URL:

https://honzik.avcdn.net/setup/avast-av/release/avast_free_antivirus_online_setup.exe

Full analysis: https://app.any.run/tasks/10754ade-657c-49a6-882b-969252097201
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 27, 2025, 08:57:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
evasion
loader
Indicators:
MD5:

302239E6E8734F1A4C433D61799F038A

SHA1:

847714495CC987DFE7A1E8A1A6ACC36FE808CF8A

SHA256:

9148F62B46FF3ABE0DBFCEDF855B8F7DCA22BBD1E664F9657E7A5A8E9C69A6E5

SSDEEP:

3:N82LfPwTGlARSRvqKXsA36/RKgqQWYWph4A:22rIiJcA36sgrPWh4A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Antivirus name has been found in the command line (generic signature)

      • AvastUI.exe (PID: 8056)
      • AvastUI.exe (PID: 9008)
      • AvastUI.exe (PID: 8088)
      • AvastUI.exe (PID: 9152)
      • AvastUI.exe (PID: 8168)
      • AvastUI.exe (PID: 8384)
      • AvastUI.exe (PID: 9108)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • avast_free_antivirus_online_setup.exe (PID: 516)
      • icarus.exe (PID: 7716)
      • icarus.exe (PID: 8144)
      • icarus.exe (PID: 8120)
      • AvEmUpdate.exe (PID: 6892)
      • engsup.exe (PID: 7768)
      • aswOfferTool.exe (PID: 8984)
      • AvastSvc.exe (PID: 6900)

    • Starts itself from another location

      • icarus.exe (PID: 7716)

    • Reads security settings of Internet Explorer

      • icarus_ui.exe (PID: 7732)

    • The process creates files with name similar to system file names

      • icarus.exe (PID: 8120)

    • Process drops legitimate windows executable

      • icarus.exe (PID: 8120)
      • engsup.exe (PID: 7768)

    • The process drops C-runtime libraries

      • icarus.exe (PID: 8120)
      • engsup.exe (PID: 7768)

    • Drops a system driver (possible attempt to evade defenses)

      • icarus.exe (PID: 8120)
      • engsup.exe (PID: 7768)
      • AvEmUpdate.exe (PID: 6892)

    • The process verifies whether the antivirus software is installed

      • engsup.exe (PID: 7768)
      • icarus.exe (PID: 8144)
      • icarus.exe (PID: 8120)

    • Checks for external IP

      • AvEmUpdate.exe (PID: 6892)
      • AvastSvc.exe (PID: 6900)
      • aswToolsSvc.exe (PID: 7784)
      • AvastUI.exe (PID: 9008)

    • Application launched itself

      • AvastUI.exe (PID: 9008)

    • Executes as Windows Service

      • wsc_proxy.exe (PID: 3968)
      • aswToolsSvc.exe (PID: 7784)
      • afwServ.exe (PID: 6652)
      • AvastSvc.exe (PID: 6900)
      • aswidsagent.exe (PID: 6108)

    • Process requests binary or script from the Internet

      • AvastSvc.exe (PID: 6900)

    • Potential Corporate Privacy Violation

      • AvastUI.exe (PID: 9008)

  • INFO

    • The sample compiled with english language support

      • chrome.exe (PID: 4688)
      • avast_free_antivirus_online_setup.exe (PID: 516)
      • icarus.exe (PID: 7716)
      • icarus.exe (PID: 8120)
      • chrome.exe (PID: 6112)
      • icarus.exe (PID: 8144)
      • engsup.exe (PID: 7768)
      • AvEmUpdate.exe (PID: 6892)
      • AvastSvc.exe (PID: 6900)
      • aswOfferTool.exe (PID: 8984)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 4688)
      • chrome.exe (PID: 6112)

    • Checks supported languages

      • avast_free_antivirus_online_setup.exe (PID: 516)
      • icarus.exe (PID: 7716)
      • icarus_ui.exe (PID: 7732)
      • icarus.exe (PID: 8120)
      • icarus.exe (PID: 8144)
      • engsup.exe (PID: 7768)

    • Application launched itself

      • chrome.exe (PID: 4688)

    • Creates files in the program directory

      • avast_free_antivirus_online_setup.exe (PID: 516)
      • icarus.exe (PID: 7716)
      • icarus_ui.exe (PID: 7732)
      • icarus.exe (PID: 8120)
      • icarus.exe (PID: 8144)
      • engsup.exe (PID: 7768)

    • Reads the computer name

      • avast_free_antivirus_online_setup.exe (PID: 516)
      • icarus.exe (PID: 7716)
      • icarus.exe (PID: 8120)
      • icarus.exe (PID: 8144)
      • icarus_ui.exe (PID: 7732)

    • Reads the software policy settings

      • avast_free_antivirus_online_setup.exe (PID: 516)
      • slui.exe (PID: 7812)
      • slui.exe (PID: 5136)
      • icarus_ui.exe (PID: 7732)

    • Create files in a temporary directory

      • avast_free_antivirus_online_setup.exe (PID: 516)

    • Checks proxy server information

      • avast_free_antivirus_online_setup.exe (PID: 516)
      • slui.exe (PID: 5136)
      • icarus_ui.exe (PID: 7732)

    • Reads the machine GUID from the registry

      • avast_free_antivirus_online_setup.exe (PID: 516)
      • icarus.exe (PID: 7716)
      • icarus_ui.exe (PID: 7732)
      • icarus.exe (PID: 8120)
      • icarus.exe (PID: 8144)

    • Reads CPU info

      • icarus.exe (PID: 7716)
      • icarus_ui.exe (PID: 7732)
      • icarus.exe (PID: 8144)
      • icarus.exe (PID: 8120)

    • Reads Environment values

      • icarus.exe (PID: 8120)

    • The sample compiled with czech language support

      • icarus.exe (PID: 8120)

    • Creates files or folders in the user directory

      • icarus_ui.exe (PID: 7732)

    • Manual execution by a user

      • AvastUI.exe (PID: 9008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
208
Monitored processes
65
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs sppextcomobj.exe no specs slui.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs avast_free_antivirus_online_setup.exe no specs avast_free_antivirus_online_setup.exe icarus.exe icarus_ui.exe icarus.exe icarus.exe slui.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs engsup.exe setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs avemupdate.exe no specs avemupdate.exe chrome.exe no specs regsvr.exe no specs regsvr.exe no specs setupinf.exe no specs wsc_proxy.exe no specs wsc_proxy.exe no specs afwserv.exe avastsvc.exe aswtoolssvc.exe aswengsrv.exe no specs aswidsagent.exe no specs unsecapp.exe no specs icarus.exe icarus.exe avastnm.exe no specs wpr.exe no specs conhost.exe no specs avastui.exe overseer.exe engsup.exe no specs aswoffertool.exe aswoffertool.exe no specs avastui.exe no specs avastui.exe no specs avastui.exe no specs avastui.exe avastui.exe no specs chrome.exe no specs avastui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6128 --field-trial-handle=1892,i,5916738836735216393,5455955716036370047,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
516"C:\Users\admin\Downloads\avast_free_antivirus_online_setup.exe" C:\Users\admin\Downloads\avast_free_antivirus_online_setup.exe
chrome.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Self-Extract Package
Version:
25.3.8935.0
Modules
Images
c:\users\admin\downloads\avast_free_antivirus_online_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
960"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /netservice:aswNdisFlt /catalog:aswNdisFlt.catC:\Program Files\Avast Software\Avast\SetupInf.exe—icarus.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
25.3.9983.0
Modules
Images
c:\program files\avast software\avast\setupinf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1072"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5300 --field-trial-handle=1892,i,5916738836735216393,5455955716036370047,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1096"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRvrt.catC:\Program Files\Avast Software\Avast\SetupInf.exe—icarus.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
25.3.9983.0
Modules
Images
c:\program files\avast software\avast\setupinf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1616"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffc89acdc40,0x7ffc89acdc4c,0x7ffc89acdc58C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2084"C:\Program Files\Avast Software\Avast\x86\RegSvr.exe" "C:\Program Files\Avast Software\Avast\x86\aswAMSI.dll"C:\Program Files\Avast Software\Avast\x86\RegSvr.exe—icarus.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
25.3.9983.0
Modules
Images
c:\program files\avast software\avast\x86\regsvr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\rpcrt4.dll
2152"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /netservice:sw_aswNdisC:\Program Files\Avast Software\Avast\SetupInf.exe—icarus.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
25.3.9983.0
Modules
Images
c:\program files\avast software\avast\setupinf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
2152"C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe" /skip_uptime /skip_remediationsC:\Program Files\Common Files\Avast Software\Overseer\overseer.exe
icarus.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Overseer
Exit code:
0
Version:
1.0.498.0
Modules
Images
c:\program files\common files\avast software\overseer\overseer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\avast software\avast\aswhook.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3968"C:\Program Files\Avast Software\Avast\wsc_proxy.exe" /runassvc /rpcserverC:\Program Files\Avast Software\Avast\wsc_proxy.exe—services.exe
User:
SYSTEM
Company:
AVAST Software
Integrity Level:
SYSTEM
Description:
Avast remediation exe
Version:
21.4.6162.0
Modules
Images
c:\program files\avast software\avast\wsc_proxy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\avast software\avast\wsc.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\userenv.dll
c:\windows\system32\shell32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wtsapi32.dll
Total events
75 133
Read events
73 895
Write events
1 107
Delete events
131

Modification events

(PID) Process:(4688) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4688) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(4688) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4688) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(4688) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(7708) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
0100000000000000A797706E52B7DB01
(PID) Process:(516) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:5FD38555-4B16-40AE-9A09-E2C969CB74AF
Value:
F6D4F52220BB5A3D7246A004278BB23F
(PID) Process:(516) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F
Operation:writeName:7CCD586D-2ABC-42FF-A23B-3731F4F183D9
Value:
F6D4F52220BB5A3D7246A004278BB23F
(PID) Process:(516) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:8C5CFDF4-AB05-4EB0-8EF6-7B4620DC2CF3
Value:
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAxr7Tj4hkL0OReQ27Upk3BAQAAAACAAAAAAAQZgAAAAEAACAAAACzh8u2NiEPRGCbc6kj5mnTnDt3z7rYvQXxwfkm5Q4TZQAAAAAOgAAAAAIAACAAAABgF6Pm17YkEAQT4G/picHaP7KtqCQ3Z4WDuEUnoHtEJ1AAAAC6tRyNIWoBVDu+hXwvjg3O9CHTvFKnGrClFJ4wHF92KIgdjJ0iQSbRMdzM0Iu1mP6mLtbryy2ij9AzL0pojS+nkZetgmENGvNpQTqjxLtbjUAAAAAkRDMXetTyUtvL5fTIrYe7BFuAwKereymOr5Z6c+TQEsrEP5uavBnZ5dEKumwpoK4K0RVwCCGfsZ54jrR7hxdP
(PID) Process:(516) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F
Operation:writeName:5E1D6A55-0134-486E-A166-38C2E4919BB1
Value:
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAxr7Tj4hkL0OReQ27Upk3BAQAAAACAAAAAAAQZgAAAAEAACAAAACzh8u2NiEPRGCbc6kj5mnTnDt3z7rYvQXxwfkm5Q4TZQAAAAAOgAAAAAIAACAAAABgF6Pm17YkEAQT4G/picHaP7KtqCQ3Z4WDuEUnoHtEJ1AAAAC6tRyNIWoBVDu+hXwvjg3O9CHTvFKnGrClFJ4wHF92KIgdjJ0iQSbRMdzM0Iu1mP6mLtbryy2ij9AzL0pojS+nkZetgmENGvNpQTqjxLtbjUAAAAAkRDMXetTyUtvL5fTIrYe7BFuAwKereymOr5Z6c+TQEsrEP5uavBnZ5dEKumwpoK4K0RVwCCGfsZ54jrR7hxdP
Executable files
886
Suspicious files
2 007
Text files
392
Unknown types
4

Dropped files

PID
Process
Filename
Type
4688chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF10be12.TMP —
MD5:—
SHA256:—
4688chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF10be22.TMP —
MD5:—
SHA256:—
4688chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
4688chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
4688chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF10be22.TMP —
MD5:—
SHA256:—
4688chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
4688chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF10be22.TMP —
MD5:—
SHA256:—
4688chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
4688chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF10be22.TMP —
MD5:—
SHA256:—
4688chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
194
TCP/UDP connections
412
DNS requests
258
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7732
icarus_ui.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
7732
icarus_ui.exe
GET
200
172.217.23.99:80
http://c.pki.goog/r/r1.crl
unknown
—
—
whitelisted
7732
icarus_ui.exe
GET
200
172.217.23.99:80
http://o.pki.goog/s/wr3/zCo/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEQDMKnjH5%2BmnjBKmbdTkJrJm
unknown
—
—
whitelisted
2552
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7732
icarus_ui.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4688
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
7256
chrome.exe
2.18.161.23:443
honzik.avcdn.net
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 184.24.77.24
  • 184.24.77.4
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.142
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
honzik.avcdn.net
  • 2.18.161.23
  • 2a02:26f0:3500:f9c::240d
  • 2a02:26f0:3500:f92::240d
whitelisted
accounts.google.com
  • 74.125.205.84
whitelisted
sb-ssl.google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
www.google.com
  • 142.250.186.36
whitelisted
login.live.com
  • 20.190.147.2
  • 20.190.177.83
  • 20.190.147.4
  • 20.190.177.147
  • 20.190.177.21
  • 20.190.147.9
  • 20.190.147.11
  • 20.190.177.23
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
6892
AvEmUpdate.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
7784
aswToolsSvc.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
6900
AvastSvc.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
6900
AvastSvc.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
6900
AvastSvc.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
6900
AvastSvc.exe
Misc activity
INFO [ANY.RUN] Possible short link service (bit .ly)
6900
AvastSvc.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
Process
Message
AvastSvc.exe
[2025-04-27 09:01:33.921] [info ] [nsf_urlinfo] [ 6900: 7400] [08C197: 46] Starting UrlInfo
AvastSvc.exe
[2025-04-27 09:01:33.921] [info ] [nsf_urlinfo] [ 6900: 7400] [D7E7C1: 39] Initialize UrlInfoMgr
AvastSvc.exe
[2025-04-27 09:01:33.937] [info ] [nsf_urlinfo] [ 6900: 7400] [D7E7C1: 72] UrlInfoMgr initialized
aswToolsSvc.exe
[2025-04-27 09:01:55.109] [error ] [NLMNetwork ] [ 7784: 5508] [AD3695: 253] AswWinNLMNetwork.SetNetworkCategory.SetCategory.fail [hr:0x800708ca]
afwServ.exe
[2025-04-27 09:01:55.109] [error ] [afwAnen ] [ 6652: 6472] [510804:1017] afwANEN::UpdateAnenWinNlmNetworkCategory for { {39719E3D-3B5B-40E4-8343-11E056790CA6} } to Public failed, code 0x800708ca Failed to set network category
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://honzik.avcdn.net/setup/avast-av/release/avast_free_antivirus_online_setup.exe