6.tmp\bloodshed-dev-c_QI-JOJ1.tmpexecutable
MD5:1C8E32202DDDB1A6C295C74E9B4D9A16
SHA256:4AC6716C222CB4DFD7B31DD541F72C382A5264E66F9F1E181E2C5CED0A8C4E5F
7280bloodshed-dev-c_QI-JOJ1.exeC:\Users\admin\AppData\Local\Temp\is-A2GMT.tmp\bloodshed-dev-c_QI-JOJ1.tmpexecutable
MD5:1C8E32202DDDB1A6C295C74E9B4D9A16
SHA256:4AC6716C222CB4DFD7B31DD541F72C382A5264E66F9F1E181E2C5CED0A8C4E5F
7328bloodshed-dev-c_QI-JOJ1.tmpC:\Users\admin\AppData\Local\Temp\is-N6D3R.tmp\Helper.dllexecutable
MD5:DE761970892FD126C0A130966215B363
SHA256:3AA8BA187B846D05BED20E2F6E71F330E029D958E943DC9DD102DB4CFC6AEB38
7328bloodshed-dev-c_QI-JOJ1.tmpC:\Users\admin\Downloads\bloodshed-dev-c.zip —
MD5:—
SHA256:—
7328bloodshed-dev-c_QI-JOJ1.tmpC:\Users\admin\AppData\Local\Temp\is-N6D3R.tmp\is-EVIUB.tmpimage
MD5:FBA1A5AC651CEDE033D2851FD43B4BF6
SHA256:BD974ADA24B5AAF45E3286036507B12FAE5558EA18E875208C7769590CB919E2
7328bloodshed-dev-c_QI-JOJ1.tmpC:\Users\admin\AppData\Local\Temp\is-N6D3R.tmp\mainlogo.pngimage
MD5:FBA1A5AC651CEDE033D2851FD43B4BF6
SHA256:BD974ADA24B5AAF45E3286036507B12FAE5558EA18E875208C7769590CB919E2
7328bloodshed-dev-c_QI-JOJ1.tmpC:\Users\admin\AppData\Local\Temp\is-N6D3R.tmp\prod0.zipcompressed
MD5:F68008B70822BD28C82D13A289DEB418
SHA256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
78
TCP/UDP connections
180
DNS requests
294
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7328
bloodshed-dev-c_QI-JOJ1.tmp
GET
200
95.168.168.24:80
http://dl.jalecdn.com/US/bloodshed-dev-c.zip
unknown
—
—
unknown
7720
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7720
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7976
avg_antivirus_free_setup.exe
POST
200
142.250.74.206:80
http://www.google-analytics.com/collect
unknown
—
—
whitelisted
7976
avg_antivirus_free_setup.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
unknown
—
—
whitelisted
7976
avg_antivirus_free_setup.exe
POST
200
142.250.74.206:80
http://www.google-analytics.com/collect
unknown
—
—
whitelisted
2284
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1744952132&P2=404&P3=2&P4=No7z0ywO20IV07LLIiTsvDrcHzCo7pUiZWJzp64%2bb1PswUHBhDM3P6DfxbR08VUNSvLscGKishXGJOyZ5hbvyg%3d%3d
unknown
—
—
whitelisted
7976
avg_antivirus_free_setup.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7328
bloodshed-dev-c_QI-JOJ1.tmp
18.66.188.14:443
djloiq2ki6v9p.cloudfront.net
AMAZON-02
US
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7328
bloodshed-dev-c_QI-JOJ1.tmp
172.67.26.92:443
static.download.it
CLOUDFLARENET
US
suspicious
7328
bloodshed-dev-c_QI-JOJ1.tmp
95.168.168.24:80
dl.jalecdn.com
LeaseWeb Netherlands B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.102.138
  • 142.250.102.101
  • 142.250.102.113
  • 142.250.102.139
  • 142.250.102.102
  • 142.250.102.100
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.32.238.112
  • 23.32.238.107
whitelisted
client.wns.windows.com
  • 184.30.25.22
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.131
  • 40.126.31.130
  • 40.126.31.71
  • 20.190.159.75
  • 20.190.159.0
  • 20.190.159.71
  • 40.126.31.131
  • 40.126.31.73
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
djloiq2ki6v9p.cloudfront.net
  • 18.66.188.14
  • 18.66.188.135
  • 18.66.188.132
  • 18.66.188.54
whitelisted
static.download.it
  • 172.67.26.92
  • 104.22.56.224
  • 104.22.57.224
unknown
dl.jalecdn.com
  • 95.168.168.24
unknown
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

PID
Process
Class
Message
7328
bloodshed-dev-c_QI-JOJ1.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
3332
AvEmUpdate.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
8336
avgToolsSvc.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
4244
AVGSvc.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
4244
AVGSvc.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
4244
AVGSvc.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
4244
AVGSvc.exe
Misc activity
INFO [ANY.RUN] Possible short link service (bit .ly)
Process
Message
AVGSvc.exe
[2025-04-14 10:06:50.270] [info ] [nsf_urlinfo] [ 4244: 7960] [D7E7C1: 39] Initialize UrlInfoMgr
AVGSvc.exe
[2025-04-14 10:06:50.332] [info ] [nsf_urlinfo] [ 4244: 7960] [D7E7C1: 72] UrlInfoMgr initialized
AVGSvc.exe
[2025-04-14 10:06:55.817] [error ] [AlphaClient] [ 4244: 8604] [F989FB: 13] ~/aYLZ6PJPpPV1Kc6gQdGxoK3F3af0GSX0+SlKa0YcNepoFFMo+RkgMT/mSi7BkD6sb0cPYnVK5PV7qgo8A1OzLGxGz3OjXLTkr7yeehTD/64pg1MmN45hJupqCOBB0bGuLoMdt6XKYjP/6M0qlFd0amLDWeIzxWG19SqJb00TM24txQ9jMklhMT4tROsH1uLvKITepHkP5fF1KU5rBlwybS3UX2T1yOEj+yjOIEPSsiyixN6n5U/icD/simwD3I=
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bloodshed-dev-c_QI-JOJ1.exe