URL:

download.avira.com/download/spotlight-windows-bootstrapper/avira.exe

Full analysis: https://app.any.run/tasks/aa7e5293-bdbe-4f10-8b99-68aee316b9c5
Verdict: Malicious activity
Analysis date: March 04, 2025, 08:58:08
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MD5:

A296C3F2827AE8D78A836C39BB7FC400

SHA1:

B64552A0E84D9955A54C6BF52B96BD63B7A0FB52

SHA256:

5E81DA778A31E59A0847067CC86EB77B514C7B1D6F4E7A1762D0607FEAA8D749

SSDEEP:

3:ZKWnSKK8LZU/3CNxExGn:ZlSKO3CNxEQn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • avira.exe (PID: 7692)

  • SUSPICIOUS

    • The process verifies whether the antivirus software is installed

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 7268)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5416)

    • Reads security settings of Internet Explorer

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 7268)

    • Executable content was dropped or overwritten

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 7268)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 2240)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 1568)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5416)
      • avira.exe (PID: 7692)

    • Adds/modifies Windows certificates

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 7268)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 2240)
      • MicrosoftEdgeUpdate.exe (PID: 1748)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 1568)
      • MicrosoftEdgeUpdate.exe (PID: 7896)

    • Process drops legitimate windows executable

      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 2240)
      • MicrosoftEdgeUpdate.exe (PID: 1748)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 1568)
      • MicrosoftEdgeUpdate.exe (PID: 7896)

    • Searches for installed software

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 7268)

    • The process creates files with name similar to system file names

      • avira.exe (PID: 7692)

  • INFO

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 6488)
      • BackgroundTransferHost.exe (PID: 8128)
      • BackgroundTransferHost.exe (PID: 2908)
      • BackgroundTransferHost.exe (PID: 5400)
      • BackgroundTransferHost.exe (PID: 6456)

    • Application launched itself

      • chrome.exe (PID: 2384)

    • Create files in a temporary directory

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 7268)
      • avira.exe (PID: 6808)
      • avira.exe (PID: 7692)

    • Checks supported languages

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 7268)
      • avira.exe (PID: 7692)

    • Reads the computer name

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 7268)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2384)
      • chrome.exe (PID: 6384)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 6488)
      • wermgr.exe (PID: 6960)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 6488)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 6488)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 7268)

    • Disables trace logs

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 7268)

    • Reads the machine GUID from the registry

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 7268)

    • Creates files in the program directory

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 7268)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 2240)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 1568)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5416)

    • The sample compiled with english language support

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 7268)
      • MicrosoftEdgeUpdate.exe (PID: 1748)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 2240)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 1568)
      • MicrosoftEdgeUpdate.exe (PID: 7896)
      • chrome.exe (PID: 6384)

    • Manual execution by a user

      • avira.exe (PID: 7720)
      • avira.exe (PID: 7692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
187
Monitored processes
43
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs sppextcomobj.exe no specs slui.exe chrome.exe no specs chrome.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs rundll32.exe no specs avira.exe no specs avira.exe avira.spotlight.bootstrapper.exe schtasks.exe no specs conhost.exe no specs acssignedic.exe no specs shellexperiencehost.exe no specs microsoftedgewebview2runtimeinstallerx64.exe slui.exe no specs chrome.exe no specs microsoftedgeupdate.exe wermgr.exe chrome.exe no specs microsoftedgewebview2runtimeinstallerx64.exe microsoftedgeupdate.exe wermgr.exe chrome.exe avira.spotlight.bootstrapper.reportingtool.exe no specs conhost.exe no specs avira.exe no specs avira.spotlight.bootstrapper.exe acssignedic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5508 --field-trial-handle=1896,i,5843777756114355698,2165656567953387096,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1072C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1568"C:\Users\admin\AppData\Local\Temp\.CR.19942\ecef41d1-5f25-4fe3-86e9-8f57d4432e4f\MicrosoftEdgeWebView2RuntimeInstallerX64.exe" /silent /installC:\Users\admin\AppData\Local\Temp\.CR.19942\ecef41d1-5f25-4fe3-86e9-8f57d4432e4f\MicrosoftEdgeWebView2RuntimeInstallerX64.exe
AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
2147747592
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\temp\.cr.19942\ecef41d1-5f25-4fe3-86e9-8f57d4432e4f\microsoftedgewebview2runtimeinstallerx64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1672"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3512 --field-trial-handle=1896,i,5843777756114355698,2165656567953387096,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1748"C:\Program Files (x86)\Microsoft\Temp\EUC04F.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers"C:\Program Files (x86)\Microsoft\Temp\EUC04F.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebView2RuntimeInstallerX64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
2147747592
Version:
1.3.195.43
Modules
Images
c:\program files (x86)\microsoft\temp\euc04f.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
2240"C:\Users\admin\AppData\Local\Temp\.CR.19942\ecef41d1-5f25-4fe3-86e9-8f57d4432e4f\MicrosoftEdgeWebView2RuntimeInstallerX64.exe" /silent /installC:\Users\admin\AppData\Local\Temp\.CR.19942\ecef41d1-5f25-4fe3-86e9-8f57d4432e4f\MicrosoftEdgeWebView2RuntimeInstallerX64.exe
AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
2147747592
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\temp\.cr.19942\ecef41d1-5f25-4fe3-86e9-8f57d4432e4f\microsoftedgewebview2runtimeinstallerx64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2384"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction,OptimizationHints "download.avira.com/download/spotlight-windows-bootstrapper/avira.exe"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2908"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4884"C:\Users\admin\AppData\Local\Temp\.CR.19942\Avira.Spotlight.Bootstrapper.ReportingTool.exe" -2147219704 webview2 "C:\Users\admin\AppData\Local\Temp" "msedge_installer.log"C:\Users\admin\AppData\Local\Temp\.CR.19942\AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE—AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE
User:
admin
Company:
Avira Operations GmbH
Integrity Level:
HIGH
Description:
Avira Security
Exit code:
0
Version:
1.0.50.758
Modules
Images
c:\users\admin\appdata\local\temp\.cr.19942\avira.spotlight.bootstrapper.reportingtool.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
88 586
Read events
88 003
Write events
552
Delete events
31

Modification events

(PID) Process:(2384) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2384) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2384) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2384) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(2384) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(8128) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8128) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8128) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8044) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
01000000000000005F4F0A96E38CDB01
(PID) Process:(6488) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
318
Suspicious files
86
Text files
40
Unknown types
0

Dropped files

PID
Process
Filename
Type
2384chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF10c13e.TMP —
MD5:—
SHA256:—
2384chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF10c13e.TMP —
MD5:—
SHA256:—
2384chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
2384chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF10c14e.TMP —
MD5:—
SHA256:—
2384chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
2384chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF10c14e.TMP —
MD5:—
SHA256:—
2384chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
2384chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
2384chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF10c14e.TMP —
MD5:—
SHA256:—
2384chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
49
DNS requests
45
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7704
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
3140
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_party_module_list.crx3
unknown
—
—
whitelisted
3140
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_party_module_list.crx3
unknown
—
—
whitelisted
4696
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3140
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
unknown
—
—
whitelisted
3140
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
unknown
—
—
whitelisted
3140
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_party_module_list.crx3
unknown
—
—
whitelisted
3140
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
unknown
—
—
whitelisted
3140
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_party_module_list.crx3
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1196
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7328
chrome.exe
2.19.106.11:80
download.avira.com
AKAMAI-AS
DE
suspicious
2384
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
7328
chrome.exe
142.250.110.84:443
accounts.google.com
GOOGLE
US
whitelisted
7328
chrome.exe
2.19.106.11:443
download.avira.com
AKAMAI-AS
DE
suspicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 20.44.239.154
whitelisted
download.avira.com
  • 2.19.106.11
unknown
accounts.google.com
  • 142.250.110.84
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.2
  • 20.190.159.128
  • 20.190.159.75
  • 20.190.159.130
  • 40.126.31.71
  • 40.126.31.0
  • 40.126.31.69
  • 20.190.159.131
  • 40.126.31.3
  • 20.190.159.23
  • 40.126.31.128
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
www.google.com
  • 142.250.186.132
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
sb-ssl.google.com
  • 142.250.185.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
download.avira.com/download/spotlight-windows-bootstrapper/avira.exe