File name:

ccsetup_online_setup.exe

Full analysis: https://app.any.run/tasks/17be488e-4b35-481b-a71a-5d050f025dce
Verdict: Malicious activity
Analysis date: November 06, 2025, 15:55:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
arch-scr
arch-html
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

18C961F7CFA2A6D319674BC9416B95E3

SHA1:

AD1D42D0EBA0AF68BA62317034762440C0179035

SHA256:

6497A2014CD62EED2C37D4B32DAEF51CB60AFE61F1AC5C772B222D8E7AB370B0

SSDEEP:

49152:u7p7Qnk2nmKhCJkNZBfcCBjHSmRQht8T0P3s80PFRB4fauJL5NqT2QHpbw+nm4+t:O+XBkQS0T0P3mPFRB4fauJNAH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ccsetup_online_setup.exe (PID: 7808)
      • icarus.exe (PID: 7928)
      • icarus.exe (PID: 8148)
      • uninst.exe (PID: 6876)
      • Un_A.exe (PID: 4616)

    • Starts itself from another location

      • icarus.exe (PID: 7928)
      • uninst.exe (PID: 6876)

    • Process drops legitimate windows executable

      • icarus.exe (PID: 8148)

    • The process drops C-runtime libraries

      • icarus.exe (PID: 8148)

    • Searches for installed software

      • cc6_migration.exe (PID: 4412)
      • Un_A.exe (PID: 4616)
      • CCleaner_service.exe (PID: 7232)

    • The process creates files with name similar to system file names

      • Un_A.exe (PID: 4616)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Un_A.exe (PID: 4616)

    • Reads security settings of Internet Explorer

      • Un_A.exe (PID: 4616)
      • CCleaner.exe (PID: 4796)
      • CCleaner.exe (PID: 5652)
      • CCleaner.exe (PID: 356)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 3100)
      • Un_A.exe (PID: 4616)

    • Application launched itself

      • cmd.exe (PID: 3100)
      • CCleaner.exe (PID: 4796)
      • CCleaner.exe (PID: 5652)
      • CCleaner.exe (PID: 356)

    • Lists all scheduled tasks in specific format

      • schtasks.exe (PID: 476)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3984)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 6596)
      • schtasks.exe (PID: 5612)
      • schtasks.exe (PID: 7364)

    • Non windows owned service launched

      • CCleaner_service.exe (PID: 7232)

    • Executes as Windows Service

      • CCleaner_service.exe (PID: 7232)

    • Checks for Java to be installed

      • CCleaner_service.exe (PID: 7232)

    • Checks for external IP

      • CCleaner_service.exe (PID: 7232)

    • Reads the date of Windows installation

      • CCleaner.exe (PID: 4796)
      • CCleaner.exe (PID: 5652)
      • CCleaner.exe (PID: 356)

  • INFO

    • Reads the computer name

      • ccsetup_online_setup.exe (PID: 7808)
      • icarus.exe (PID: 7928)
      • icarus_ui.exe (PID: 7976)
      • icarus.exe (PID: 8148)
      • cc6_migration.exe (PID: 4412)
      • Un_A.exe (PID: 4616)
      • CCUpdate.exe (PID: 1252)
      • CCleaner_service.exe (PID: 7232)
      • CCleaner.exe (PID: 4796)
      • CCleaner.exe (PID: 4628)
      • CCleaner.exe (PID: 7484)
      • CCleaner.exe (PID: 5652)
      • CCleaner.exe (PID: 4412)
      • CCleaner.exe (PID: 356)

    • The sample compiled with english language support

      • ccsetup_online_setup.exe (PID: 7808)
      • icarus.exe (PID: 7928)
      • icarus.exe (PID: 8148)
      • uninst.exe (PID: 6876)
      • Un_A.exe (PID: 4616)

    • Reads the machine GUID from the registry

      • ccsetup_online_setup.exe (PID: 7808)
      • icarus.exe (PID: 7928)
      • icarus_ui.exe (PID: 7976)
      • icarus.exe (PID: 8148)
      • Un_A.exe (PID: 4616)
      • CCleaner_service.exe (PID: 7232)
      • avDump.exe (PID: 7112)

    • Create files in a temporary directory

      • ccsetup_online_setup.exe (PID: 7808)
      • uninst.exe (PID: 6876)
      • Un_A.exe (PID: 4616)

    • Checks supported languages

      • ccsetup_online_setup.exe (PID: 7808)
      • icarus.exe (PID: 7928)
      • icarus_ui.exe (PID: 7976)
      • icarus.exe (PID: 8148)
      • cc6_migration.exe (PID: 4412)
      • uninst.exe (PID: 6876)
      • Un_A.exe (PID: 4616)
      • CCUpdate.exe (PID: 1252)
      • CCleaner_service.exe (PID: 7232)
      • CCleaner.exe (PID: 4628)
      • avDump.exe (PID: 7112)
      • CCleaner.exe (PID: 4796)
      • CCleaner.exe (PID: 5652)
      • CCleaner.exe (PID: 7484)
      • avDump.exe (PID: 7288)
      • CCleaner.exe (PID: 4412)
      • avDump.exe (PID: 2920)
      • CCleaner.exe (PID: 356)

    • Creates files in the program directory

      • ccsetup_online_setup.exe (PID: 7808)
      • icarus.exe (PID: 7928)
      • icarus_ui.exe (PID: 7976)
      • icarus.exe (PID: 8148)
      • cc6_migration.exe (PID: 4412)
      • avDump.exe (PID: 7112)
      • CCleaner_service.exe (PID: 7232)

    • Reads the software policy settings

      • ccsetup_online_setup.exe (PID: 7808)
      • Un_A.exe (PID: 4616)
      • CCleaner_service.exe (PID: 7232)

    • Checks proxy server information

      • ccsetup_online_setup.exe (PID: 7808)
      • Un_A.exe (PID: 4616)

    • Reads CPU info

      • icarus.exe (PID: 7928)
      • icarus_ui.exe (PID: 7976)
      • icarus.exe (PID: 8148)
      • CCleaner_service.exe (PID: 7232)
      • CCleaner.exe (PID: 4628)
      • CCleaner.exe (PID: 4796)
      • CCleaner.exe (PID: 5652)
      • CCleaner.exe (PID: 7484)
      • CCleaner.exe (PID: 4412)
      • CCleaner.exe (PID: 356)

    • Creates a software uninstall entry

      • icarus.exe (PID: 8148)

    • Reads Environment values

      • Un_A.exe (PID: 4616)
      • CCleaner_service.exe (PID: 7232)
      • avDump.exe (PID: 7112)
      • avDump.exe (PID: 7288)
      • avDump.exe (PID: 2920)

    • Creates files or folders in the user directory

      • Un_A.exe (PID: 4616)
      • CCleaner.exe (PID: 4796)
      • CCleaner.exe (PID: 4628)
      • avDump.exe (PID: 7112)
      • CCleaner.exe (PID: 5652)
      • CCleaner.exe (PID: 7484)
      • avDump.exe (PID: 7288)
      • CCleaner.exe (PID: 4412)
      • CCleaner.exe (PID: 356)
      • avDump.exe (PID: 2920)

    • Manual execution by a user

      • CCleaner.exe (PID: 4796)
      • CCleaner.exe (PID: 5652)
      • CCleaner.exe (PID: 356)

    • Process checks computer location settings

      • CCleaner.exe (PID: 4796)
      • CCleaner.exe (PID: 4628)
      • CCleaner.exe (PID: 5652)
      • CCleaner.exe (PID: 7484)
      • CCleaner.exe (PID: 4412)
      • CCleaner.exe (PID: 356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:07:16 10:28:22+00:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.42
CodeSize: 1153024
InitializedDataSize: 548864
UninitializedDataSize: -
EntryPoint: 0x66790
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 25.7.9619.0
ProductVersionNumber: 7.0.1010.1196
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Gen Digital Inc.
FileDescription: CCleaner Self-Extract Package
FileVersion: 25.7.9619.0
InternalName: icarus_sfx
LegalCopyright: Copyright © 2025 Gen Digital Inc. All rights reserved.
MainProductId: piriform-ccl
OriginalFileName: icarus_sfx.exe
ProductId: piriform-icarus
ProductName: CCleaner
ProductVersion: 7.0.1010.1196
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
185
Monitored processes
34
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start ccsetup_online_setup.exe icarus.exe icarus_ui.exe no specs icarus.exe cc6_migration.exe no specs conhost.exe no specs uninst.exe un_a.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs schtasks.exe no specs findstr.exe no specs schtasks.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs ccupdate.exe no specs ccleaner_service.exe ccleaner.exe no specs ccleaner.exe avdump.exe no specs conhost.exe no specs ccleaner.exe no specs ccleaner.exe avdump.exe no specs conhost.exe no specs ccleaner.exe no specs ccleaner.exe avdump.exe no specs conhost.exe no specs slui.exe no specs ccsetup_online_setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
356"C:\Program Files\Piriform\CCleaner 7\CCleaner.exe" C:\Program Files\Piriform\CCleaner 7\CCleaner.exe—explorer.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
MEDIUM
Description:
CCleaner
Exit code:
0
Version:
7.1.2007.0
Modules
Images
c:\program files\piriform\ccleaner 7\ccleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
476C:\WINDOWS\system32\schtasks /query /fo list C:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
988\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1152findstr /i CCleanerSkipUACC:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1252"C:\Program Files\CCleaner\ccupdate.exe" /unregC:\Program Files\CCleaner\CCUpdate.exe—Un_A.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
CCleaner CCleaner emergency updater
Exit code:
0
Version:
23.3.12.0
Modules
Images
c:\program files\ccleaner\ccupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
2800\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2880\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—avDump.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2920"C:\Program Files\Piriform\CCleaner 7\avDump.exe" --pid 4412 --exception_ptr 0000009F3DB7B1F0 --thread_id 6048 --dump_level 21 --dump_file "C:\Users\admin\AppData\Roaming\CCleaner\dumps\unp312154134040481622i-unhandled.mdmp" --comment " Program version: 7.1.1042.0" --min_interval 60C:\Program Files\Piriform\CCleaner 7\avDump.exe—CCleaner.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
CCleaner Dump Process
Exit code:
0
Version:
25.0.0.1
Modules
Images
c:\program files\piriform\ccleaner 7\avdump.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3100cmd /c for /f "usebackq tokens=1* delims=\" %# in (`C:\WINDOWS\system32\schtasks /query /fo list ^| findstr /i CCleanerSkipUAC`) do C:\WINDOWS\system32\schtasks /delete /tn "%f7f81a39-5f63-5b42-9efd-1f13b5431005quot; /fC:\Windows\SysWOW64\cmd.exe—Un_A.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3300\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—avDump.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
16 493
Read events
16 393
Write events
44
Delete events
56

Modification events

(PID) Process:(7808) ccsetup_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:5FD38555-4B16-40AE-9A09-E2C969CB74AF
Value:
5E88AB2B29C498B5332BFF3DCC837969
(PID) Process:(7808) ccsetup_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F
Operation:writeName:7CCD586D-2ABC-42FF-A23B-3731F4F183D9
Value:
5E88AB2B29C498B5332BFF3DCC837969
(PID) Process:(7808) ccsetup_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:8C5CFDF4-AB05-4EB0-8EF6-7B4620DC2CF3
Value:
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAzFLySQz7xkyuVRNOtEQbjAQAAAACAAAAAAAQZgAAAAEAACAAAADbkDPRj9nJZGM3WH4xS9Tep4BgDnrkp4dYa0VhIEKD7QAAAAAOgAAAAAIAACAAAAC1NrkTH/sxW69s+zcSxed4uimm39yQr79hTkwZOrx6alAAAACUXuYz8Em4g+xa6jMCd5Qe2JdI91tI3yO6k7F+iQCNZPmaJtdtcgffRAwio2PDcOfnl3OVF3zPN2KyiXgmB3CHJu2cJiS95MTSlJykYFcAQEAAAACABGMormuw0Vajz0ZQdMw6Jux1DSq8APfnInruI11ODiNw+onByjs1dgpmro2jHAJyM2HGyNceeSu1UCXyGc9o
(PID) Process:(7808) ccsetup_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F
Operation:writeName:5E1D6A55-0134-486E-A166-38C2E4919BB1
Value:
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAzFLySQz7xkyuVRNOtEQbjAQAAAACAAAAAAAQZgAAAAEAACAAAADbkDPRj9nJZGM3WH4xS9Tep4BgDnrkp4dYa0VhIEKD7QAAAAAOgAAAAAIAACAAAAC1NrkTH/sxW69s+zcSxed4uimm39yQr79hTkwZOrx6alAAAACUXuYz8Em4g+xa6jMCd5Qe2JdI91tI3yO6k7F+iQCNZPmaJtdtcgffRAwio2PDcOfnl3OVF3zPN2KyiXgmB3CHJu2cJiS95MTSlJykYFcAQEAAAACABGMormuw0Vajz0ZQdMw6Jux1DSq8APfnInruI11ODiNw+onByjs1dgpmro2jHAJyM2HGyNceeSu1UCXyGc9o
(PID) Process:(7808) ccsetup_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:144807F0-DE37-4C62-9C05-EB4CC64A7A2F
Value:
a48271da-1300-45f0-bacd-5f37c08d4837
(PID) Process:(7808) ccsetup_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F
Operation:writeName:56C7A9DA-4B11-406A-8B1A-EFF157C294D6
Value:
a48271da-1300-45f0-bacd-5f37c08d4837
(PID) Process:(7928) icarus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:144807F0-DE37-4C62-9C05-EB4CC64A7A2F
Value:
a48271da-1300-45f0-bacd-5f37c08d4837
(PID) Process:(7928) icarus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:5FD38555-4B16-40AE-9A09-E2C969CB74AF
Value:
5E88AB2B29C498B5332BFF3DCC837969
(PID) Process:(8148) icarus.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\Software\Piriform\Icarus
Operation:writeName:DataFolder
Value:
C:\ProgramData\Piriform\Icarus
(PID) Process:(8148) icarus.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\Software\Piriform\Icarus
Operation:delete valueName:UninstallToken
Value:
Executable files
85
Suspicious files
279
Text files
398
Unknown types
2

Dropped files

PID
Process
Filename
Type
7808ccsetup_online_setup.exeC:\Users\admin\AppData\Local\Temp\D566D7D7-DCD6-471C-8109-BE0AD33199E3binary
MD5:36C0EF1B03DDB8C104907CF99253A319
SHA256:70EC13D10A13D0888F418BBAC04665E1AE44C9DE37C8180E236CB372E3D6BCEE
7808ccsetup_online_setup.exeC:\Users\admin\AppData\Local\Temp\F07D8C6A-04B6-4025-869C-70A788D7B5C0binary
MD5:B377443592E3E41C33E3B74203BA869D
SHA256:C7253BDBC28D9F6EAAB12EF44AFBE14D132BF2A0807FD78DCC31B1612342BFAE
7808ccsetup_online_setup.exeC:\ProgramData\Piriform\Icarus\Logs\sfx.logtext
MD5:ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA256:F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
7808ccsetup_online_setup.exeC:\Windows\Temp\asw-311d20ac-4967-40e1-badd-44d69e20a23b\common\product-info.xmlxml
MD5:D154A0539AA2675032DC758C6151B7CD
SHA256:35902A1E3A2B5335F806E39275DD51DF72E309567AF62173571A7356A34C253A
7808ccsetup_online_setup.exeC:\Windows\Temp\asw-311d20ac-4967-40e1-badd-44d69e20a23b\common\icarus_ui.exeexecutable
MD5:69DCFF3B65292A69E5EE6EA01B1B638C
SHA256:B94F188C314186C0844863744040E937200C38537F9A2C727555801B279BDA62
7808ccsetup_online_setup.exeC:\Windows\Temp\asw-311d20ac-4967-40e1-badd-44d69e20a23b\common\83fe63cb-57ca-4fb0-a787-eb9e6fe824d4compressed
MD5:FA9792063CBFCCCBAB07576448C8A94F
SHA256:60132A15450DB65263CB0C5358428ED040E06CD86AA42F1CDED27425C1FEC895
7808ccsetup_online_setup.exeC:\Windows\Temp\asw-311d20ac-4967-40e1-badd-44d69e20a23b\common\6007fc5e-6d94-4c5a-b98f-92775ee6476acompressed
MD5:403F5B510BECBD0F220878BB0EDF8DC7
SHA256:3F50B2D73C9BA96940A7C01064AEC00D236F3F967516A3F5D3B2E7C4067A8C13
7808ccsetup_online_setup.exeC:\Windows\Temp\asw-311d20ac-4967-40e1-badd-44d69e20a23b\common\icarus.exeexecutable
MD5:11CBFFECCB583CDDBEAEC3D1396A4A77
SHA256:89767B00CA35A4A352CFADD3BDFFC34DF929F8FD610E56797678A248A022D284
7808ccsetup_online_setup.exeC:\Windows\Temp\asw-311d20ac-4967-40e1-badd-44d69e20a23b\common\1929f110-8228-42e4-83cd-4ec6a0d6569ecompressed
MD5:26BCC4886E5297A2D8A49EF180E69C15
SHA256:F5D7A49ED8DA1B2EBA93F70C7D0765E23735CBF08F7CC4852DCF5B4DDF6DF42A
7808ccsetup_online_setup.exeC:\Users\admin\AppData\Local\Temp\6358C710-B89F-46B9-93F2-F6CAC44F5286binary
MD5:911AB80B7955D8D9C4AD1272083AE61C
SHA256:572136209A3CD6DC18B18E9F4D76AAA19C4C42346484675A4F92943CD86F1BC4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
71
DNS requests
44
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1792
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5596
MoUsoCoreWorker.exe
GET
200
23.216.77.25:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7304
SIHClient.exe
GET
200
72.246.29.11:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.3.crl
unknown
—
—
whitelisted
7304
SIHClient.exe
GET
200
72.246.29.11:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
7304
SIHClient.exe
GET
200
72.246.29.11:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.3.crl
unknown
—
—
whitelisted
4616
Un_A.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAsA6S1NbXMfyjBZx8seGIY%3D
unknown
—
—
whitelisted
7232
CCleaner_service.exe
GET
200
2.19.126.142:80
http://ncc.avast.com/ncc.txt
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6880
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1792
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5596
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.11.206.112:443
www.bing.com
Akamai International B.V.
DE
whitelisted
7808
ccsetup_online_setup.exe
34.117.223.223:443
analytics.avcdn.net
GOOGLE-CLOUD-PLATFORM
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7808
ccsetup_online_setup.exe
184.28.65.105:443
honzik.avcdn.net
AKAMAI-AS
US
unknown
7928
icarus.exe
34.117.223.223:443
analytics.avcdn.net
GOOGLE-CLOUD-PLATFORM
US
whitelisted
7928
icarus.exe
34.160.176.28:443
shepherd.avcdn.net
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
login.live.com
  • 40.126.31.0
  • 20.190.159.4
  • 40.126.31.2
  • 20.190.159.73
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.23
  • 20.190.159.2
whitelisted
google.com
  • 142.250.186.142
whitelisted
www.bing.com
  • 23.11.206.112
  • 23.11.206.106
  • 95.100.158.122
  • 95.100.158.113
  • 95.100.158.121
  • 95.100.158.105
  • 23.3.89.89
  • 95.100.158.114
  • 23.11.206.105
whitelisted
analytics.avcdn.net
  • 34.117.223.223
whitelisted
honzik.avcdn.net
  • 184.28.65.105
  • 2a02:26f0:3500:f9c::240d
  • 2a02:26f0:3500:f92::240d
  • 23.212.89.10
whitelisted
shepherd.avcdn.net
  • 34.160.176.28
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 23.216.77.25
  • 23.216.77.6
  • 23.216.77.8
  • 23.216.77.37
  • 23.216.77.18
  • 23.216.77.30
  • 23.216.77.41
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted

Threats

PID
Process
Class
Message
2276
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
7232
CCleaner_service.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
Process
Message
CCleaner.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
CCleaner.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
CCleaner.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ccsetup_online_setup.exe