analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

avast_free_antivirus_setup_online.exe

Full analysis: https://app.any.run/tasks/8a68955f-46e4-46ac-9550-8d988c30ae2d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 05, 2022, 01:02:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C931A2D568CDD6FC852112C6D7172D1A

SHA1:

11205AA69C072BBAF4E350293A4C1D7FC2BA2339

SHA256:

ABAE9967E8E74A823C70E6E7E97E7B07E972E58D5F8E28CC6D44685EF7E5A9E8

SSDEEP:

3072:G3FKK+qOLpWZOpHwOnxjhI1a29nMGkvmUCDzTObdPnF5od1Jc+mTSC/REMz5hMcj:G9+qOLoaXjhenMGmmUEebVF+uoBVy6tU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • avast_free_antivirus_setup_online.exe (PID: 3532)
      • avast_free_antivirus_setup_online.exe (PID: 2792)
      • instup.exe (PID: 3248)
      • instup.exe (PID: 2244)
      • aswOfferTool.exe (PID: 3452)
      • aswOfferTool.exe (PID: 3732)
      • aswOfferTool.exe (PID: 1352)

    • Application was dropped or rewritten from another process

      • avast_free_antivirus_setup_online.exe (PID: 2792)
      • instup.exe (PID: 3248)
      • instup.exe (PID: 2244)
      • aswOfferTool.exe (PID: 2112)
      • aswOfferTool.exe (PID: 3220)
      • aswOfferTool.exe (PID: 3452)
      • aswOfferTool.exe (PID: 3732)
      • aswOfferTool.exe (PID: 1352)

    • Loads dropped or rewritten executable

      • instup.exe (PID: 3248)
      • instup.exe (PID: 2244)
      • aswOfferTool.exe (PID: 1352)
      • aswOfferTool.exe (PID: 3452)

  • SUSPICIOUS

    • Reads the computer name

      • avast_free_antivirus_setup_online.exe (PID: 3532)
      • avast_free_antivirus_setup_online.exe (PID: 2792)
      • instup.exe (PID: 3248)
      • instup.exe (PID: 2244)
      • aswOfferTool.exe (PID: 3732)

    • Reads CPU info

      • avast_free_antivirus_setup_online.exe (PID: 2792)
      • instup.exe (PID: 3248)
      • instup.exe (PID: 2244)

    • Checks supported languages

      • avast_free_antivirus_setup_online.exe (PID: 3532)
      • avast_free_antivirus_setup_online.exe (PID: 2792)
      • instup.exe (PID: 3248)
      • instup.exe (PID: 2244)
      • aswOfferTool.exe (PID: 3452)
      • aswOfferTool.exe (PID: 3220)
      • aswOfferTool.exe (PID: 2112)
      • aswOfferTool.exe (PID: 3732)
      • aswOfferTool.exe (PID: 1352)

    • Creates files in the Windows directory

      • avast_free_antivirus_setup_online.exe (PID: 3532)
      • avast_free_antivirus_setup_online.exe (PID: 2792)
      • instup.exe (PID: 3248)
      • instup.exe (PID: 2244)
      • aswOfferTool.exe (PID: 3452)
      • aswOfferTool.exe (PID: 3732)

    • Drops a file with a compile date too recent

      • avast_free_antivirus_setup_online.exe (PID: 3532)
      • avast_free_antivirus_setup_online.exe (PID: 2792)
      • instup.exe (PID: 3248)
      • instup.exe (PID: 2244)
      • aswOfferTool.exe (PID: 3452)
      • aswOfferTool.exe (PID: 1352)
      • aswOfferTool.exe (PID: 3732)

    • Executable content was dropped or overwritten

      • avast_free_antivirus_setup_online.exe (PID: 3532)
      • avast_free_antivirus_setup_online.exe (PID: 2792)
      • instup.exe (PID: 3248)
      • instup.exe (PID: 2244)
      • aswOfferTool.exe (PID: 3452)
      • aswOfferTool.exe (PID: 3732)
      • aswOfferTool.exe (PID: 1352)

    • Creates files in the program directory

      • avast_free_antivirus_setup_online.exe (PID: 2792)
      • instup.exe (PID: 3248)

    • Creates or modifies windows services

      • instup.exe (PID: 3248)

    • Reads Environment values

      • instup.exe (PID: 3248)
      • instup.exe (PID: 2244)

    • Starts itself from another location

      • instup.exe (PID: 3248)
      • aswOfferTool.exe (PID: 3732)

    • Removes files from Windows directory

      • instup.exe (PID: 3248)
      • instup.exe (PID: 2244)
      • aswOfferTool.exe (PID: 3452)
      • aswOfferTool.exe (PID: 3732)

    • Creates a directory in Program Files

      • instup.exe (PID: 2244)

  • INFO

    • Reads settings of System Certificates

      • avast_free_antivirus_setup_online.exe (PID: 3532)
      • avast_free_antivirus_setup_online.exe (PID: 2792)
      • instup.exe (PID: 3248)
      • instup.exe (PID: 2244)

    • Reads the hosts file

      • instup.exe (PID: 3248)
      • instup.exe (PID: 2244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2022-Sep-08 09:36:06
Detected languages:
  • English - United States
  • French - France
  • Portuguese - Brazil
  • Russian - Russia
  • Spanish - Spain (International sort)
Debug artifacts:
  • C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb
CompanyName: AVAST Software
Edition: 1
FileDescription: Avast Installer
FileVersion: 2.1.84.0
InternalName: microstub
LegalCopyright: Copyright (c) 2022 AVAST Software
OriginalFilename: microstub.exe
ProductName: Avast
ProductVersion: 2.1.84.0

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 288

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 6
TimeDateStamp: 2022-Sep-08 09:36:06
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
135274
135680
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.55405
.rdata
143360
40866
40960
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.4232
.data
184320
5552
2560
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.78928
.didat
192512
76
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.599443
.rsrc
196608
70344
70656
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.18555
.reloc
270336
7272
7680
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.51031

Resources

Title
Entropy
Size
Codepage
Language
Type
1
7.90423
8512
UNKNOWN
English - United States
RT_ICON
2
2.20257
16936
UNKNOWN
English - United States
RT_ICON
3
3.15857
9640
UNKNOWN
English - United States
RT_ICON
4
2.91719
4264
UNKNOWN
English - United States
RT_ICON
5
3.77184
1128
UNKNOWN
English - United States
RT_ICON
63
2.29127
116
UNKNOWN
English - United States
RT_STRING
76
3.18649
352
UNKNOWN
English - United States
RT_STRING
100
2.61013
76
UNKNOWN
English - United States
RT_GROUP_ICON
126
2.57629
148
UNKNOWN
English - United States
RT_STRING
132
2.85598
324
UNKNOWN
English - United States
RT_STRING

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
USER32.dll
WindowsCodecs.dll (delay-loaded)
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
10
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start avast_free_antivirus_setup_online.exe no specs avast_free_antivirus_setup_online.exe avast_free_antivirus_setup_online.exe instup.exe instup.exe aswoffertool.exe no specs aswoffertool.exe no specs aswoffertool.exe aswoffertool.exe aswoffertool.exe

Process information

PID
CMD
Path
Indicators
Parent process
2968"C:\Users\admin\AppData\Local\Temp\avast_free_antivirus_setup_online.exe" C:\Users\admin\AppData\Local\Temp\avast_free_antivirus_setup_online.exe—Explorer.EXE
User:
admin
Company:
AVAST Software
Integrity Level:
MEDIUM
Description:
Avast Installer
Exit code:
3221226540
Version:
2.1.84.0
Modules
Images
c:\users\admin\appdata\local\temp\avast_free_antivirus_setup_online.exe
c:\windows\system32\ntdll.dll
3532"C:\Users\admin\AppData\Local\Temp\avast_free_antivirus_setup_online.exe" C:\Users\admin\AppData\Local\Temp\avast_free_antivirus_setup_online.exe
Explorer.EXE
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Installer
Version:
2.1.84.0
Modules
Images
c:\users\admin\appdata\local\temp\avast_free_antivirus_setup_online.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2792"C:\Windows\Temp\asw.c665f83348009143\avast_free_antivirus_setup_online.exe" /cookie:mmm_ava_012_999_a6j_m:dlid_FAV-PPC-WIN-GLOWEB-5664 /ga_clientid:3781bd76-7cd0-4884-bdd2-57347ab6e86e /edat_dir:C:\Windows\Temp\asw.c665f83348009143C:\Windows\Temp\asw.c665f83348009143\avast_free_antivirus_setup_online.exe
avast_free_antivirus_setup_online.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus
Version:
22.9.7554.0
Modules
Images
c:\windows\temp\asw.c665f83348009143\avast_free_antivirus_setup_online.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3248"C:\Windows\Temp\asw.ebe2116064f3c4ac\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.ebe2116064f3c4ac /edition:1 /prod:ais /guid:adc95d4f-f78f-4b63-9e0f-dac9c88df832 /ga_clientid:3781bd76-7cd0-4884-bdd2-57347ab6e86e /cookie:mmm_ava_012_999_a6j_m:dlid_FAV-PPC-WIN-GLOWEB-5664 /ga_clientid:3781bd76-7cd0-4884-bdd2-57347ab6e86e /edat_dir:C:\Windows\Temp\asw.c665f83348009143C:\Windows\Temp\asw.ebe2116064f3c4ac\instup.exe
avast_free_antivirus_setup_online.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Version:
22.9.7554.0
Modules
Images
c:\windows\temp\asw.ebe2116064f3c4ac\instup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
2244"C:\Windows\Temp\asw.ebe2116064f3c4ac\New_16091792\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.ebe2116064f3c4ac /edition:1 /prod:ais /guid:adc95d4f-f78f-4b63-9e0f-dac9c88df832 /ga_clientid:3781bd76-7cd0-4884-bdd2-57347ab6e86e /cookie:mmm_ava_012_999_a6j_m:dlid_FAV-PPC-WIN-GLOWEB-5664 /edat_dir:C:\Windows\Temp\asw.c665f83348009143 /online_installerC:\Windows\Temp\asw.ebe2116064f3c4ac\New_16091792\instup.exe
instup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Version:
22.9.7554.0
Modules
Images
c:\windows\temp\asw.ebe2116064f3c4ac\new_16091792\instup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\wininet.dll
c:\windows\system32\lpk.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\gdi32.dll
3220"C:\Windows\Temp\asw.ebe2116064f3c4ac\New_16091792\aswOfferTool.exe" -checkGToolbar -elevatedC:\Windows\Temp\asw.ebe2116064f3c4ac\New_16091792\aswOfferTool.exe—instup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Offer Installation Tool
Exit code:
2
Version:
22.9.7554.0
Modules
Images
c:\windows\temp\asw.ebe2116064f3c4ac\new_16091792\aswoffertool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\userenv.dll
c:\windows\system32\rpcrt4.dll
2112"C:\Windows\Temp\asw.ebe2116064f3c4ac\New_16091792\aswOfferTool.exe" /check_secure_browserC:\Windows\Temp\asw.ebe2116064f3c4ac\New_16091792\aswOfferTool.exe—instup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Offer Installation Tool
Exit code:
0
Version:
22.9.7554.0
Modules
Images
c:\windows\temp\asw.ebe2116064f3c4ac\new_16091792\aswoffertool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\userenv.dll
c:\windows\system32\rpcrt4.dll
3452"C:\Windows\Temp\asw.ebe2116064f3c4ac\New_16091792\aswOfferTool.exe" -checkChrome -elevatedC:\Windows\Temp\asw.ebe2116064f3c4ac\New_16091792\aswOfferTool.exe
instup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Offer Installation Tool
Exit code:
2
Version:
22.9.7554.0
Modules
Images
c:\windows\temp\asw.ebe2116064f3c4ac\new_16091792\aswoffertool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\userenv.dll
c:\windows\system32\rpcrt4.dll
3732"C:\Windows\Temp\asw.ebe2116064f3c4ac\New_16091792\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFAC:\Windows\Temp\asw.ebe2116064f3c4ac\New_16091792\aswOfferTool.exe
instup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Offer Installation Tool
Exit code:
0
Version:
22.9.7554.0
Modules
Images
c:\windows\temp\asw.ebe2116064f3c4ac\new_16091792\aswoffertool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\userenv.dll
c:\windows\system32\rpcrt4.dll
1352"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFAC:\Users\Public\Documents\aswOfferTool.exe
aswOfferTool.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\public\documents\aswoffertool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\rpcrt4.dll
Total events
17 171
Read events
16 446
Write events
721
Delete events
4

Modification events

(PID) Process:(3532) avast_free_antivirus_setup_online.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Windows\Temp\asw.c665f83348009143
(PID) Process:(3532) avast_free_antivirus_setup_online.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2792) avast_free_antivirus_setup_online.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2792) avast_free_antivirus_setup_online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
Operation:writeName:SfxInstProgress
Value:
0
(PID) Process:(3248) instup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\Avast\properties
Operation:writeName:UseRegistry
Value:
1
(PID) Process:(3248) instup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\partmgr
Operation:writeName:EnableCounterForIoctl
Value:
1
(PID) Process:(3248) instup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\Avast
Operation:writeName:SetupLog
Value:
C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\Setup.log
(PID) Process:(3248) instup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\Products
Operation:writeName:public-instup 3248
Value:
(PID) Process:(3248) instup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3248) instup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
Operation:writeName:InstupProgress_UpdateSetup_Syncer
Value:
0
Executable files
24
Suspicious files
17
Text files
23
Unknown types
0

Dropped files

PID
Process
Filename
Type
2792avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.ebe2116064f3c4ac\cookie.bintext
MD5:4C28DF4F8E6E1F2A249271AB686104FE
SHA256:FDD510F9B6DCC3761A0DD031B5B26A2996A835B2E2FD852982DE203671F8B967
2792avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.ebe2116064f3c4ac\part-setup_ais-16091792.vpxbinary
MD5:DBF115ABE87D50990F62A34CDD752854
SHA256:02D129E88982775BB7CBCD444F65AC6481EC393F9D89F6B29DCD0CABABEC71C5
2792avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.ebe2116064f3c4ac\part-prg_ais-16091792.vpxbinary
MD5:84F56E4CEAAD63734CF685253A5F3E12
SHA256:7D1A7329B6BC23A00704F9116BBB7C024E685609D5036AC7ECD11D2EC147F515
2792avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.ebe2116064f3c4ac\servers.def.vpxbinary
MD5:7D5DDAD12C95AE2E4A4A8C516C727C4F
SHA256:C45725FC02DD2FDB1B6913CBA5003137798D9A836D1D69E4437438B7151B4ACC
2792avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.ebe2116064f3c4ac\servers.defini
MD5:2BAC3D81306AAA10E8B07C90172C6DFF
SHA256:A210B0C6D0AD739CFB186E57BBF6360F1D47F7B8090A74340E812A68DEB71A38
2792avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.ebe2116064f3c4ac\part-jrog2-dca.vpxbinary
MD5:C0D85315A9C01EEA8D8A3FC583C1E9C6
SHA256:0926F7C186C2A89653AF5A7573895CA9606F894056409886B880D5DD7D089784
3532avast_free_antivirus_setup_online.exeC:\windows\temp\asw.c665f83348009143\ecoo.edattext
MD5:4C28DF4F8E6E1F2A249271AB686104FE
SHA256:FDD510F9B6DCC3761A0DD031B5B26A2996A835B2E2FD852982DE203671F8B967
2792avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.ebe2116064f3c4ac\prod-vps.vpxbinary
MD5:382CD2DA4DAA789B7B5A5FEE03C01C20
SHA256:8183ECAA33449CDD5B9C2B62BB2A5365597E1188D7A137F73EF407134F41CFB2
2792avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.ebe2116064f3c4ac\config.def.vpxbinary
MD5:C01F6150C0C4D4D88248DA58B2F21E5B
SHA256:265BF995BF8B8C07E9F4E024B38E1400324EE302FA338CA1FC7B62362D087760
2792avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.ebe2116064f3c4ac\uata64.vpxbinary
MD5:CEAF116BE2B6DA1AFDDF3C1A38E283DD
SHA256:6C061917F68893D365377D93673B677B8ED79252CABB152BD1EF08D955813C55
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
30
DNS requests
57
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3248
instup.exe
GET
200
23.73.139.81:80
http://r9319236.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
US
binary
572 b
whitelisted
3248
instup.exe
GET
200
23.73.139.81:80
http://r9319236.iavs9x.u.avast.com/iavs9x/sbr_x86_ais-9eb.vpx
US
binary
9.74 Kb
whitelisted
3532
avast_free_antivirus_setup_online.exe
GET
200
23.48.23.6:80
http://iavs9x.u.avast.com/iavs9x/avast_free_antivirus_setup_online.exe
US
executable
8.39 Mb
whitelisted
3532
avast_free_antivirus_setup_online.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
US
—
—
whitelisted
3248
instup.exe
GET
200
23.73.139.81:80
http://r9319236.iavs9x.u.avast.com/iavs9x/offertool_ais-9eb.vpx
US
binary
344 Kb
whitelisted
2244
instup.exe
GET
200
23.73.139.81:80
http://b7210692.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
US
binary
572 b
whitelisted
3248
instup.exe
GET
200
23.73.139.81:80
http://r9319236.iavs9x.u.avast.com/iavs9x/avbugreport_ais-9eb.vpx
US
binary
1.17 Mb
whitelisted
3248
instup.exe
GET
200
23.73.139.81:80
http://r9319236.iavs9x.u.avast.com/iavs9x/avdump_x86_ais-9eb.vpx
US
binary
329 Kb
whitelisted
3248
instup.exe
GET
200
23.73.139.81:80
http://r4427608.iavs9x.u.avast.com/iavs9x/servers.def.vpx
US
binary
2.40 Kb
whitelisted
3532
avast_free_antivirus_setup_online.exe
POST
200
142.250.186.46:80
http://www.google-analytics.com/collect
US
image
35 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3532
avast_free_antivirus_setup_online.exe
34.117.223.223:80
v7event.stats.avast.com
GOOGLE-CLOUD-PLATFORM
US
unknown
3532
avast_free_antivirus_setup_online.exe
142.250.186.46:80
www.google-analytics.com
GOOGLE
US
whitelisted
2792
avast_free_antivirus_setup_online.exe
142.250.186.46:80
www.google-analytics.com
GOOGLE
US
whitelisted
3532
avast_free_antivirus_setup_online.exe
23.48.23.6:443
iavs9x.u.avast.com
Akamai International B.V.
DE
suspicious
3532
avast_free_antivirus_setup_online.exe
23.48.23.6:80
iavs9x.u.avast.com
Akamai International B.V.
DE
suspicious
—
—
23.48.23.6:443
iavs9x.u.avast.com
Akamai International B.V.
DE
suspicious
2792
avast_free_antivirus_setup_online.exe
34.117.223.223:443
v7event.stats.avast.com
GOOGLE-CLOUD-PLATFORM
US
unknown
2244
instup.exe
23.73.139.50:80
p1043812.vps18tiny.u.avcdn.net
Akamai International B.V.
GB
unknown
2244
instup.exe
5.62.25.40:443
shepherd.ff.avast.com
AVAST Software s.r.o.
GB
suspicious
2244
instup.exe
5.62.38.15:443
alpha-license-dealer.ff.avast.com
AVAST Software s.r.o.
GB
unknown

DNS requests

Domain
IP
Reputation
v7event.stats.avast.com
  • 34.117.223.223
whitelisted
www.google-analytics.com
  • 142.250.186.46
whitelisted
iavs9x.u.avast.com
  • 23.48.23.6
  • 23.48.23.20
whitelisted
analytics.ff.avast.com
  • 34.117.223.223
whitelisted
shepherd.ff.avast.com
  • 77.234.42.107
  • 77.234.42.94
  • 5.62.25.40
whitelisted
l2983942.iavs9x.u.avast.com
  • 23.73.139.81
  • 23.73.139.56
whitelisted
r4427608.iavs9x.u.avast.com
  • 23.73.139.56
  • 23.73.139.81
whitelisted
r9319236.iavs9x.u.avast.com
  • 23.73.139.56
  • 23.73.139.81
whitelisted
s-iavs9x.avcdn.net
  • 104.120.141.25
whitelisted
s1843811.iavs9x.u.avast.com
  • 23.73.139.56
  • 23.73.139.81
whitelisted

Threats

PID
Process
Class
Message
3532
avast_free_antivirus_setup_online.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
avast_free_antivirus_setup_online.exe