analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

avast_free_antivirus_setup_online.exe

Full analysis: https://app.any.run/tasks/473d34df-a90e-4dcd-b3d5-fc11826503dc
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: October 05, 2022, 01:03:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C931A2D568CDD6FC852112C6D7172D1A

SHA1:

11205AA69C072BBAF4E350293A4C1D7FC2BA2339

SHA256:

ABAE9967E8E74A823C70E6E7E97E7B07E972E58D5F8E28CC6D44685EF7E5A9E8

SSDEEP:

3072:G3FKK+qOLpWZOpHwOnxjhI1a29nMGkvmUCDzTObdPnF5od1Jc+mTSC/REMz5hMcj:G9+qOLoaXjhenMGmmUEebVF+uoBVy6tU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops executable file immediately after starts

      • avast_free_antivirus_setup_online.exe (PID: 3820)
      • avast_free_antivirus_setup_online.exe (PID: 684)
      • instup.exe (PID: 3396)
      • instup.exe (PID: 2384)
    • Application was dropped or rewritten from another process

      • avast_free_antivirus_setup_online.exe (PID: 684)
      • instup.exe (PID: 3396)
      • instup.exe (PID: 2384)
    • Loads dropped or rewritten executable

      • instup.exe (PID: 3396)
      • instup.exe (PID: 2384)
  • SUSPICIOUS

    • Checks supported languages

      • avast_free_antivirus_setup_online.exe (PID: 3820)
      • avast_free_antivirus_setup_online.exe (PID: 684)
      • instup.exe (PID: 3396)
      • instup.exe (PID: 2384)
    • Reads CPU info

      • avast_free_antivirus_setup_online.exe (PID: 684)
      • instup.exe (PID: 3396)
      • instup.exe (PID: 2384)
    • Reads the computer name

      • avast_free_antivirus_setup_online.exe (PID: 3820)
      • avast_free_antivirus_setup_online.exe (PID: 684)
      • instup.exe (PID: 3396)
      • instup.exe (PID: 2384)
    • Executable content was dropped or overwritten

      • avast_free_antivirus_setup_online.exe (PID: 3820)
      • avast_free_antivirus_setup_online.exe (PID: 684)
      • instup.exe (PID: 3396)
      • instup.exe (PID: 2384)
    • Creates files in the Windows directory

      • avast_free_antivirus_setup_online.exe (PID: 3820)
      • avast_free_antivirus_setup_online.exe (PID: 684)
      • instup.exe (PID: 3396)
      • instup.exe (PID: 2384)
    • Drops a file with a compile date too recent

      • avast_free_antivirus_setup_online.exe (PID: 3820)
      • avast_free_antivirus_setup_online.exe (PID: 684)
      • instup.exe (PID: 3396)
      • instup.exe (PID: 2384)
    • Reads Environment values

      • instup.exe (PID: 3396)
      • instup.exe (PID: 2384)
    • Creates or modifies windows services

      • instup.exe (PID: 3396)
    • Creates files in the program directory

      • avast_free_antivirus_setup_online.exe (PID: 684)
      • instup.exe (PID: 3396)
    • Starts itself from another location

      • instup.exe (PID: 3396)
    • Removes files from Windows directory

      • instup.exe (PID: 3396)
      • instup.exe (PID: 2384)
  • INFO

    • Reads settings of System Certificates

      • avast_free_antivirus_setup_online.exe (PID: 3820)
      • avast_free_antivirus_setup_online.exe (PID: 684)
      • instup.exe (PID: 3396)
    • Reads the hosts file

      • instup.exe (PID: 3396)
      • instup.exe (PID: 2384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2022-Sep-08 09:36:06
Detected languages:
  • English - United States
  • French - France
  • Portuguese - Brazil
  • Russian - Russia
  • Spanish - Spain (International sort)
Debug artifacts:
  • C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb
CompanyName: AVAST Software
Edition: 1
FileDescription: Avast Installer
FileVersion: 2.1.84.0
InternalName: microstub
LegalCopyright: Copyright (c) 2022 AVAST Software
OriginalFilename: microstub.exe
ProductName: Avast
ProductVersion: 2.1.84.0

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 288

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 6
TimeDateStamp: 2022-Sep-08 09:36:06
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
135274
135680
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.55405
.rdata
143360
40866
40960
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.4232
.data
184320
5552
2560
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.78928
.didat
192512
76
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.599443
.rsrc
196608
70344
70656
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.18555
.reloc
270336
7272
7680
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.51031

Resources

Title
Entropy
Size
Codepage
Language
Type
1
7.90423
8512
UNKNOWN
English - United States
RT_ICON
2
2.20257
16936
UNKNOWN
English - United States
RT_ICON
3
3.15857
9640
UNKNOWN
English - United States
RT_ICON
4
2.91719
4264
UNKNOWN
English - United States
RT_ICON
5
3.77184
1128
UNKNOWN
English - United States
RT_ICON
63
2.29127
116
UNKNOWN
English - United States
RT_STRING
76
3.18649
352
UNKNOWN
English - United States
RT_STRING
100
2.61013
76
UNKNOWN
English - United States
RT_GROUP_ICON
126
2.57629
148
UNKNOWN
English - United States
RT_STRING
132
2.85598
324
UNKNOWN
English - United States
RT_STRING

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
USER32.dll
WindowsCodecs.dll (delay-loaded)
ole32.dll
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start avast_free_antivirus_setup_online.exe no specs avast_free_antivirus_setup_online.exe avast_free_antivirus_setup_online.exe instup.exe instup.exe

Process information

PID
CMD
Path
Indicators
Parent process
600"C:\Users\admin\AppData\Local\Temp\avast_free_antivirus_setup_online.exe" C:\Users\admin\AppData\Local\Temp\avast_free_antivirus_setup_online.exeExplorer.EXE
User:
admin
Company:
AVAST Software
Integrity Level:
MEDIUM
Description:
Avast Installer
Exit code:
3221226540
Version:
2.1.84.0
Modules
Images
c:\users\admin\appdata\local\temp\avast_free_antivirus_setup_online.exe
c:\windows\system32\ntdll.dll
3820"C:\Users\admin\AppData\Local\Temp\avast_free_antivirus_setup_online.exe" C:\Users\admin\AppData\Local\Temp\avast_free_antivirus_setup_online.exe
Explorer.EXE
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Installer
Version:
2.1.84.0
Modules
Images
c:\users\admin\appdata\local\temp\avast_free_antivirus_setup_online.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
684"C:\Windows\Temp\asw.9c0b2f7948d269d5\avast_free_antivirus_setup_online.exe" /cookie:mmm_ava_012_999_a6j_m:dlid_FAV-PPC-WIN-GLOWEB-5664 /ga_clientid:2e0b686a-4f1a-4270-a15e-6eea357e9c82 /edat_dir:C:\Windows\Temp\asw.9c0b2f7948d269d5C:\Windows\Temp\asw.9c0b2f7948d269d5\avast_free_antivirus_setup_online.exe
avast_free_antivirus_setup_online.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus
Version:
22.9.7554.0
Modules
Images
c:\windows\temp\asw.9c0b2f7948d269d5\avast_free_antivirus_setup_online.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3396"C:\Windows\Temp\asw.c86c1c5d59b1ebfe\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.c86c1c5d59b1ebfe /edition:1 /prod:ais /guid:93916f37-a8c6-4250-bfc7-e7d57d32aed6 /ga_clientid:2e0b686a-4f1a-4270-a15e-6eea357e9c82 /cookie:mmm_ava_012_999_a6j_m:dlid_FAV-PPC-WIN-GLOWEB-5664 /ga_clientid:2e0b686a-4f1a-4270-a15e-6eea357e9c82 /edat_dir:C:\Windows\Temp\asw.9c0b2f7948d269d5C:\Windows\Temp\asw.c86c1c5d59b1ebfe\instup.exe
avast_free_antivirus_setup_online.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Version:
22.9.7554.0
Modules
Images
c:\windows\temp\asw.c86c1c5d59b1ebfe\instup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2384"C:\Windows\Temp\asw.c86c1c5d59b1ebfe\New_16091792\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.c86c1c5d59b1ebfe /edition:1 /prod:ais /guid:93916f37-a8c6-4250-bfc7-e7d57d32aed6 /ga_clientid:2e0b686a-4f1a-4270-a15e-6eea357e9c82 /cookie:mmm_ava_012_999_a6j_m:dlid_FAV-PPC-WIN-GLOWEB-5664 /edat_dir:C:\Windows\Temp\asw.9c0b2f7948d269d5 /online_installerC:\Windows\Temp\asw.c86c1c5d59b1ebfe\New_16091792\instup.exe
instup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Version:
22.9.7554.0
Modules
Images
c:\windows\temp\asw.c86c1c5d59b1ebfe\new_16091792\instup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
Total events
12 137
Read events
11 968
Write events
169
Delete events
0

Modification events

(PID) Process:(3820) avast_free_antivirus_setup_online.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Windows\Temp\asw.9c0b2f7948d269d5
(PID) Process:(3820) avast_free_antivirus_setup_online.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(684) avast_free_antivirus_setup_online.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(684) avast_free_antivirus_setup_online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
Operation:writeName:SfxInstProgress
Value:
0
(PID) Process:(3396) instup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\Avast\properties
Operation:writeName:UseRegistry
Value:
1
(PID) Process:(3396) instup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\partmgr
Operation:writeName:EnableCounterForIoctl
Value:
1
(PID) Process:(3396) instup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\Avast
Operation:writeName:SetupLog
Value:
C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\Setup.log
(PID) Process:(3396) instup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\Products
Operation:writeName:public-instup 3396
Value:
(PID) Process:(3396) instup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3396) instup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
Operation:writeName:InstupProgress_UpdateSetup_Syncer
Value:
0
Executable files
20
Suspicious files
15
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
3820avast_free_antivirus_setup_online.exeC:\windows\temp\asw.9c0b2f7948d269d5\ecoo.edattext
MD5:4C28DF4F8E6E1F2A249271AB686104FE
SHA256:FDD510F9B6DCC3761A0DD031B5B26A2996A835B2E2FD852982DE203671F8B967
684avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.c86c1c5d59b1ebfe\part-vps_windows-22092000.vpxbinary
MD5:3452F12ABE90A7B69D7FDA854413CD76
SHA256:D6C92487A98DDD0A2FBBCFFC5BC4A556C3BFEA3F591930F1F4D256498BBB1175
684avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.c86c1c5d59b1ebfe\servers.def.vpxbinary
MD5:7D5DDAD12C95AE2E4A4A8C516C727C4F
SHA256:C45725FC02DD2FDB1B6913CBA5003137798D9A836D1D69E4437438B7151B4ACC
684avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.c86c1c5d59b1ebfe\servers.defini
MD5:2BAC3D81306AAA10E8B07C90172C6DFF
SHA256:A210B0C6D0AD739CFB186E57BBF6360F1D47F7B8090A74340E812A68DEB71A38
684avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.c86c1c5d59b1ebfe\prod-vps.vpxbinary
MD5:382CD2DA4DAA789B7B5A5FEE03C01C20
SHA256:8183ECAA33449CDD5B9C2B62BB2A5365597E1188D7A137F73EF407134F41CFB2
684avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.c86c1c5d59b1ebfe\uata64.vpxbinary
MD5:CEAF116BE2B6DA1AFDDF3C1A38E283DD
SHA256:6C061917F68893D365377D93673B677B8ED79252CABB152BD1EF08D955813C55
684avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.c86c1c5d59b1ebfe\config.def.vpxbinary
MD5:C01F6150C0C4D4D88248DA58B2F21E5B
SHA256:265BF995BF8B8C07E9F4E024B38E1400324EE302FA338CA1FC7B62362D087760
3820avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.9c0b2f7948d269d5\avast_free_antivirus_setup_online.exeexecutable
MD5:D5845B1777B18DFEF5A04FF4B8399830
SHA256:37C6D889C132EFBF0FA850B370F4744C34EDEBC3C928F93FF46DF6889DC70FF3
684avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.c86c1c5d59b1ebfe\uat.vpxbinary
MD5:A0C4DD18F77E57FF46F266786CA043A3
SHA256:5F876CE35A9B5D7437710D7BD3DE25AAB30886BF366AD62FE469FAAD0595A536
684avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.c86c1c5d59b1ebfe\part-setup_ais-16091792.vpxbinary
MD5:DBF115ABE87D50990F62A34CDD752854
SHA256:02D129E88982775BB7CBCD444F65AC6481EC393F9D89F6B29DCD0CABABEC71C5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
22
DNS requests
45
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3396
instup.exe
GET
200
184.51.252.162:80
http://y8002308.iavs9x.u.avast.com/iavs9x/servers.def.vpx
US
binary
2.40 Kb
whitelisted
3396
instup.exe
GET
200
184.51.252.162:80
http://y9830512.iavs9x.u.avast.com/iavs9x/offertool_ais-9eb.vpx
US
binary
344 Kb
whitelisted
3396
instup.exe
GET
200
184.51.252.162:80
http://y9830512.iavs9x.u.avast.com/iavs9x/avdump_x86_ais-9eb.vpx
US
binary
329 Kb
whitelisted
3820
avast_free_antivirus_setup_online.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
US
whitelisted
3396
instup.exe
GET
200
184.51.252.154:80
http://y9830512.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
US
binary
572 b
whitelisted
3820
avast_free_antivirus_setup_online.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
US
whitelisted
3396
instup.exe
GET
200
184.51.252.162:80
http://y9830512.iavs9x.u.avast.com/iavs9x/sbr_x86_ais-9eb.vpx
US
binary
9.74 Kb
whitelisted
3820
avast_free_antivirus_setup_online.exe
GET
200
2.16.106.161:80
http://iavs9x.u.avast.com/iavs9x/avast_free_antivirus_setup_online.exe
unknown
executable
8.39 Mb
whitelisted
2384
instup.exe
GET
200
184.51.252.154:80
http://c3978047.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
US
binary
572 b
whitelisted
3820
avast_free_antivirus_setup_online.exe
POST
200
172.217.17.110:80
http://www.google-analytics.com/collect
US
image
35 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
684
avast_free_antivirus_setup_online.exe
34.117.223.223:443
v7event.stats.avast.com
GOOGLE-CLOUD-PLATFORM
US
unknown
3820
avast_free_antivirus_setup_online.exe
34.117.223.223:80
v7event.stats.avast.com
GOOGLE-CLOUD-PLATFORM
US
unknown
684
avast_free_antivirus_setup_online.exe
172.217.17.110:80
www.google-analytics.com
GOOGLE
US
whitelisted
3820
avast_free_antivirus_setup_online.exe
172.217.17.110:80
www.google-analytics.com
GOOGLE
US
whitelisted
3820
avast_free_antivirus_setup_online.exe
2.16.106.161:443
iavs9x.u.avast.com
Akamai International B.V.
DE
whitelisted
2.16.106.161:80
iavs9x.u.avast.com
Akamai International B.V.
DE
whitelisted
3396
instup.exe
69.94.76.71:443
shepherd.ff.avast.com
AVAST Software s.r.o.
CZ
unknown
3396
instup.exe
184.51.252.162:80
b7210692.iavs9x.u.avast.com
Akamai International B.V.
SE
unknown
2384
instup.exe
184.51.252.154:80
b7210692.iavs9x.u.avast.com
Akamai International B.V.
SE
unknown
3396
instup.exe
184.51.252.154:80
b7210692.iavs9x.u.avast.com
Akamai International B.V.
SE
unknown

DNS requests

Domain
IP
Reputation
www.google-analytics.com
  • 172.217.17.110
whitelisted
v7event.stats.avast.com
  • 34.117.223.223
whitelisted
iavs9x.u.avast.com
  • 2.16.106.161
  • 2.16.106.152
whitelisted
analytics.ff.avast.com
  • 34.117.223.223
whitelisted
shepherd.ff.avast.com
  • 5.62.25.40
  • 69.94.76.71
whitelisted
b7210692.iavs9x.u.avast.com
  • 184.51.252.154
  • 184.51.252.162
whitelisted
m0658849.iavs9x.u.avast.com
  • 184.51.252.154
  • 184.51.252.162
whitelisted
n2833777.iavs9x.u.avast.com
  • 184.51.252.154
  • 184.51.252.162
whitelisted
s-iavs9x.avcdn.net
  • 104.76.25.33
whitelisted
y8002308.iavs9x.u.avast.com
  • 184.51.252.154
  • 184.51.252.162
whitelisted

Threats

PID
Process
Class
Message
3820
avast_free_antivirus_setup_online.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info