URL:

https://www.avira.com/en/start-download/product/1930/-I12e2mvtstLKUkGnG-U3eKJ0uoYLc4lDY0eCg2ZeeRMAXyeS4YYmsvxtf-rJOk

Full analysis: https://app.any.run/tasks/0655841e-b586-4f87-8ea6-a326eb6bf312
Verdict: Malicious activity
Analysis date: March 01, 2025, 08:06:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MD5:

0F9B0C16472AA282D7B80C78C0D8B12D

SHA1:

96915F3FA1D0E4C938EAC7942ED65ACB3BEAC4C7

SHA256:

AE6D23E1D06CAD5193476F4ED190492773900560E4EFAB436EA3CE52F1B2260C

SSDEEP:

3:N8DSLSKKFWREB8zkQRKFWNUeWWk/v6cp1vAAYa2bTPi:2OLSbDB8jRKFbJZ6g9AA12/i

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • avira_en_asu70___poptws.exe (PID: 3096)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • avira_en_asu70___poptws.exe (PID: 3096)
      • avira_en_asu70___poptws.exe (PID: 680)

    • Executable content was dropped or overwritten

      • avira_en_asu70___poptws.exe (PID: 3096)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5064)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 5048)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 7652)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 1184)

    • Reads security settings of Internet Explorer

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5064)
      • MicrosoftEdgeUpdate.exe (PID: 6240)
      • ShellExperienceHost.exe (PID: 7308)
      • MicrosoftEdgeUpdate.exe (PID: 7796)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 1184)

    • Checks Windows Trust Settings

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5064)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 1184)

    • There is functionality for taking screenshot (YARA)

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5064)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 5048)
      • MicrosoftEdgeUpdate.exe (PID: 6240)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 7652)
      • MicrosoftEdgeUpdate.exe (PID: 7796)

    • The process verifies whether the antivirus software is installed

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5064)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 1184)

    • Process drops legitimate windows executable

      • MicrosoftEdgeUpdate.exe (PID: 6240)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 5048)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 7652)
      • MicrosoftEdgeUpdate.exe (PID: 7796)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 6240)
      • MicrosoftEdgeUpdate.exe (PID: 7796)

    • Searches for installed software

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 1184)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5064)

    • Creates a software uninstall entry

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 1184)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 5436)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 4996)

    • Create files in a temporary directory

      • avira_en_asu70___poptws.exe (PID: 3096)
      • avira_en_asu70___poptws.exe (PID: 2284)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5064)
      • avira_en_asu70___poptws.exe (PID: 5892)
      • avira_en_asu70___poptws.exe (PID: 680)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 1184)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 4996)

    • Checks supported languages

      • avira_en_asu70___poptws.exe (PID: 3096)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5064)
      • avira_en_asu70___poptws.exe (PID: 2284)
      • ACSSIGNEDIC.EXE (PID: 8080)
      • avira_en_asu70___poptws.exe (PID: 5892)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 5048)
      • MicrosoftEdgeUpdate.exe (PID: 6240)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 7652)
      • ShellExperienceHost.exe (PID: 7308)
      • MicrosoftEdgeUpdate.exe (PID: 7796)
      • avira_en_asu70___poptws.exe (PID: 680)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 1184)
      • ACSSIGNEDIC.EXE (PID: 684)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 2316)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 1328)

    • Reads the computer name

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5064)
      • MicrosoftEdgeUpdate.exe (PID: 6240)
      • MicrosoftEdgeUpdate.exe (PID: 7796)
      • ShellExperienceHost.exe (PID: 7308)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 2316)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 1184)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 1328)

    • Reads the machine GUID from the registry

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5064)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 1184)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 2316)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 1328)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 5548)
      • BackgroundTransferHost.exe (PID: 5776)
      • BackgroundTransferHost.exe (PID: 4408)
      • BackgroundTransferHost.exe (PID: 7300)
      • BackgroundTransferHost.exe (PID: 4688)

    • Reads the software policy settings

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5064)
      • BackgroundTransferHost.exe (PID: 5776)
      • slui.exe (PID: 7980)
      • MicrosoftEdgeUpdate.exe (PID: 6240)
      • wermgr.exe (PID: 7728)
      • MicrosoftEdgeUpdate.exe (PID: 7796)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 1184)
      • wermgr.exe (PID: 6564)
      • slui.exe (PID: 5200)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 5776)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5064)
      • MicrosoftEdgeUpdate.exe (PID: 6240)
      • wermgr.exe (PID: 7728)
      • MicrosoftEdgeUpdate.exe (PID: 7796)
      • wermgr.exe (PID: 6564)
      • slui.exe (PID: 5200)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 1184)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 1328)

    • Disables trace logs

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5064)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 1184)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 1328)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 5776)
      • wermgr.exe (PID: 7728)

    • Creates files in the program directory

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5064)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 5048)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 7652)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 1184)

    • The sample compiled with english language support

      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 5048)
      • MicrosoftEdgeUpdate.exe (PID: 6240)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 5064)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 7652)
      • MicrosoftEdgeUpdate.exe (PID: 7796)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 6240)
      • MicrosoftEdgeUpdate.exe (PID: 7796)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 6240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
196
Monitored processes
48
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs sppextcomobj.exe no specs slui.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs avira_en_asu70___poptws.exe no specs avira_en_asu70___poptws.exe avira.spotlight.bootstrapper.exe schtasks.exe no specs conhost.exe no specs backgroundtransferhost.exe no specs avira_en_asu70___poptws.exe no specs avira_en_asu70___poptws.exe acssignedic.exe no specs backgroundtransferhost.exe chrome.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs avira_en_asu70___poptws.exe no specs avira_en_asu70___poptws.exe rundll32.exe no specs slui.exe microsoftedgewebview2runtimeinstallerx64.exe microsoftedgeupdate.exe wermgr.exe microsoftedgewebview2runtimeinstallerx64.exe shellexperiencehost.exe no specs microsoftedgeupdate.exe wermgr.exe avira.spotlight.bootstrapper.reportingtool.exe no specs conhost.exe no specs avira_en_asu70___poptws.exe no specs avira.spotlight.bootstrapper.exe acssignedic.exe no specs schtasks.exe no specs conhost.exe no specs avira.spotlight.bootstrapper.reportingtool.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680"C:\Users\admin\AppData\Local\Temp\.CR.6460\ece1dd56-9d1c-4620-8dec-b422f01aca6b\avira_en_asu70___poptws.exe" Action=RegisterFallbackUpdater AllowMultipleInstances=true UnpackInCurrentDirectory=trueC:\Users\admin\AppData\Local\Temp\.CR.6460\ece1dd56-9d1c-4620-8dec-b422f01aca6b\avira_en_asu70___poptws.exe—AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE
User:
admin
Company:
Avira Operations GmbH
Integrity Level:
HIGH
Description:
Avira Security
Version:
1.0.49.727
Modules
Images
c:\users\admin\appdata\local\temp\.cr.6460\ece1dd56-9d1c-4620-8dec-b422f01aca6b\avira_en_asu70___poptws.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
684"C:\Users\admin\AppData\Local\Temp\.CR.6460\ece1dd56-9d1c-4620-8dec-b422f01aca6b\.CR.7803\ACSSignedIC.exe"C:\Users\admin\AppData\Local\Temp\.CR.6460\ece1dd56-9d1c-4620-8dec-b422f01aca6b\.CR.7803\ACSSIGNEDIC.EXE—AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE
User:
admin
Company:
Avira Operations GmbH
Integrity Level:
HIGH
Description:
ASCSigned
Exit code:
0
Version:
255.255.255.255
Modules
Images
c:\users\admin\appdata\local\temp\.cr.6460\ece1dd56-9d1c-4620-8dec-b422f01aca6b\.cr.7803\acssignedic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\kernel.appcore.dll
720"C:\Users\admin\Downloads\avira_en_asu70___poptws.exe" C:\Users\admin\Downloads\avira_en_asu70___poptws.exe—chrome.exe
User:
admin
Company:
Avira Operations GmbH
Integrity Level:
MEDIUM
Description:
Avira Security
Exit code:
3221226540
Version:
1.0.49.727
Modules
Images
c:\users\admin\downloads\avira_en_asu70___poptws.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1088\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1184"C:\Users\admin\AppData\Local\Temp\.CR.6460\ece1dd56-9d1c-4620-8dec-b422f01aca6b\.CR.7803\Avira.Spotlight.Bootstrapper.exe" "C:\Users\admin\AppData\Local\Temp\.CR.6460\ece1dd56-9d1c-4620-8dec-b422f01aca6b\.CR.7803\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=avira_en_asu70___poptws.exe Action=RegisterFallbackUpdater AllowMultipleInstances=true C:\Users\admin\AppData\Local\Temp\.CR.6460\ece1dd56-9d1c-4620-8dec-b422f01aca6b\.CR.7803\AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE
avira_en_asu70___poptws.exe
User:
admin
Company:
Avira Operations GmbH
Integrity Level:
HIGH
Description:
Avira Security
Exit code:
0
Version:
1.0.49.727
Modules
Images
c:\users\admin\appdata\local\temp\.cr.6460\ece1dd56-9d1c-4620-8dec-b422f01aca6b\.cr.7803\avira.spotlight.bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1328"C:\Users\admin\AppData\Local\Temp\.CR.6460\ece1dd56-9d1c-4620-8dec-b422f01aca6b\.CR.7803\Avira.Spotlight.Bootstrapper.ReportingTool.exe" /TrackUnsentEventsC:\Users\admin\AppData\Local\Temp\.CR.6460\ece1dd56-9d1c-4620-8dec-b422f01aca6b\.CR.7803\AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE—avira_en_asu70___poptws.exe
User:
admin
Company:
Avira Operations GmbH
Integrity Level:
HIGH
Description:
Avira Security
Version:
1.0.49.727
Modules
Images
c:\users\admin\appdata\local\temp\.cr.6460\ece1dd56-9d1c-4620-8dec-b422f01aca6b\.cr.7803\avira.spotlight.bootstrapper.reportingtool.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2088"C:\Users\admin\Downloads\avira_en_asu70___poptws.exe" C:\Users\admin\Downloads\avira_en_asu70___poptws.exe—chrome.exe
User:
admin
Company:
Avira Operations GmbH
Integrity Level:
MEDIUM
Description:
Avira Security
Exit code:
3221226540
Version:
1.0.49.727
Modules
Images
c:\users\admin\downloads\avira_en_asu70___poptws.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2088"C:\Users\admin\Downloads\avira_en_asu70___poptws.exe" C:\Users\admin\Downloads\avira_en_asu70___poptws.exe—chrome.exe
User:
admin
Company:
Avira Operations GmbH
Integrity Level:
MEDIUM
Description:
Avira Security
Exit code:
3221226540
Version:
1.0.49.727
Modules
Images
c:\users\admin\downloads\avira_en_asu70___poptws.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2268\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2284"C:\Users\admin\Downloads\avira_en_asu70___poptws.exe" C:\Users\admin\Downloads\avira_en_asu70___poptws.exe
chrome.exe
User:
admin
Company:
Avira Operations GmbH
Integrity Level:
HIGH
Description:
Avira Security
Exit code:
1618
Version:
1.0.49.727
Modules
Images
c:\users\admin\downloads\avira_en_asu70___poptws.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
92 841
Read events
92 296
Write events
519
Delete events
26

Modification events

(PID) Process:(4996) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4996) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(4996) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4996) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(4996) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(6244) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
0100000000000000A2656AD8808ADB01
(PID) Process:(3096) avira_en_asu70___poptws.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\Avira.Spotlight.Bootstrapper.exe
Operation:writeName:NoStartPage
Value:
(PID) Process:(5548) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5548) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5548) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
314
Suspicious files
74
Text files
47
Unknown types
0

Dropped files

PID
Process
Filename
Type
4996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF10caa5.TMP —
MD5:—
SHA256:—
4996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF10caa5.TMP —
MD5:—
SHA256:—
4996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
4996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
4996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF10caa5.TMP —
MD5:—
SHA256:—
4996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
4996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF10cab4.TMP —
MD5:—
SHA256:—
4996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
4996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF10cae3.TMP —
MD5:—
SHA256:—
4996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
97
DNS requests
113
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5776
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4424
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4424
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7728
wermgr.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7728
wermgr.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4996
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7408
chrome.exe
2.19.122.202:443
www.avira.com
Akamai International B.V.
DE
whitelisted
7408
chrome.exe
173.194.76.84:443
accounts.google.com
GOOGLE
US
whitelisted
3008
backgroundTaskHost.exe
2.19.122.6:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.142
whitelisted
login.live.com
  • 40.126.31.71
  • 20.190.159.75
  • 40.126.31.131
  • 40.126.31.67
  • 40.126.31.128
  • 20.190.159.71
  • 20.190.159.68
  • 20.190.159.4
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
www.avira.com
  • 2.19.122.202
  • 2.19.122.198
whitelisted
accounts.google.com
  • 173.194.76.84
whitelisted
www.bing.com
  • 2.19.122.6
  • 2.19.122.12
  • 2.19.122.11
  • 2.19.122.16
  • 2.19.122.5
  • 2.19.122.27
  • 2.19.122.28
  • 2.19.122.20
  • 2.19.122.9
whitelisted
cdn.cookielaw.org
  • 104.18.87.42
  • 104.18.86.42
whitelisted
www.webassetscdn.com
  • 2.19.122.223
  • 2.19.122.200
whitelisted
script.crazyegg.com
  • 104.19.147.8
  • 104.19.148.8
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.avira.com/en/start-download/product/1930/-I12e2mvtstLKUkGnG-U3eKJ0uoYLc4lDY0eCg2ZeeRMAXyeS4YYmsvxtf-rJOk