analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

camstudio.exe

Full analysis: https://app.any.run/tasks/e353f1f2-76e6-4f2a-8dc9-888d41c9380d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: December 06, 2019, 22:30:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B4EFA591B1D5131060E03A729E4DB831

SHA1:

261FC7426BFD4F0AA59521CF4B0D0BEF4F5692BA

SHA256:

80F99A0A5E765C931A10E1CA250790074716EA6D139D20B14714EFA0714E43A5

SSDEEP:

98304:WMvqb5Cxi5EYjHu5JyMJf2hTAXcnvydbOYkmyvY06xDi:X+Da7r2hTA2vypOYkmyexDi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 14500031_stp.exe (PID: 1976)
      • avast_free_antivirus_setup_online.exe (PID: 3628)
      • Recorder.exe (PID: 1520)
      • avastfreeantivirussetuponline.m.exe (PID: 1316)
      • instup.exe (PID: 1532)
      • sbr.exe (PID: 3776)
      • instup.exe (PID: 1648)
      • SetupInf.exe (PID: 1504)
      • SetupInf.exe (PID: 3468)
      • SetupInf.exe (PID: 1936)
      • SetupInf.exe (PID: 2980)
      • AvEmUpdate.exe (PID: 2588)
      • AvEmUpdate.exe (PID: 2920)
      • AvEmUpdate.exe (PID: 3872)
      • AvEmUpdate.exe (PID: 3272)
      • Playerplus.exe (PID: 3644)
      • CCUpdate.exe (PID: 2856)
      • CCUpdate.exe (PID: 2588)
      • CCUpdate.exe (PID: 2864)
      • CCUpdate.exe (PID: 284)
      • CCUpdate.exe (PID: 3604)
      • RegSvr.exe (PID: 1728)
      • avBugReport.exe (PID: 3840)
      • RegSvr.exe (PID: 1044)
      • overseer.exe (PID: 1888)
      • AvastNM.exe (PID: 3844)
      • wsc_proxy.exe (PID: 3400)
      • AvastSvc.exe (PID: 2084)
      • engsup.exe (PID: 2176)
      • wsc_proxy.exe (PID: 2408)
      • instup.exe (PID: 1792)
      • engsup.exe (PID: 3888)
      • instup.exe (PID: 2300)
    • Loads dropped or rewritten executable

      • camstudio.exe (PID: 1856)
      • instup.exe (PID: 1648)
      • instup.exe (PID: 1532)
      • AvEmUpdate.exe (PID: 2920)
      • AvEmUpdate.exe (PID: 3872)
      • AvEmUpdate.exe (PID: 3272)
      • CCUpdate.exe (PID: 2864)
      • explorer.exe (PID: 352)
      • RegSvr.exe (PID: 1728)
      • engsup.exe (PID: 2176)
      • RegSvr.exe (PID: 1044)
      • AvastSvc.exe (PID: 2084)
      • engsup.exe (PID: 3888)
    • Downloads executable files from the Internet

      • avastfreeantivirussetuponline.m.exe (PID: 1316)
      • AvEmUpdate.exe (PID: 2920)
      • CCUpdate.exe (PID: 284)
    • Changes the autorun value in the registry

      • instup.exe (PID: 1532)
    • Loads the Task Scheduler COM API

      • AvEmUpdate.exe (PID: 2588)
      • AvEmUpdate.exe (PID: 2920)
      • CCUpdate.exe (PID: 284)
      • CCUpdate.exe (PID: 3604)
      • overseer.exe (PID: 1888)
    • Changes settings of System certificates

      • AvastSvc.exe (PID: 2084)
  • SUSPICIOUS

    • Creates files in the program directory

      • camstudio.exe (PID: 1856)
      • avast_free_antivirus_setup_online.exe (PID: 3628)
      • instup.exe (PID: 1648)
      • AvEmUpdate.exe (PID: 2588)
      • instup.exe (PID: 1532)
      • AvEmUpdate.exe (PID: 2920)
      • CCUpdate.exe (PID: 284)
      • CCUpdate.exe (PID: 2588)
      • CCUpdate.exe (PID: 2856)
      • CCUpdate.exe (PID: 3604)
      • avBugReport.exe (PID: 3840)
      • AvastNM.exe (PID: 3844)
      • engsup.exe (PID: 2176)
      • overseer.exe (PID: 1888)
      • wsc_proxy.exe (PID: 3400)
      • AvastSvc.exe (PID: 2084)
      • engsup.exe (PID: 3888)
    • Executable content was dropped or overwritten

      • camstudio.exe (PID: 1856)
      • 14500031_stp.tmp (PID: 2428)
      • 14500031_stp.exe (PID: 1976)
      • avastfreeantivirussetuponline.m.exe (PID: 1316)
      • avast_free_antivirus_setup_online.exe (PID: 3628)
      • instup.exe (PID: 1648)
      • instup.exe (PID: 1532)
      • AvEmUpdate.exe (PID: 2920)
      • AvEmUpdate.exe (PID: 3272)
      • CCUpdate.exe (PID: 284)
      • CCUpdate.exe (PID: 2588)
      • CCUpdate.exe (PID: 2856)
      • overseer.exe (PID: 1888)
      • AvastSvc.exe (PID: 2084)
    • Reads internet explorer settings

      • camstudio.exe (PID: 1856)
    • Low-level read access rights to disk partition

      • avastfreeantivirussetuponline.m.exe (PID: 1316)
      • instup.exe (PID: 1648)
      • avast_free_antivirus_setup_online.exe (PID: 3628)
      • instup.exe (PID: 1532)
      • AvEmUpdate.exe (PID: 2920)
      • AvEmUpdate.exe (PID: 3872)
      • AvEmUpdate.exe (PID: 3272)
      • CCUpdate.exe (PID: 2588)
      • CCUpdate.exe (PID: 2856)
      • CCUpdate.exe (PID: 284)
      • CCUpdate.exe (PID: 2864)
      • CCUpdate.exe (PID: 3604)
      • avBugReport.exe (PID: 3840)
      • overseer.exe (PID: 1888)
      • AvastSvc.exe (PID: 2084)
    • Reads Environment values

      • camstudio.exe (PID: 1856)
      • AvastSvc.exe (PID: 2084)
    • Application launched itself

      • camstudio.exe (PID: 1152)
      • AvEmUpdate.exe (PID: 2920)
      • CCUpdate.exe (PID: 284)
    • Creates files in the Windows directory

      • avastfreeantivirussetuponline.m.exe (PID: 1316)
      • avast_free_antivirus_setup_online.exe (PID: 3628)
      • instup.exe (PID: 1648)
      • instup.exe (PID: 1532)
      • AvEmUpdate.exe (PID: 2920)
      • AvastSvc.exe (PID: 2084)
    • Creates or modifies windows services

      • instup.exe (PID: 1648)
      • instup.exe (PID: 1532)
      • SetupInf.exe (PID: 3468)
      • SetupInf.exe (PID: 1936)
      • AvEmUpdate.exe (PID: 2588)
      • SetupInf.exe (PID: 2980)
      • SetupInf.exe (PID: 1504)
      • AvEmUpdate.exe (PID: 2920)
      • AvEmUpdate.exe (PID: 3272)
      • AvEmUpdate.exe (PID: 3872)
      • RegSvr.exe (PID: 1728)
      • avBugReport.exe (PID: 3840)
      • RegSvr.exe (PID: 1044)
      • wsc_proxy.exe (PID: 3400)
      • AvastSvc.exe (PID: 2084)
      • wsc_proxy.exe (PID: 2408)
    • Searches for installed software

      • camstudio.exe (PID: 1856)
      • AvastSvc.exe (PID: 2084)
    • Removes files from Windows directory

      • instup.exe (PID: 1648)
      • instup.exe (PID: 1532)
      • AvEmUpdate.exe (PID: 2920)
      • avast_free_antivirus_setup_online.exe (PID: 3628)
    • Starts itself from another location

      • instup.exe (PID: 1648)
      • CCUpdate.exe (PID: 2588)
    • Modifies the open verb of a shell class

      • instup.exe (PID: 1532)
    • Creates a software uninstall entry

      • instup.exe (PID: 1532)
      • AvEmUpdate.exe (PID: 3272)
    • Creates COM task schedule object

      • instup.exe (PID: 1532)
      • RegSvr.exe (PID: 1728)
      • RegSvr.exe (PID: 1044)
    • Creates files in the driver directory

      • instup.exe (PID: 1532)
      • AvEmUpdate.exe (PID: 2920)
    • Reads Internet Cache Settings

      • Recorder.exe (PID: 1520)
      • explorer.exe (PID: 352)
      • instup.exe (PID: 1532)
    • Creates files in the user directory

      • explorer.exe (PID: 352)
    • Executed as Windows Service

      • AvastSvc.exe (PID: 2084)
    • Reads the cookies of Mozilla Firefox

      • engsup.exe (PID: 3888)
    • Reads the cookies of Google Chrome

      • engsup.exe (PID: 3888)
  • INFO

    • Loads dropped or rewritten executable

      • 14500031_stp.tmp (PID: 2428)
    • Application was dropped or rewritten from another process

      • 14500031_stp.tmp (PID: 2428)
    • Creates files in the program directory

      • 14500031_stp.tmp (PID: 2428)
    • Creates a software uninstall entry

      • 14500031_stp.tmp (PID: 2428)
    • Reads the hosts file

      • instup.exe (PID: 1648)
      • instup.exe (PID: 1532)
      • overseer.exe (PID: 1888)
      • AvastSvc.exe (PID: 2084)
    • Dropped object may contain Bitcoin addresses

      • instup.exe (PID: 1532)
      • AvEmUpdate.exe (PID: 2920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (57.2)
.exe | Win32 Executable (generic) (18.2)
.exe | Win16/32 Executable Delphi generic (8.3)
.exe | Generic Win/DOS Executable (8)
.exe | DOS Executable Generic (8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:10:13 10:19:32+02:00
PEType: PE32
LinkerVersion: 2.25
CodeSize: 65024
InitializedDataSize: 201728
UninitializedDataSize: -
EntryPoint: 0x113bc
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.1.1
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: CamStudio
FileDescription: CamStudio Installer
FileVersion: 1.0.1.1
LegalCopyright: CamStudio
ProductName: Camstudio Installer
ProductVersion: 1.0.1.1

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 13-Oct-2013 08:19:32
Detected languages:
  • English - United States
Comments: This installation was built with Inno Setup.
CompanyName: CamStudio
FileDescription: CamStudio Installer
FileVersion: 1.0.1.1
LegalCopyright: CamStudio
ProductName: Camstudio Installer
ProductVersion: 1.0.1.1

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 13-Oct-2013 08:19:32
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000F12C
0x0000F200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.41201
.itext
0x00011000
0x00000B44
0x00000C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.73444
.data
0x00012000
0x00000C88
0x00000E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.24631
.bss
0x00013000
0x000056B4
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x00019000
0x00000DD0
0x00000E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.97188
.tls
0x0001A000
0x00000008
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rdata
0x0001B000
0x00000018
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0.204488
.rsrc
0x0001C000
0x0002F530
0x0002F600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.25762

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.11919
1512
Latin 1 / Western European
English - United States
RT_MANIFEST
2
6.69592
2440
Latin 1 / Western European
English - United States
RT_ICON
3
6.65802
4264
Latin 1 / Western European
English - United States
RT_ICON
4
6.45142
9640
Latin 1 / Western European
English - United States
RT_ICON
5
6.43989
13032
Latin 1 / Western European
English - United States
RT_ICON
6
6.17295
16936
Latin 1 / Western European
English - United States
RT_ICON
7
6.36418
38056
Latin 1 / Western European
English - United States
RT_ICON
8
6.36146
67624
Latin 1 / Western European
English - United States
RT_ICON
4091
2.56031
104
Latin 1 / Western European
UNKNOWN
RT_STRING
4092
3.25287
212
Latin 1 / Western European
UNKNOWN
RT_STRING

Imports

advapi32.dll
comctl32.dll
kernel32.dll
oleaut32.dll
user32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
80
Monitored processes
39
Malicious processes
21
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start camstudio.exe no specs camstudio.exe 14500031_stp.exe 14500031_stp.tmp avastfreeantivirussetuponline.m.exe recorder.exe avast_free_antivirus_setup_online.exe instup.exe instup.exe sbr.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs avemupdate.exe no specs avemupdate.exe avemupdate.exe avemupdate.exe playerplus.exe no specs ccupdate.exe ccupdate.exe ccupdate.exe ccupdate.exe explorer.exe no specs ccupdate.exe winrar.exe no specs avbugreport.exe regsvr.exe no specs regsvr.exe no specs avastnm.exe no specs overseer.exe engsup.exe no specs wsc_proxy.exe no specs avastsvc.exe engsup.exe no specs winrar.exe no specs wsc_proxy.exe no specs instup.exe no specs instup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1152"C:\Users\admin\Desktop\camstudio.exe" C:\Users\admin\Desktop\camstudio.exeexplorer.exe
User:
admin
Company:
CamStudio
Integrity Level:
MEDIUM
Description:
CamStudio Installer
Exit code:
0
Version:
1.0.1.1
Modules
Images
c:\users\admin\desktop\camstudio.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1856"C:\Users\admin\Desktop\camstudio.exe" /RSF /ppn:YyhwYgxaFRAiP211FM5W /mnlC:\Users\admin\Desktop\camstudio.exe
camstudio.exe
User:
admin
Company:
CamStudio
Integrity Level:
HIGH
Description:
CamStudio Installer
Exit code:
0
Version:
1.0.1.1
Modules
Images
c:\users\admin\desktop\camstudio.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1976"C:\Users\admin\AppData\Local\Temp\in3F5E2B75\14500031_stp.exe" /verysilent /norestart /supressmsgboxesC:\Users\admin\AppData\Local\Temp\in3F5E2B75\14500031_stp.exe
camstudio.exe
User:
admin
Company:
CamStudio Open Source
Integrity Level:
HIGH
Description:
CamStudio Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\in3f5e2b75\14500031_stp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2428"C:\Users\admin\AppData\Local\Temp\is-QB744.tmp\14500031_stp.tmp" /SL5="$E011E,11156480,54272,C:\Users\admin\AppData\Local\Temp\in3F5E2B75\14500031_stp.exe" /verysilent /norestart /supressmsgboxesC:\Users\admin\AppData\Local\Temp\is-QB744.tmp\14500031_stp.tmp
14500031_stp.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-qb744.tmp\14500031_stp.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1316"C:\Users\admin\AppData\Local\Temp\in3F5E2B75\7389A82B_stp\avastfreeantivirussetuponline.m.exe" /silent /psh:RbTGKAXvlyEA7ZZUAOnjUwPrliIWrsZhDe+SJAnskCUG75AmAO6SJQfvhHpWu8dnDZz0VGOJhHZCvpEnDeySJQbvlScF75L+RwAAADDdohU= /wsC:\Users\admin\AppData\Local\Temp\in3F5E2B75\7389A82B_stp\avastfreeantivirussetuponline.m.exe
camstudio.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
2.1.1252.0
Modules
Images
c:\users\admin\appdata\local\temp\in3f5e2b75\7389a82b_stp\avastfreeantivirussetuponline.m.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1520"C:\Program Files\CamStudio 2.7\Recorder.exe" C:\Program Files\CamStudio 2.7\Recorder.exe
camstudio.exe
User:
admin
Company:
CamStudio Group
Integrity Level:
HIGH
Description:
CamStudio Recorder
Version:
3.1.0.0
Modules
Images
c:\program files\camstudio 2.7\recorder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3628"C:\Windows\Temp\asw.be8719bb6709833d\avast_free_antivirus_setup_online.exe" /silent /psh:RbTGKAXvlyEA7ZZUAOnjUwPrliIWrsZhDe+SJAnskCUG75AmAO6SJQfvhHpWu8dnDZz0VGOJhHZCvpEnDeySJQbvlScF75L+RwAAADDdohU= /ws /ga_clientid:76569d6a-4fee-442c-9b08-01cccb10d653 /edat_dir:C:\Windows\Temp\asw.be8719bb6709833dC:\Windows\Temp\asw.be8719bb6709833d\avast_free_antivirus_setup_online.exe
avastfreeantivirussetuponline.m.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
19.8.4793.0
Modules
Images
c:\windows\temp\asw.be8719bb6709833d\avast_free_antivirus_setup_online.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1648"C:\Windows\Temp\asw.5e1fbae36557301c\instup.exe" /cookie:mmm_irs_ppi_002_451_m /edition:1 /ga_clientid:76569d6a-4fee-442c-9b08-01cccb10d653 /guid:9e173af6-3549-49f7-9088-77ce28bd5a38 /prod:ais /sfx:lite /sfxstorage:C:\Windows\Temp\asw.5e1fbae36557301c /silent /psh:RbTGKAXvlyEA7ZZUAOnjUwPrliIWrsZhDe+SJAnskCUG75AmAO6SJQfvhHpWu8dnDZz0VGOJhHZCvpEnDeySJQbvlScF75L+RwAAADDdohU= /ws /ga_clientid:76569d6a-4fee-442c-9b08-01cccb10d653 /edat_dir:C:\Windows\Temp\asw.be8719bb6709833dC:\Windows\Temp\asw.5e1fbae36557301c\instup.exe
avast_free_antivirus_setup_online.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
19.8.4793.0
Modules
Images
c:\windows\temp\asw.5e1fbae36557301c\instup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1532"C:\Windows\Temp\asw.5e1fbae36557301c\New_13080959\instup.exe" /cookie:mmm_irs_ppi_002_451_m /edat_dir:C:\Windows\Temp\asw.be8719bb6709833d /edition:1 /ga_clientid:76569d6a-4fee-442c-9b08-01cccb10d653 /guid:9e173af6-3549-49f7-9088-77ce28bd5a38 /online_installer /prod:ais /psh:RbTGKAXvlyEA7ZZUAOnjUwPrliIWrsZhDe+SJAnskCUG75AmAO6SJQfvhHpWu8dnDZz0VGOJhHZCvpEnDeySJQbvlScF75L+RwAAADDdohU= /sfx /sfxstorage:C:\Windows\Temp\asw.5e1fbae36557301c /silent /wsC:\Windows\Temp\asw.5e1fbae36557301c\New_13080959\instup.exe
instup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
19.8.4793.0
Modules
Images
c:\windows\temp\asw.5e1fbae36557301c\new_13080959\instup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
3776"C:\Windows\Temp\asw.5e1fbae36557301c\New_13080959\sbr.exe" 1532 "Avast Antivirus setup" "Avast Antivirus is being installed. Do not shut down your computer!"C:\Windows\Temp\asw.5e1fbae36557301c\New_13080959\sbr.exeinstup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Shutdown blocker
Exit code:
0
Version:
19.8.4793.0
Modules
Images
c:\windows\temp\asw.5e1fbae36557301c\new_13080959\sbr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
15 083
Read events
9 711
Write events
0
Delete events
0

Modification events

No data
Executable files
499
Suspicious files
137
Text files
265
Unknown types
45

Dropped files

PID
Process
Filename
Type
1856camstudio.exeC:\Users\admin\AppData\Local\Temp\0039B88C.log
MD5:
SHA256:
1856camstudio.exeC:\Users\admin\AppData\Local\Temp\inH37827967290\css\main.scsstext
MD5:98834991290EAAF4BCBF626D6FFB7557
SHA256:A88C2327F095BEEC4145FD69E5F3E541A2235D1AB7CD7151F325A61B16F59B82
1856camstudio.exeC:\Users\admin\AppData\Local\Temp\inH37827967290\css\helpers\_float.scsstext
MD5:BC5EB91B59A99E0FC439E02F80319975
SHA256:EAF9D36E3E75177E64090AC71C6FCF9BB6465CD21F5C0A5CCB05666033609DA8
1856camstudio.exeC:\Users\admin\AppData\Local\Temp\inH37827967290\css\helpers\_colors.scsstext
MD5:2DA278FBB61E370E0CC9F548E8154E1C
SHA256:857A73FC1DA7CF54525048AA60EC9E2F07328EE1D718A66E3B17186170BB5B5B
1856camstudio.exeC:\Users\admin\AppData\Local\Temp\inH37827967290\css\_helpers.scsstext
MD5:5F158DBBD9FC4594A2F6C13854501916
SHA256:BF12B79F67F1CB9988797F7D81F6F504C8DFE0F0435482E64819A140DBC8DA14
1856camstudio.exeC:\Users\admin\AppData\Local\Temp\inH37827967290\css\_functions.scsstext
MD5:8F7259DE64F6DDF352BF461F44D34A81
SHA256:80EDC9D67172BC830D68D33F4547735FB072CADF3EF25AAB37A10B50DB87A069
1856camstudio.exeC:\Users\admin\AppData\Local\Temp\inH37827967290\css\ie6_main.scsstext
MD5:F336AA4D3AC7F291984D6CF4933EDFA8
SHA256:B6B8795FAD34918DD3B8387E1EF585E0D97F40CA1BE76A2D3BE6515223761D68
1856camstudio.exeC:\Users\admin\AppData\Local\Temp\inH37827967290\css\main.csstext
MD5:3C1A5C5BFEB925AA5997657C16D73123
SHA256:BA78616EAF79EB188B5F3E6CB86B29F56361D547ED71DBED47C92247AF9C604F
1856camstudio.exeC:\Users\admin\AppData\Local\Temp\inH37827967290\css\_variables.scsstext
MD5:07922410C30F0117CBC3C140F14AEA88
SHA256:AF1999B49C03F5DCBB19466466FAC2D8172C684C0FF18931B85A8D0A06332C73
1856camstudio.exeC:\Users\admin\AppData\Local\Temp\inH37827967290\css\helpers\_border.scsstext
MD5:681FB7EB197E8E7EBD89F828D1181FD6
SHA256:51E8AFA69ED6D92EB82F71939B0B8FD34EF23FAECEE457698238E5A4F28DF984
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
168
TCP/UDP connections
123
DNS requests
127
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1856
camstudio.exe
GET
200
192.96.201.161:80
http://host.deneyodcucona.com/img/Sibarasawi/bg_comp.png
US
image
25.2 Kb
malicious
1856
camstudio.exe
GET
200
192.96.201.161:80
http://host.deneyodcucona.com/img/Jimomoromoj/Jimomoromoj_logo.png
US
image
2.10 Kb
malicious
1856
camstudio.exe
GET
200
192.96.201.161:80
http://host.deneyodcucona.com/img/Tavasat/15Feb17/v2/EN.png
US
image
43.9 Kb
malicious
1856
camstudio.exe
HEAD
200
192.96.201.161:80
http://host.deneyodcucona.com/ofr/Niniwic/YL/Niniwic_Tefenece_12Apr16
US
image
1.82 Kb
malicious
1856
camstudio.exe
GET
200
192.96.201.161:80
http://host.deneyodcucona.com/img/Tefenece/Tefenece_logo_black.png
US
image
1.82 Kb
malicious
1856
camstudio.exe
GET
200
192.96.201.161:80
http://host.deneyodcucona.com/img/Nuhududanew/BG_IMG_LONG.png
US
image
46.0 Kb
malicious
1856
camstudio.exe
GET
200
192.96.201.161:80
http://host.deneyodcucona.com/img/Vavavag/V2/DE.png
US
image
42.9 Kb
malicious
1856
camstudio.exe
GET
200
192.96.201.161:80
http://host.deneyodcucona.com/img/Nuhududanew/BG.jpg
US
image
100 Kb
malicious
1856
camstudio.exe
GET
200
192.96.201.161:80
http://host.deneyodcucona.com/img/Nuhududanew/BG_IMG.jpg
US
image
19.1 Kb
malicious
1856
camstudio.exe
GET
200
192.96.201.161:80
http://host.deneyodcucona.com/img/Sibarasawi/logo_comp.png
US
image
12.4 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1316
avastfreeantivirussetuponline.m.exe
172.217.21.238:80
www.google-analytics.com
Google Inc.
US
whitelisted
1856
camstudio.exe
52.51.217.55:80
ww3.deneyodcucona.com
Amazon.com, Inc.
IE
malicious
1316
avastfreeantivirussetuponline.m.exe
2.16.186.104:80
iavs9x.u.avast.com
Akamai International B.V.
whitelisted
1856
camstudio.exe
185.59.222.146:80
ww1.deneyodcucona.com
Datacamp Limited
NL
malicious
1856
camstudio.exe
52.51.129.59:80
www3.deneyodcucona.com
Amazon.com, Inc.
IE
malicious
1856
camstudio.exe
192.96.201.161:80
host.deneyodcucona.com
Leaseweb USA, Inc.
US
malicious
1316
avastfreeantivirussetuponline.m.exe
5.62.44.230:80
v7event.stats.avast.com
AVAST Software s.r.o.
US
unknown
3628
avast_free_antivirus_setup_online.exe
172.217.21.238:80
www.google-analytics.com
Google Inc.
US
whitelisted
1520
Recorder.exe
209.59.174.236:80
camstudio.org
Liquid Web, L.L.C
US
unknown
3628
avast_free_antivirus_setup_online.exe
5.62.44.230:80
v7event.stats.avast.com
AVAST Software s.r.o.
US
unknown

DNS requests

Domain
IP
Reputation
ww3.deneyodcucona.com
  • 52.51.217.55
  • 52.210.197.124
malicious
www3.deneyodcucona.com
  • 52.51.129.59
  • 52.212.215.62
  • 52.50.98.206
malicious
host.deneyodcucona.com
  • 192.96.201.161
malicious
ww1.deneyodcucona.com
  • 185.59.222.146
malicious
v7event.stats.avast.com
  • 5.62.44.230
  • 5.62.44.224
  • 5.62.53.212
  • 5.62.53.224
whitelisted
iavs9x.u.avast.com
  • 2.16.186.104
  • 2.16.186.50
whitelisted
www.google-analytics.com
  • 172.217.21.238
  • 216.58.207.78
whitelisted
camstudio.org
  • 209.59.174.236
unknown
shepherd.ff.avast.com
  • 5.62.44.49
  • 69.94.69.152
whitelisted
g0679661.iavs9x.u.avast.com
  • 92.123.77.34
  • 92.123.77.58
whitelisted

Threats

PID
Process
Class
Message
1856
camstudio.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1316
avastfreeantivirussetuponline.m.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2920
AvEmUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
284
CCUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
18 ETPRO signatures available at the full report
Process
Message
AvastSvc.exe
[2019-12-06 22:33:11.762] [error ] [av_pp_prov ] [ 2084: 3980] Exception: get_file_content 'C:\Program Files\AVAST Software\Avast\resources\updatefile.json' Code: 0x00000003 (3)