URL:

https://www.avg.com/cs-cz/download-thank-you.php?product=FREEGSR

Full analysis: https://app.any.run/tasks/2f589ed0-b5cb-4665-9e38-0d401a96b7f9
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 02, 2025, 11:49:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
arch-scr
loader
stealer
antivm
xor-url
generic
pecompact
inno
installer
themida
upx
aspack
api-base64
susp-powershell
Indicators:
MD5:

1C44475200889F2651AEEEF88D8E895B

SHA1:

1E3703E3969D5DB7A851B910B33165A94B861BC1

SHA256:

B0F981A46ADE272AB2FC413386E857438132319075F1A76838B50195996FDE1E

SSDEEP:

3:N8DSL72W3RNPnVWGYj3ggV3n:2OLyIPVnYLg23

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • AVGSvc.exe (PID: 820)
      • aswEngSrv.exe (PID: 3808)
      • AVGBROWSER.EXE (PID: 5880)
      • engsup.exe (PID: 3736)
      • AVGBrowser.exe (PID: 5040)
      • AVGUI.exe (PID: 6136)

    • Changes the autorun value in the registry

      • icarus.exe (PID: 3768)
      • setup.exe (PID: 5608)
      • AVGBROWSER.EXE (PID: 5880)
      • AVGBROWSER.EXE (PID: 3320)

    • Disables Windows Defender

      • wsc_proxy.exe (PID: 2300)

    • Actions looks like stealing of personal data

      • AVGBrowserInstaller.exe (PID: 4724)
      • engsup.exe (PID: 3736)
      • AVGUI.exe (PID: 6136)

    • XORed URL has been found (YARA)

      • aswEngSrv.exe (PID: 3808)
      • AVGSvc.exe (PID: 820)

    • Antivirus name has been found in the command line (generic signature)

      • AVGUI.exe (PID: 6136)
      • AVGUI.exe (PID: 3212)
      • AVGUI.exe (PID: 2224)
      • AVGUI.exe (PID: 4912)
      • AVGUI.exe (PID: 2356)
      • AVGUI.exe (PID: 4008)
      • AVGUI.exe (PID: 3092)
      • AVGUI.exe (PID: 4956)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • avg_antivirus_free_setup.exe (PID: 1880)
      • avg_antivirus_free_online_setup.exe (PID: 2308)
      • icarus_ui.exe (PID: 656)
      • AvEmUpdate.exe (PID: 3408)
      • AvEmUpdate.exe (PID: 2124)
      • AvEmUpdate.exe (PID: 3508)
      • AVGBrowserInstaller.exe (PID: 4724)
      • AVGBrowserUpdate.exe (PID: 5312)
      • AVGBROWSER.EXE (PID: 6036)
      • AVGBROWSER.EXE (PID: 5880)
      • AVGBROWSER.EXE (PID: 3320)
      • AVGBROWSER.EXE (PID: 3500)
      • AVGBrowser.exe (PID: 5972)
      • AVGBrowser.exe (PID: 5040)
      • AVGUI.exe (PID: 6136)

    • Executable content was dropped or overwritten

      • avg_antivirus_free_setup.exe (PID: 1880)
      • avg_antivirus_free_online_setup.exe (PID: 2308)
      • icarus.exe (PID: 3800)
      • icarus.exe (PID: 3768)
      • icarus.exe (PID: 3576)
      • SetupInf.exe (PID: 3080)
      • drvinst.exe (PID: 3204)
      • AvEmUpdate.exe (PID: 3408)
      • AVGSvc.exe (PID: 820)
      • aswOfferTool.exe (PID: 2312)
      • securebrowser_setup.exe (PID: 4260)
      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)
      • setup.exe (PID: 5608)
      • AVGBrowserInstaller.exe (PID: 5588)
      • AVGBrowserInstaller.exe (PID: 4724)
      • ASWOFFERTOOL.EXE (PID: 5164)

    • Checks for external IP

      • avg_antivirus_free_setup.exe (PID: 1880)
      • AvEmUpdate.exe (PID: 3508)
      • AvEmUpdate.exe (PID: 3408)
      • AvEmUpdate.exe (PID: 2124)
      • avgToolsSvc.exe (PID: 2700)
      • AVGSvc.exe (PID: 820)
      • AVGBrowser.exe (PID: 5972)
      • AVGUI.exe (PID: 6136)

    • Starts itself from another location

      • icarus.exe (PID: 3800)
      • AVGBrowserUpdate.exe (PID: 5196)

    • Reads the Internet Settings

      • icarus_ui.exe (PID: 656)
      • AvEmUpdate.exe (PID: 2824)
      • AvEmUpdate.exe (PID: 3508)
      • AvEmUpdate.exe (PID: 3408)
      • AvEmUpdate.exe (PID: 2124)
      • AVGBrowserInstaller.exe (PID: 4724)
      • AVGBrowserUpdate.exe (PID: 5312)
      • AVGBROWSER.EXE (PID: 5880)
      • AVGBROWSER.EXE (PID: 3320)
      • AVGBrowser.exe (PID: 5040)
      • AVGUI.exe (PID: 6136)
      • AVGUI.exe (PID: 4008)
      • AVGUI.exe (PID: 2224)
      • AVGUI.exe (PID: 4912)
      • AVGUI.exe (PID: 4956)
      • AVGUI.exe (PID: 3212)
      • AVGUI.exe (PID: 2356)
      • AVGUI.exe (PID: 3092)

    • Reads security settings of Internet Explorer

      • icarus_ui.exe (PID: 656)
      • AVGSvc.exe (PID: 820)
      • AVGBrowserInstaller.exe (PID: 4724)

    • The process verifies whether the antivirus software is installed

      • icarus.exe (PID: 3768)
      • engsup.exe (PID: 4092)
      • SetupInf.exe (PID: 1072)
      • icarus.exe (PID: 3576)
      • SetupInf.exe (PID: 2688)
      • SetupInf.exe (PID: 2852)
      • SetupInf.exe (PID: 2716)
      • SetupInf.exe (PID: 1120)
      • SetupInf.exe (PID: 2460)
      • SetupInf.exe (PID: 2600)
      • SetupInf.exe (PID: 3080)
      • AvEmUpdate.exe (PID: 3408)
      • AvEmUpdate.exe (PID: 2824)
      • AvEmUpdate.exe (PID: 3508)
      • AvEmUpdate.exe (PID: 2124)
      • wsc_proxy.exe (PID: 3172)
      • RegSvr.exe (PID: 1760)
      • wsc_proxy.exe (PID: 2300)
      • AVGSvc.exe (PID: 820)
      • afwServ.exe (PID: 3352)
      • avgToolsSvc.exe (PID: 2700)
      • aswEngSrv.exe (PID: 3808)
      • icarus.exe (PID: 4432)
      • aswidsagent.exe (PID: 4136)
      • icarus.exe (PID: 4624)
      • AVGBrowserInstaller.exe (PID: 4724)
      • AVGBrowserUpdate.exe (PID: 5196)
      • AVGBrowserUpdate.exe (PID: 5232)
      • AVGBrowserUpdate.exe (PID: 5268)
      • AVGBrowserUpdate.exe (PID: 5380)
      • AVGBrowserUpdate.exe (PID: 5324)
      • AVGBrowserInstaller.exe (PID: 5588)
      • AVGBrowserUpdate.exe (PID: 5312)
      • setup.exe (PID: 5620)
      • setup.exe (PID: 5608)
      • AVGBROWSER.EXE (PID: 5880)
      • AVGBROWSER.EXE (PID: 5892)
      • AVGBROWSER.EXE (PID: 6036)
      • AVGBrowserCrashHandler.exe (PID: 5760)
      • AVGBROWSER.EXE (PID: 6052)
      • ELEVATION_SERVICE.EXE (PID: 6080)
      • AVGBROWSER.EXE (PID: 6024)
      • AVGBROWSER.EXE (PID: 4732)
      • AVGBROWSER.EXE (PID: 4740)
      • AVGBROWSER.EXE (PID: 4768)
      • AVGBROWSER.EXE (PID: 4992)
      • AVGBROWSER.EXE (PID: 4744)
      • AVGBROWSER.EXE (PID: 5248)
      • AVGBROWSER.EXE (PID: 3344)
      • AVGBROWSER.EXE (PID: 5488)
      • ELEVATION_SERVICE.EXE (PID: 4944)
      • AVGBROWSER.EXE (PID: 3500)
      • AVGBROWSER.EXE (PID: 5676)
      • ELEVATION_SERVICE.EXE (PID: 5680)
      • AVGBROWSER.EXE (PID: 3320)
      • AVGBROWSER.EXE (PID: 5600)
      • ELEVATION_SERVICE.EXE (PID: 5408)
      • AVGBROWSER.EXE (PID: 5532)
      • AVGBROWSER.EXE (PID: 5400)
      • AVGBROWSER.EXE (PID: 4584)
      • AVGBROWSER.EXE (PID: 3784)
      • AVGBROWSER.EXE (PID: 4740)
      • AVGBROWSER.EXE (PID: 2564)
      • AVGBROWSER.EXE (PID: 5136)
      • AVGBROWSER.EXE (PID: 5140)
      • AVGBROWSER.EXE (PID: 3844)
      • AVGBROWSER.EXE (PID: 4780)
      • AVGBROWSER.EXE (PID: 2232)
      • AVGBROWSER.EXE (PID: 5064)
      • AVGBROWSER.EXE (PID: 5168)
      • AVGBROWSER.EXE (PID: 6132)
      • AVGBROWSER.EXE (PID: 4700)
      • AVGBROWSER.EXE (PID: 3728)
      • AVGBROWSER.EXE (PID: 6136)
      • AVGBROWSER.EXE (PID: 5352)
      • AVGBROWSER.EXE (PID: 6108)
      • AVGBROWSER.EXE (PID: 524)
      • AVGBROWSER.EXE (PID: 4564)
      • AVGBROWSER.EXE (PID: 4756)
      • AVGBROWSER.EXE (PID: 5952)
      • AVGBROWSER.EXE (PID: 5932)
      • AVGBROWSER.EXE (PID: 5956)
      • AVGBROWSER.EXE (PID: 6064)
      • AVGBrowser.exe (PID: 1276)
      • AVGBrowser.exe (PID: 3692)
      • AVGBrowser.exe (PID: 4944)
      • AVGBrowser.exe (PID: 4448)
      • AVGBrowser.exe (PID: 3784)
      • AVGBROWSER.EXE (PID: 5680)
      • AVGBROWSER.EXE (PID: 3556)
      • AVGBROWSER.EXE (PID: 5644)
      • AVGBrowser.exe (PID: 4560)
      • AVGBrowser.exe (PID: 4856)
      • AVGBrowser.exe (PID: 3308)
      • AVGBrowser.exe (PID: 6016)
      • AVGBrowser.exe (PID: 6132)
      • AVGBrowser.exe (PID: 3912)
      • AVGBrowser.exe (PID: 4644)
      • AVGBrowser.exe (PID: 5004)
      • AVGBrowser.exe (PID: 4772)
      • AVGBrowser.exe (PID: 1980)
      • AVGBrowser.exe (PID: 5424)
      • AVGBrowser.exe (PID: 2464)
      • AVGBrowser.exe (PID: 4768)
      • AVGBrowser.exe (PID: 5632)
      • setup.exe (PID: 4900)
      • AVGBrowser.exe (PID: 5056)
      • setup.exe (PID: 5084)
      • AVGBrowser.exe (PID: 5040)
      • elevation_service.exe (PID: 5624)
      • AVGBrowser.exe (PID: 580)
      • AVGBrowser.exe (PID: 6132)
      • AVGBrowser.exe (PID: 5984)
      • AVGBrowser.exe (PID: 5972)
      • AVGBrowser.exe (PID: 5640)
      • AVGBrowser.exe (PID: 2636)
      • AVGUI.exe (PID: 6136)
      • AVGBrowser.exe (PID: 5896)
      • AVGBrowser.exe (PID: 5912)
      • AVGBrowser.exe (PID: 2464)
      • AVGBrowser.exe (PID: 6088)
      • AVGBrowser.exe (PID: 5076)
      • elevation_service.exe (PID: 4608)
      • overseer.exe (PID: 5904)
      • AVGBrowser.exe (PID: 1744)
      • icarus.exe (PID: 3800)
      • engsup.exe (PID: 3736)
      • AVGBrowser.exe (PID: 5852)
      • icarus.exe (PID: 3648)
      • AVGUI.exe (PID: 2224)
      • AVGUI.exe (PID: 3212)
      • AVGUI.exe (PID: 4912)
      • AVGUI.exe (PID: 3092)
      • AVGUI.exe (PID: 4008)
      • AVGUI.exe (PID: 4956)
      • AVGBrowser.exe (PID: 5344)
      • AVGUI.exe (PID: 2356)
      • AVGBrowser.exe (PID: 6028)
      • AVGBrowser.exe (PID: 6684)

    • The process creates files with name similar to system file names

      • icarus.exe (PID: 3768)

    • Creates/Modifies COM task schedule object

      • icarus.exe (PID: 3768)
      • RegSvr.exe (PID: 1760)
      • AVGBrowserUpdate.exe (PID: 5268)
      • AVGBrowserUpdate.exe (PID: 5196)

    • Creates or modifies Windows services

      • icarus.exe (PID: 3768)

    • Creates a software uninstall entry

      • icarus.exe (PID: 3768)
      • setup.exe (PID: 5608)
      • AVGBrowserInstaller.exe (PID: 4724)
      • ELEVATION_SERVICE.EXE (PID: 6080)
      • ELEVATION_SERVICE.EXE (PID: 5680)
      • elevation_service.exe (PID: 5624)

    • Process drops legitimate windows executable

      • icarus.exe (PID: 3768)

    • The process drops C-runtime libraries

      • icarus.exe (PID: 3768)

    • Drops a system driver (possible attempt to evade defenses)

      • icarus.exe (PID: 3768)
      • SetupInf.exe (PID: 3080)
      • drvinst.exe (PID: 3204)

    • Creates files in the driver directory

      • icarus.exe (PID: 3768)
      • drvinst.exe (PID: 3204)
      • SetupInf.exe (PID: 3080)

    • Adds/modifies Windows certificates

      • SetupInf.exe (PID: 3080)
      • AVGSvc.exe (PID: 820)
      • AVGBrowserInstaller.exe (PID: 4724)
      • AVGBrowserUpdate.exe (PID: 5312)
      • AVGBrowserUpdate.exe (PID: 5380)

    • Application launched itself

      • AvEmUpdate.exe (PID: 3408)
      • setup.exe (PID: 5608)
      • AVGBROWSER.EXE (PID: 5880)
      • AVGBROWSER.EXE (PID: 3320)
      • AVGBROWSER.EXE (PID: 4584)
      • AVGBrowser.exe (PID: 5040)
      • setup.exe (PID: 4900)
      • AVGUI.exe (PID: 6136)
      • AVGBrowser.exe (PID: 6028)

    • Process requests binary or script from the Internet

      • AvEmUpdate.exe (PID: 3408)
      • AVGBrowserUpdate.exe (PID: 5380)

    • Potential Corporate Privacy Violation

      • AvEmUpdate.exe (PID: 3408)
      • AVGBrowserUpdate.exe (PID: 5380)
      • AVGUI.exe (PID: 6136)

    • Executes as Windows Service

      • wsc_proxy.exe (PID: 2300)
      • AVGSvc.exe (PID: 820)
      • afwServ.exe (PID: 3352)
      • avgToolsSvc.exe (PID: 2700)
      • aswidsagent.exe (PID: 4136)
      • AVGBrowserUpdate.exe (PID: 5380)
      • ELEVATION_SERVICE.EXE (PID: 6080)
      • ELEVATION_SERVICE.EXE (PID: 4944)
      • ELEVATION_SERVICE.EXE (PID: 5680)
      • ELEVATION_SERVICE.EXE (PID: 5408)
      • elevation_service.exe (PID: 5624)
      • elevation_service.exe (PID: 4608)

    • Modifies hosts file to alter network resolution

      • AVGSvc.exe (PID: 820)

    • Creates file in the systems drive root

      • aswidsagent.exe (PID: 4136)
      • AVGSvc.exe (PID: 820)

    • Reads the date of Windows installation

      • aswidsagent.exe (PID: 4136)
      • setup.exe (PID: 4900)
      • AVGUI.exe (PID: 6136)
      • AVGSvc.exe (PID: 820)

    • Connects to unusual port

      • AVGSvc.exe (PID: 820)

    • Read startup parameters

      • aswidsagent.exe (PID: 4136)
      • AVGSvc.exe (PID: 820)

    • Checks for Java to be installed

      • AVGSvc.exe (PID: 820)

    • Searches for installed software

      • AVGBrowserInstaller.exe (PID: 4724)
      • setup.exe (PID: 5608)
      • AVGSvc.exe (PID: 820)
      • AVGBROWSER.EXE (PID: 5880)
      • AVGBROWSER.EXE (PID: 3320)
      • AVGBrowser.exe (PID: 5040)
      • overseer.exe (PID: 5904)
      • icarus.exe (PID: 3768)
      • icarus.exe (PID: 3800)

    • Disables SEHOP

      • AVGBrowserUpdate.exe (PID: 5196)

    • There is functionality for VM detection VMWare (YARA)

      • AVGBrowserInstaller.exe (PID: 4724)

    • There is functionality for VM detection antiVM strings (YARA)

      • AVGBrowserInstaller.exe (PID: 4724)
      • aswEngSrv.exe (PID: 3808)

    • There is functionality for taking screenshot (YARA)

      • securebrowser_setup.exe (PID: 4260)
      • AVGBrowserInstaller.exe (PID: 4724)
      • AVGBROWSER.EXE (PID: 4740)

    • There is functionality for VM detection VirtualBox (YARA)

      • AVGBrowserInstaller.exe (PID: 4724)
      • avgToolsSvc.exe (PID: 2700)

    • Reads Mozilla Firefox installation path

      • AVGBROWSER.EXE (PID: 5880)
      • AVGBrowser.exe (PID: 5040)

    • Reads browser cookies

      • engsup.exe (PID: 3736)

    • Reads Microsoft Outlook installation path

      • AVGSvc.exe (PID: 820)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 2932)

    • The sample compiled with english language support

      • chrome.exe (PID: 2932)
      • avg_antivirus_free_setup.exe (PID: 1880)
      • avg_antivirus_free_online_setup.exe (PID: 2308)
      • icarus.exe (PID: 3800)
      • icarus.exe (PID: 3768)
      • icarus.exe (PID: 3576)
      • SetupInf.exe (PID: 3080)
      • drvinst.exe (PID: 3204)
      • AvEmUpdate.exe (PID: 3408)
      • AVGSvc.exe (PID: 820)
      • securebrowser_setup.exe (PID: 4260)
      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)
      • AVGBrowserInstaller.exe (PID: 5588)
      • setup.exe (PID: 5608)
      • ASWOFFERTOOL.EXE (PID: 5164)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2932)

    • Reads the machine GUID from the registry

      • avg_antivirus_free_setup.exe (PID: 1880)
      • avg_antivirus_free_online_setup.exe (PID: 2308)
      • icarus.exe (PID: 3800)
      • icarus_ui.exe (PID: 656)
      • icarus.exe (PID: 3768)
      • icarus.exe (PID: 3576)
      • SetupInf.exe (PID: 3080)
      • drvinst.exe (PID: 3204)
      • AvEmUpdate.exe (PID: 3408)
      • AvEmUpdate.exe (PID: 2124)
      • AvEmUpdate.exe (PID: 3508)
      • wsc_proxy.exe (PID: 3172)
      • afwServ.exe (PID: 3352)
      • AVGSvc.exe (PID: 820)
      • avgToolsSvc.exe (PID: 2700)
      • icarus.exe (PID: 4432)
      • aswidsagent.exe (PID: 4136)
      • icarus.exe (PID: 4624)
      • AVGBrowserInstaller.exe (PID: 4724)
      • AVGBrowserUpdate.exe (PID: 5324)
      • AVGBrowserUpdate.exe (PID: 5380)
      • AVGBrowserUpdate.exe (PID: 5196)
      • AVGBrowserUpdate.exe (PID: 5312)
      • AVGBROWSER.EXE (PID: 5880)
      • setup.exe (PID: 5608)
      • ELEVATION_SERVICE.EXE (PID: 6080)
      • ELEVATION_SERVICE.EXE (PID: 4944)
      • ELEVATION_SERVICE.EXE (PID: 5680)
      • AVGBROWSER.EXE (PID: 3320)
      • ELEVATION_SERVICE.EXE (PID: 5408)
      • AVGBROWSER.EXE (PID: 2564)
      • setup.exe (PID: 4900)
      • AVGBrowser.exe (PID: 5040)
      • elevation_service.exe (PID: 5624)
      • elevation_service.exe (PID: 4608)
      • overseer.exe (PID: 5904)
      • AVGUI.exe (PID: 6136)
      • icarus.exe (PID: 3648)
      • AVGBrowser.exe (PID: 6684)

    • Reads the software policy settings

      • avg_antivirus_free_setup.exe (PID: 1880)
      • avg_antivirus_free_online_setup.exe (PID: 2308)
      • icarus_ui.exe (PID: 656)
      • drvinst.exe (PID: 3204)
      • AvEmUpdate.exe (PID: 3508)
      • AvEmUpdate.exe (PID: 3408)
      • AvEmUpdate.exe (PID: 2124)
      • AVGSvc.exe (PID: 820)
      • AVGBrowserInstaller.exe (PID: 4724)
      • AVGBrowserUpdate.exe (PID: 5380)
      • AVGBrowserUpdate.exe (PID: 5312)
      • AVGUI.exe (PID: 6136)

    • Checks supported languages

      • avg_antivirus_free_setup.exe (PID: 1880)
      • avg_antivirus_free_online_setup.exe (PID: 2308)
      • icarus_ui.exe (PID: 656)
      • icarus.exe (PID: 3576)
      • icarus.exe (PID: 3768)
      • icarus.exe (PID: 3800)
      • engsup.exe (PID: 4092)
      • SetupInf.exe (PID: 2688)
      • SetupInf.exe (PID: 2716)
      • SetupInf.exe (PID: 1072)
      • SetupInf.exe (PID: 1120)
      • SetupInf.exe (PID: 2460)
      • SetupInf.exe (PID: 2852)
      • SetupInf.exe (PID: 2600)
      • SetupInf.exe (PID: 3080)
      • drvinst.exe (PID: 3204)
      • AvEmUpdate.exe (PID: 3408)
      • AvEmUpdate.exe (PID: 2824)
      • AvEmUpdate.exe (PID: 3508)
      • AvEmUpdate.exe (PID: 2124)
      • wsc_proxy.exe (PID: 3172)
      • wsc_proxy.exe (PID: 2300)
      • RegSvr.exe (PID: 1760)
      • AVGSvc.exe (PID: 820)
      • afwServ.exe (PID: 3352)
      • avgToolsSvc.exe (PID: 2700)
      • aswEngSrv.exe (PID: 3808)
      • aswOfferTool.exe (PID: 2312)
      • aswidsagent.exe (PID: 4136)
      • icarus.exe (PID: 4432)
      • icarus.exe (PID: 4624)
      • securebrowser_setup.exe (PID: 4260)
      • AVGBrowserInstaller.exe (PID: 4724)
      • keytool.exe (PID: 4992)
      • keytool.exe (PID: 5100)
      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)
      • AVGBrowserUpdate.exe (PID: 5232)
      • AVGBrowserUpdate.exe (PID: 5268)
      • AVGBrowserUpdate.exe (PID: 5324)
      • AVGBrowserUpdate.exe (PID: 5380)
      • AVGBrowserUpdate.exe (PID: 5312)
      • AVGBrowserInstaller.exe (PID: 5588)
      • setup.exe (PID: 5608)
      • setup.exe (PID: 5620)
      • AVGBROWSER.EXE (PID: 5880)
      • AVGBROWSER.EXE (PID: 5892)
      • AVGBROWSER.EXE (PID: 6024)
      • AVGBROWSER.EXE (PID: 6036)
      • AVGBrowserCrashHandler.exe (PID: 5760)
      • AVGBROWSER.EXE (PID: 6052)
      • ELEVATION_SERVICE.EXE (PID: 6080)
      • AVGBROWSER.EXE (PID: 4732)
      • AVGBROWSER.EXE (PID: 4740)
      • AVGBROWSER.EXE (PID: 4992)
      • AVGBROWSER.EXE (PID: 4744)
      • AVGBROWSER.EXE (PID: 4768)
      • AVGBROWSER.EXE (PID: 5248)
      • AVGBROWSER.EXE (PID: 3344)
      • AVGBROWSER.EXE (PID: 3320)
      • AVGBROWSER.EXE (PID: 5488)
      • ELEVATION_SERVICE.EXE (PID: 4944)
      • AVGBROWSER.EXE (PID: 5600)
      • AVGBROWSER.EXE (PID: 5676)
      • ELEVATION_SERVICE.EXE (PID: 5680)
      • AVGBROWSER.EXE (PID: 3500)
      • ELEVATION_SERVICE.EXE (PID: 5408)
      • AVGBROWSER.EXE (PID: 5400)
      • AVGBROWSER.EXE (PID: 5532)
      • AVGBROWSER.EXE (PID: 5168)
      • AVGBROWSER.EXE (PID: 4584)
      • AVGBROWSER.EXE (PID: 4740)
      • AVGBROWSER.EXE (PID: 5136)
      • AVGBROWSER.EXE (PID: 4780)
      • AVGBROWSER.EXE (PID: 5140)
      • AVGBROWSER.EXE (PID: 3844)
      • AVGBROWSER.EXE (PID: 2232)
      • AVGBROWSER.EXE (PID: 3784)
      • AVGBROWSER.EXE (PID: 2564)
      • AVGBROWSER.EXE (PID: 6132)
      • AVGBROWSER.EXE (PID: 3728)
      • AVGBROWSER.EXE (PID: 4700)
      • AVGBROWSER.EXE (PID: 5352)
      • AVGBROWSER.EXE (PID: 5952)
      • AVGBROWSER.EXE (PID: 5064)
      • AVGBROWSER.EXE (PID: 6108)
      • AVGBROWSER.EXE (PID: 6136)
      • AVGBROWSER.EXE (PID: 4564)
      • AVGBROWSER.EXE (PID: 524)
      • AVGBROWSER.EXE (PID: 4756)
      • AVGBROWSER.EXE (PID: 5680)
      • AVGBROWSER.EXE (PID: 5932)
      • AVGBROWSER.EXE (PID: 5956)
      • AVGBROWSER.EXE (PID: 6064)
      • AVGBrowser.exe (PID: 4560)
      • AVGBrowser.exe (PID: 4944)
      • AVGBrowser.exe (PID: 3784)
      • AVGBROWSER.EXE (PID: 3556)
      • AVGBROWSER.EXE (PID: 5644)
      • AVGBrowser.exe (PID: 1276)
      • AVGBrowser.exe (PID: 3692)
      • AVGBrowser.exe (PID: 4448)
      • AVGBrowser.exe (PID: 6016)
      • AVGBrowser.exe (PID: 3308)
      • AVGBrowser.exe (PID: 3912)
      • AVGBrowser.exe (PID: 4644)
      • AVGBrowser.exe (PID: 6132)
      • AVGBrowser.exe (PID: 4768)
      • AVGBrowser.exe (PID: 5004)
      • AVGBrowser.exe (PID: 4856)
      • AVGBrowser.exe (PID: 4772)
      • AVGBrowser.exe (PID: 5632)
      • AVGBrowser.exe (PID: 5424)
      • AVGBrowser.exe (PID: 1980)
      • AVGBrowser.exe (PID: 2464)
      • AVGBrowser.exe (PID: 5056)
      • setup.exe (PID: 5084)
      • AVGBrowser.exe (PID: 5040)
      • setup.exe (PID: 4900)
      • AVGBrowser.exe (PID: 5972)
      • AVGBrowser.exe (PID: 6132)
      • elevation_service.exe (PID: 5624)
      • AVGBrowser.exe (PID: 5640)
      • AVGBrowser.exe (PID: 580)
      • elevation_service.exe (PID: 4608)
      • AVGBrowser.exe (PID: 2636)
      • AVGBrowser.exe (PID: 5896)
      • AVGBrowser.exe (PID: 5912)
      • AVGBrowser.exe (PID: 2464)
      • overseer.exe (PID: 5904)
      • AVGBrowser.exe (PID: 5984)
      • AVGBrowser.exe (PID: 5076)
      • engsup.exe (PID: 3736)
      • AVGUI.exe (PID: 6136)
      • AVGBrowser.exe (PID: 1744)
      • AVGBrowser.exe (PID: 6088)
      • ASWOFFERTOOL.EXE (PID: 5164)
      • icarus.exe (PID: 3648)
      • AVGBrowser.exe (PID: 5852)
      • AVGUI.exe (PID: 4912)
      • AVGUI.exe (PID: 3212)
      • ASWOFFERTOOL.EXE (PID: 3196)
      • AVGUI.exe (PID: 4008)
      • AVGUI.exe (PID: 3092)
      • AVGUI.exe (PID: 2356)
      • AVGUI.exe (PID: 4956)
      • AVGUI.exe (PID: 2224)
      • AVGBrowser.exe (PID: 6028)
      • AVGBrowser.exe (PID: 5344)
      • AVGBrowser.exe (PID: 6684)

    • Reads the computer name

      • avg_antivirus_free_setup.exe (PID: 1880)
      • avg_antivirus_free_online_setup.exe (PID: 2308)
      • icarus.exe (PID: 3576)
      • icarus.exe (PID: 3800)
      • icarus_ui.exe (PID: 656)
      • icarus.exe (PID: 3768)
      • SetupInf.exe (PID: 2688)
      • SetupInf.exe (PID: 2716)
      • SetupInf.exe (PID: 1072)
      • SetupInf.exe (PID: 1120)
      • SetupInf.exe (PID: 2600)
      • SetupInf.exe (PID: 2460)
      • SetupInf.exe (PID: 3080)
      • SetupInf.exe (PID: 2852)
      • drvinst.exe (PID: 3204)
      • AvEmUpdate.exe (PID: 2824)
      • AvEmUpdate.exe (PID: 3408)
      • AvEmUpdate.exe (PID: 3508)
      • AvEmUpdate.exe (PID: 2124)
      • wsc_proxy.exe (PID: 3172)
      • wsc_proxy.exe (PID: 2300)
      • RegSvr.exe (PID: 1760)
      • afwServ.exe (PID: 3352)
      • AVGSvc.exe (PID: 820)
      • avgToolsSvc.exe (PID: 2700)
      • aswidsagent.exe (PID: 4136)
      • aswOfferTool.exe (PID: 2312)
      • icarus.exe (PID: 4432)
      • icarus.exe (PID: 4624)
      • securebrowser_setup.exe (PID: 4260)
      • AVGBrowserInstaller.exe (PID: 4724)
      • AVGBrowserUpdate.exe (PID: 5196)
      • AVGBrowserUpdate.exe (PID: 5232)
      • AVGBrowserUpdate.exe (PID: 5324)
      • AVGBrowserUpdate.exe (PID: 5380)
      • AVGBrowserUpdate.exe (PID: 5312)
      • AVGBrowserInstaller.exe (PID: 5588)
      • setup.exe (PID: 5608)
      • AVGBROWSER.EXE (PID: 5880)
      • AVGBROWSER.EXE (PID: 6036)
      • ELEVATION_SERVICE.EXE (PID: 6080)
      • AVGBROWSER.EXE (PID: 6024)
      • AVGBROWSER.EXE (PID: 4740)
      • AVGBROWSER.EXE (PID: 5248)
      • ELEVATION_SERVICE.EXE (PID: 4944)
      • ELEVATION_SERVICE.EXE (PID: 5680)
      • AVGBROWSER.EXE (PID: 3500)
      • AVGBROWSER.EXE (PID: 5600)
      • AVGBROWSER.EXE (PID: 3320)
      • ELEVATION_SERVICE.EXE (PID: 5408)
      • AVGBROWSER.EXE (PID: 4740)
      • AVGBROWSER.EXE (PID: 4584)
      • AVGBROWSER.EXE (PID: 2564)
      • setup.exe (PID: 4900)
      • AVGBrowser.exe (PID: 5040)
      • elevation_service.exe (PID: 5624)
      • AVGBrowser.exe (PID: 6132)
      • AVGBrowser.exe (PID: 5972)
      • elevation_service.exe (PID: 4608)
      • overseer.exe (PID: 5904)
      • AVGUI.exe (PID: 6136)
      • engsup.exe (PID: 3736)
      • AVGBrowser.exe (PID: 1744)
      • ASWOFFERTOOL.EXE (PID: 5164)
      • icarus.exe (PID: 3648)
      • ASWOFFERTOOL.EXE (PID: 3196)
      • AVGUI.exe (PID: 3212)
      • AVGUI.exe (PID: 4008)
      • AVGUI.exe (PID: 2356)
      • AVGUI.exe (PID: 4912)
      • AVGUI.exe (PID: 2224)
      • AVGBrowser.exe (PID: 6028)
      • AVGUI.exe (PID: 4956)
      • AVGUI.exe (PID: 3092)
      • AVGBrowser.exe (PID: 6684)

    • Creates files in the program directory

      • avg_antivirus_free_online_setup.exe (PID: 2308)
      • icarus.exe (PID: 3800)
      • icarus_ui.exe (PID: 656)
      • icarus.exe (PID: 3768)
      • engsup.exe (PID: 4092)
      • icarus.exe (PID: 3576)
      • AvEmUpdate.exe (PID: 2824)
      • AvEmUpdate.exe (PID: 3408)
      • wsc_proxy.exe (PID: 3172)
      • afwServ.exe (PID: 3352)
      • avgToolsSvc.exe (PID: 2700)
      • AVGSvc.exe (PID: 820)
      • aswOfferTool.exe (PID: 2312)
      • aswidsagent.exe (PID: 4136)
      • keytool.exe (PID: 4992)
      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)
      • AVGBrowserUpdate.exe (PID: 5380)
      • AVGBrowserInstaller.exe (PID: 5588)
      • setup.exe (PID: 5608)
      • AVGBrowserInstaller.exe (PID: 4724)
      • setup.exe (PID: 4900)
      • AVGUI.exe (PID: 6136)
      • engsup.exe (PID: 3736)
      • ASWOFFERTOOL.EXE (PID: 5164)

    • Create files in a temporary directory

      • avg_antivirus_free_online_setup.exe (PID: 2308)
      • SetupInf.exe (PID: 3080)
      • securebrowser_setup.exe (PID: 4260)
      • AVGBrowserInstaller.exe (PID: 4724)
      • AVGBrowserUpdate.exe (PID: 5380)
      • AVGBROWSER.EXE (PID: 5880)
      • AVGBROWSER.EXE (PID: 3320)
      • AVGBrowser.exe (PID: 5040)
      • engsup.exe (PID: 3736)
      • AVGUI.exe (PID: 6136)

    • Reads CPU info

      • icarus.exe (PID: 3576)
      • icarus_ui.exe (PID: 656)
      • icarus.exe (PID: 3800)
      • icarus.exe (PID: 3768)
      • engsup.exe (PID: 4092)
      • SetupInf.exe (PID: 1072)
      • SetupInf.exe (PID: 1120)
      • SetupInf.exe (PID: 2716)
      • SetupInf.exe (PID: 2852)
      • SetupInf.exe (PID: 2688)
      • SetupInf.exe (PID: 2600)
      • SetupInf.exe (PID: 2460)
      • SetupInf.exe (PID: 3080)
      • AvEmUpdate.exe (PID: 3408)
      • AvEmUpdate.exe (PID: 2824)
      • AvEmUpdate.exe (PID: 3508)
      • AvEmUpdate.exe (PID: 2124)
      • wsc_proxy.exe (PID: 3172)
      • RegSvr.exe (PID: 1760)
      • afwServ.exe (PID: 3352)
      • wsc_proxy.exe (PID: 2300)
      • AVGSvc.exe (PID: 820)
      • avgToolsSvc.exe (PID: 2700)
      • aswidsagent.exe (PID: 4136)
      • aswEngSrv.exe (PID: 3808)
      • icarus.exe (PID: 4432)
      • icarus.exe (PID: 4624)
      • setup.exe (PID: 4900)
      • AVGUI.exe (PID: 6136)
      • engsup.exe (PID: 3736)
      • icarus.exe (PID: 3648)
      • AVGUI.exe (PID: 2224)
      • AVGUI.exe (PID: 3212)
      • AVGUI.exe (PID: 4912)
      • AVGUI.exe (PID: 2356)
      • AVGUI.exe (PID: 4956)
      • AVGUI.exe (PID: 3092)
      • AVGUI.exe (PID: 4008)

    • Reads Environment values

      • icarus.exe (PID: 3768)
      • AvEmUpdate.exe (PID: 2824)
      • AvEmUpdate.exe (PID: 3408)
      • AvEmUpdate.exe (PID: 3508)
      • AvEmUpdate.exe (PID: 2124)
      • afwServ.exe (PID: 3352)
      • AVGSvc.exe (PID: 820)
      • avgToolsSvc.exe (PID: 2700)
      • aswidsagent.exe (PID: 4136)
      • AVGBrowserInstaller.exe (PID: 4724)
      • AVGBROWSER.EXE (PID: 5880)
      • AVGBROWSER.EXE (PID: 3320)
      • AVGBrowser.exe (PID: 5040)
      • AVGUI.exe (PID: 6136)

    • Checks proxy server information

      • icarus_ui.exe (PID: 656)
      • AVGBrowserInstaller.exe (PID: 4724)

    • Creates files or folders in the user directory

      • icarus_ui.exe (PID: 656)
      • AVGBROWSER.EXE (PID: 5880)
      • AVGBROWSER.EXE (PID: 6036)
      • AVGBROWSER.EXE (PID: 3320)
      • AVGBROWSER.EXE (PID: 5488)
      • AVGBROWSER.EXE (PID: 3784)
      • setup.exe (PID: 4900)
      • AVGBROWSER.EXE (PID: 3500)
      • AVGBrowser.exe (PID: 580)
      • AVGBrowser.exe (PID: 5040)
      • AVGBrowser.exe (PID: 5972)
      • AVGUI.exe (PID: 6136)
      • AVGBrowser.exe (PID: 5344)
      • AVGUI.exe (PID: 4912)

    • The sample compiled with czech language support

      • icarus.exe (PID: 3768)
      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • Process checks computer location settings

      • avgToolsSvc.exe (PID: 2700)
      • AVGBrowserInstaller.exe (PID: 4724)
      • AVGBROWSER.EXE (PID: 5880)
      • AVGBROWSER.EXE (PID: 4744)
      • AVGBROWSER.EXE (PID: 4732)
      • AVGBROWSER.EXE (PID: 4768)
      • AVGBROWSER.EXE (PID: 5400)
      • AVGBROWSER.EXE (PID: 5532)
      • AVGBROWSER.EXE (PID: 3320)
      • AVGBrowser.exe (PID: 3308)
      • AVGBrowser.exe (PID: 6016)
      • AVGBrowser.exe (PID: 5632)
      • AVGBrowser.exe (PID: 5424)
      • AVGBrowser.exe (PID: 1980)
      • AVGBrowser.exe (PID: 5056)
      • AVGBrowser.exe (PID: 5040)
      • AVGBrowser.exe (PID: 2464)
      • AVGBrowser.exe (PID: 5076)
      • AVGBrowser.exe (PID: 5984)
      • AVGBrowser.exe (PID: 5896)
      • AVGBrowser.exe (PID: 5912)
      • AVGBrowser.exe (PID: 2636)
      • AVGBrowser.exe (PID: 6088)
      • AVGUI.exe (PID: 6136)
      • AVGUI.exe (PID: 4008)
      • AVGUI.exe (PID: 2356)
      • AVGUI.exe (PID: 3092)
      • AVGUI.exe (PID: 2224)

    • Launching a file from a Registry key

      • icarus.exe (PID: 3768)
      • setup.exe (PID: 5608)
      • AVGBROWSER.EXE (PID: 5880)
      • AVGBROWSER.EXE (PID: 3320)

    • Reads the time zone

      • aswidsagent.exe (PID: 4136)

    • Reads product name

      • aswidsagent.exe (PID: 4136)

    • The sample compiled with arabic language support

      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • The sample compiled with bulgarian language support

      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • The sample compiled with japanese language support

      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • The sample compiled with french language support

      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • The sample compiled with Indonesian language support

      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • The sample compiled with polish language support

      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • The sample compiled with Italian language support

      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • The sample compiled with korean language support

      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • The sample compiled with portuguese language support

      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • The sample compiled with turkish language support

      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • The sample compiled with russian language support

      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • The sample compiled with german language support

      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • The sample compiled with swedish language support

      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • The sample compiled with chinese language support

      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • The sample compiled with slovak language support

      • AVGBrowserUpdateSetup.exe (PID: 5188)
      • AVGBrowserUpdate.exe (PID: 5196)

    • Detects InnoSetup installer (YARA)

      • aswEngSrv.exe (PID: 3808)

    • UPX packer has been detected

      • aswEngSrv.exe (PID: 3808)

    • Aspack has been detected

      • aswEngSrv.exe (PID: 3808)

    • PECompact has been detected (YARA)

      • aswEngSrv.exe (PID: 3808)

    • Themida protector has been detected

      • aswEngSrv.exe (PID: 3808)

    • Detects AutoHotkey samples (YARA)

      • aswEngSrv.exe (PID: 3808)

    • Manual execution by a user

      • AVGUI.exe (PID: 6136)

    • Potential remote process memory writing (Base64 Encoded 'WriteProcessMemory')

      • AVGSvc.exe (PID: 820)

    • Found Base64 encoded network access via PowerShell (YARA)

      • AVGSvc.exe (PID: 820)

    • Process checks whether UAC notifications are on

      • AVGSvc.exe (PID: 820)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(3808) aswEngSrv.exe
Decrypted-URLs (3)http://u.to/
http://www.pussy.com
http://www.ultra.com
Decrypted-URLs (1)https://i.imgurn
Decrypted-URLs (56)http://4dlmng.com/sf
http://4dlmng.com/sfTWJ
http://aspps.ru/libs.tmp
http://automation.whatismyip.com/~
http://cl.ly/;m
http://d.8wei.net/list/t1
http://develsee.info/taveara?q=
http://dl.dropbox.com/u/
http://dl.dropbox.com/u/4
http://dl.dropbox.com/u/5
http://edaysch.ru/includes/js/3v
http://elongoogle.info/taveara?q=A
http://filepop.co.kr/App/auto/
http://goo.gl/GZle0
http://jonathanqtjapalinguasss.com/
http://kkpic.net/ggg/adc/U~
http://lajdbgdefg.net/llll.html?search=%]]%]]%
http://lilj.us/abcd.exe
http://livestatscounter.com/Generic/am.php?pr=
http://loltrain.com
http://m.55et.com/?b22
http://malta.pushmonkey.life/lv7.php?p=&
http://malta.pushmonkey.life/lv7.php?p=&pid=
http://meatspin.com
http://netdhc.com/
http://outware.info/taveara?q=
http://pastebin.com/raw.php?
http://powerdry.info/taveara?q=
http://px.koreasys1.com/receive/r_autoidcnt
http://se.liaobamm.com/
http://secure.oinstaller
http://strong.girlsmist.online/lvx7.php?p=sevenzip&tid=:S
http://strong.girlsmist.online/lvx7.php?p=sevenzip&tid=R
http://update.i9
http://vip.114central.co
http://www.4shared.com/download/
http://www.bitcoinplus.com/generate?for=
http://www.engine-search.biz
http://www.haohack.com/DZ.txt
http://www.momocell.com/log/install.php?mac=
http://www.nighttibia.pl/
http://www.playground.ru/download/?file=
https://api-torrent.ru/api/offer2/get?s
https://api-torrent.ru/api/offer2/get?st
https://api-torrent.ru/api/offer?torrent_id=
https://api-torrentzz.ru/api/offer2/get?st
https://gosoftdl.mail.ru/switcher_pd_3_9.exe
https://loderka.ru/api/offer?v=
https://loderka.ru/api/offer?v=Z
https://loderka.ru/api/soft/launch?torrent_id=
https://loderka.ru/api/soft/open?torrent_id=
https://moytorrent.ru/api/soft/launch?torrent_id=
https://my-games-online.ru/site/?gid=
https://torrent-apis.ru/api/offer?id=
https://www.runonpc.com
https://www2.bancobrasilSc
Decrypted-URLs (3)http://evt17.comw
http://test.voolH
http://zzwx.ru/
Decrypted-URLs (90)http://aa.18dd.net/ww/new
http://api.xxxxxxxxxxxx
http://apis.googlestorge.ru/apis/
http://app2.tsmon.co.kr/filenmsbr/nmsbr
http://buy.haote.com/?
http://cmp.torrentsma
http://ct.chameleontom.org/
http://data.down
http://develsee.info/taveara?q=
http://elongoogle.info/taveara?q=A
http://errors.fullmanlock.com/utility.gif?report=fdata&f&
http://errors.localkeymappeer.com/utility.gif?report=fda9l@
http://errors.localkeymappeer.com/utility.gifou_B
http://errors.neomapobjectrack.com/utility.gif?report=fd
http://errors.nodedomax.com/utility.gif?report=fd
http://errors.staticclientstorage.com/utility.gif?report=fdata&f=]H
http://errors.staticclientstorage.com/utility.gif?report=fdata&y
http://errors.staticinputserv.com/utility.gif?re
http://file.ietab.co.kr/dst/InsideTool_I
http://file.ietab.co.kr/dst/InsideTool_IT
http://get.dribbla.xyzK
http://kcyber.info/pub/dsct.exe
http://kkpic.net/ggg/adc/U~
http://livestatscounter.com/Generic/am.php?pr=
http://logs.clientstaticserv.com/monetization.gif?event=3&ibi
http://logs.datagenserv.com/monetization.gif?event=5&ibic=
http://logs.democlientnet.com/monetization.gif?event=
http://logs.demogensrv.com/monetization.gif?event=5&i
http://logs.geninfocloud.com/monetization.gif?event=5&ibic=
http://logs.genstatsnet.com/monetization.gif?event=5&
http://logs.infodatacloud.com/monetization.gif?event=
http://logs.infogenservice.com/monetization.gif?event=
http://logs.infostatsserv.com/monetization.gif?event=4'
http://logs.loadclientinputsrv.com/monetization.gif?evenA
http://logs.localkeymappeer.com/monetization.gif?event=5
http://logs.neomapobjectrack.com/monetization.gif?eve
http://logs.neomapobjectrack.com/monetization.gif?event=
http://logs.neomapobjectrack.com/monetization.gif?event=Y
http://logs.newclientonlinestorage.com/monetization.gif?event=5&ibic=
http://logs.newdatastatsserv.com/monetization.gif?ev
http://logs.newdatastatsserv.com/monetization.gif?event=
http://logs.newdatastatsserv.com/monetization.gif?event=5&ibic=
http://logs.newinfoclientstack.com/monetization.g
http://logs.newstaticinputserv.com/monetization.gif?event=5&ibic=
http://logs.newstatsd
http://logs.ourstaticdatastorage.com/monetization.gif?ev
http://logs.ourstatsstaticstack.com/monetization.gif?evea8r
http://logs.staticclientstorage.com/monetization.gif?eveZ
http://logs.staticclientstorage.com/monetization.gif?p
http://logs.staticinputserv.com/monetization.gif?event=
http://logs.staticinputserv.com/monetization.gif?event=5.
http://logs.staticinputserv.com/monetization.gif?event=5=
http://malta.pushmonkey.life/lv7.php?p=&
http://malta.pushmonkey.life/lv7.php?p=&pid=
http://mfd.malavida.org/
http://outware.info/taveara?q=
http://pe-ento.com/launch_v3.php?p=
http://pe-ento.com/start_v2.php?p=Y
http://pe-mainin.com/launch.php?p=sevenzip&pid=
http://pf.dlwvit.com/s/
http://pf.dlwvit.com/s/2/
http://powerdry.info/taveara?q=
http://qvc.com/qic/
http://sd.dlwvit.com/s/
http://sd.dlwvit.com/s/1
http://sniff.su
http://softvers.in/adobe.php?ver=93
http://speeddownload.co.uk/?sid=
http://strong.girlsmist.online/lvx7.php?p=sevenzip&tid=:S
http://strong.girlsmist.online/lvx7.php?p=sevenzip&tid=R
http://tap.frip783.xyz/stats.php?bu=
http://up.ic-upp.xyz/stats.php?[
http://up.ic-upp.xyz/stats.php?bu=
http://update.vaccineclean.co.kr/inst
http://www.bitcoinplus.com/generate?for=
http://www.espejosescorts.com/
http://x.azjmp.com/c.php?o=10580&
https://api-torrent.ru/api/offer2/get?s
https://api-torrent.ru/api/offer2/get?st
https://api-torrent.ru/api/offer?torrent_id=
https://api-torrentzz.ru/api/offer2/get?st
https://gosoftdl.mail.ru/switcher_pd_3_9.exe
https://loderka.ru/api/offer?v=
https://loderka.ru/api/offer?v=Z
https://loderka.ru/api/soft/launch?torrent_id=
https://loderka.ru/api/soft/open?torrent_id=
https://moytorrent.ru/api/soft/launch?torrent_id=
https://my-games-online.ru/site/?gid=
https://torrent-apis.ru/api/offer?id=
https://www.runonpc.com
Decrypted-URLs (2)http://dl.dropbox.com/
http://jabox.ru/
(PID) Process(820) AVGSvc.exe
Decrypted-URLs (2)http://dl.dropbox.com/
http://jabox.ru/
Decrypted-URLs (1)https://i.imgurn
Decrypted-URLs (3)http://u.to/
http://www.pussy.com
http://www.ultra.com
Decrypted-URLs (90)http://aa.18dd.net/ww/new
http://api.xxxxxxxxxxxx
http://apis.googlestorge.ru/apis/
http://app2.tsmon.co.kr/filenmsbr/nmsbr
http://buy.haote.com/?
http://cmp.torrentsma
http://ct.chameleontom.org/
http://data.down
http://develsee.info/taveara?q=
http://elongoogle.info/taveara?q=A
http://errors.fullmanlock.com/utility.gif?report=fdata&f&
http://errors.localkeymappeer.com/utility.gif?report=fda9l@
http://errors.localkeymappeer.com/utility.gifou_B
http://errors.neomapobjectrack.com/utility.gif?report=fd
http://errors.nodedomax.com/utility.gif?report=fd
http://errors.staticclientstorage.com/utility.gif?report=fdata&f=]H
http://errors.staticclientstorage.com/utility.gif?report=fdata&y
http://errors.staticinputserv.com/utility.gif?re
http://file.ietab.co.kr/dst/InsideTool_I
http://file.ietab.co.kr/dst/InsideTool_IT
http://get.dribbla.xyzK
http://kcyber.info/pub/dsct.exe
http://kkpic.net/ggg/adc/U~
http://livestatscounter.com/Generic/am.php?pr=
http://logs.clientstaticserv.com/monetization.gif?event=3&ibi
http://logs.datagenserv.com/monetization.gif?event=5&ibic=
http://logs.democlientnet.com/monetization.gif?event=
http://logs.demogensrv.com/monetization.gif?event=5&i
http://logs.geninfocloud.com/monetization.gif?event=5&ibic=
http://logs.genstatsnet.com/monetization.gif?event=5&
http://logs.infodatacloud.com/monetization.gif?event=
http://logs.infogenservice.com/monetization.gif?event=
http://logs.infostatsserv.com/monetization.gif?event=4'
http://logs.loadclientinputsrv.com/monetization.gif?evenA
http://logs.localkeymappeer.com/monetization.gif?event=5
http://logs.neomapobjectrack.com/monetization.gif?eve
http://logs.neomapobjectrack.com/monetization.gif?event=
http://logs.neomapobjectrack.com/monetization.gif?event=Y
http://logs.newclientonlinestorage.com/monetization.gif?event=5&ibic=
http://logs.newdatastatsserv.com/monetization.gif?ev
http://logs.newdatastatsserv.com/monetization.gif?event=
http://logs.newdatastatsserv.com/monetization.gif?event=5&ibic=
http://logs.newinfoclientstack.com/monetization.g
http://logs.newstaticinputserv.com/monetization.gif?event=5&ibic=
http://logs.newstatsd
http://logs.ourstaticdatastorage.com/monetization.gif?ev
http://logs.ourstatsstaticstack.com/monetization.gif?evea8r
http://logs.staticclientstorage.com/monetization.gif?eveZ
http://logs.staticclientstorage.com/monetization.gif?p
http://logs.staticinputserv.com/monetization.gif?event=
http://logs.staticinputserv.com/monetization.gif?event=5.
http://logs.staticinputserv.com/monetization.gif?event=5=
http://malta.pushmonkey.life/lv7.php?p=&
http://malta.pushmonkey.life/lv7.php?p=&pid=
http://mfd.malavida.org/
http://outware.info/taveara?q=
http://pe-ento.com/launch_v3.php?p=
http://pe-ento.com/start_v2.php?p=Y
http://pe-mainin.com/launch.php?p=sevenzip&pid=
http://pf.dlwvit.com/s/
http://pf.dlwvit.com/s/2/
http://powerdry.info/taveara?q=
http://qvc.com/qic/
http://sd.dlwvit.com/s/
http://sd.dlwvit.com/s/1
http://sniff.su
http://softvers.in/adobe.php?ver=93
http://speeddownload.co.uk/?sid=
http://strong.girlsmist.online/lvx7.php?p=sevenzip&tid=:S
http://strong.girlsmist.online/lvx7.php?p=sevenzip&tid=R
http://tap.frip783.xyz/stats.php?bu=
http://up.ic-upp.xyz/stats.php?[
http://up.ic-upp.xyz/stats.php?bu=
http://update.vaccineclean.co.kr/inst
http://www.bitcoinplus.com/generate?for=
http://www.espejosescorts.com/
http://x.azjmp.com/c.php?o=10580&
https://api-torrent.ru/api/offer2/get?s
https://api-torrent.ru/api/offer2/get?st
https://api-torrent.ru/api/offer?torrent_id=
https://api-torrentzz.ru/api/offer2/get?st
https://gosoftdl.mail.ru/switcher_pd_3_9.exe
https://loderka.ru/api/offer?v=
https://loderka.ru/api/offer?v=Z
https://loderka.ru/api/soft/launch?torrent_id=
https://loderka.ru/api/soft/open?torrent_id=
https://moytorrent.ru/api/soft/launch?torrent_id=
https://my-games-online.ru/site/?gid=
https://torrent-apis.ru/api/offer?id=
https://www.runonpc.com
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
225
Monitored processes
175
Malicious processes
146
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs avg_antivirus_free_setup.exe no specs avg_antivirus_free_setup.exe avg_antivirus_free_online_setup.exe icarus.exe icarus_ui.exe icarus.exe icarus.exe chrome.exe no specs chrome.exe no specs engsup.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe drvinst.exe avemupdate.exe no specs avemupdate.exe avemupdate.exe avemupdate.exe regsvr.exe no specs wsc_proxy.exe no specs wsc_proxy.exe no specs afwserv.exe #XOR-URL avgsvc.exe avgtoolssvc.exe #XOR-URL aswengsrv.exe aswoffertool.exe aswidsagent.exe no specs securebrowser_setup.exe icarus.exe unsecapp.exe no specs icarus.exe avgbrowserinstaller.exe keytool.exe no specs icacls.exe no specs keytool.exe no specs avgbrowserupdatesetup.exe avgbrowserupdate.exe avgbrowserupdate.exe no specs avgbrowserupdate.exe no specs avgbrowserupdate.exe avgbrowserupdate.exe no specs avgbrowserupdate.exe avgbrowserinstaller.exe setup.exe setup.exe no specs avgbrowsercrashhandler.exe no specs avgbrowser.exe avgbrowser.exe avgbrowser.exe no specs avgbrowser.exe avgbrowser.exe no specs elevation_service.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs elevation_service.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe avgbrowser.exe no specs elevation_service.exe no specs elevation_service.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs setup.exe no specs setup.exe no specs avgbrowser.exe avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe elevation_service.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgui.exe avgbrowser.exe no specs elevation_service.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs overseer.exe avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs engsup.exe avgbrowser.exe no specs avgbrowser.exe no specs aswoffertool.exe icarus.exe aswoffertool.exe no specs avgui.exe avgui.exe no specs avgui.exe avgui.exe no specs avgui.exe no specs avgui.exe no specs avgui.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
524"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3572 --field-trial-handle=1104,i,10509269214779822398,10342702116726936407,131072 /prefetch:8C:\Program Files\AVG\Browser\Application\AVGBROWSER.EXE—AVGBROWSER.EXE
User:
admin
Company:
AVG Technologies
Integrity Level:
LOW
Description:
AVG Secure Browser
Exit code:
0
Version:
109.0.25992.121
Modules
Images
c:\program files\avg\browser\application\avgbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\avg\antivirus\aswhook.dll
c:\windows\system32\kernelbase.dll
c:\program files\avg\browser\application\109.0.25992.121\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
580"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\AVG\Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win32 --annotation=prod=AVG --annotation=ver=109.0.25992.121 --initial-client-data=0xcc,0xd0,0xd4,0xa0,0xd8,0x55b58b48,0x55b58b58,0x55b58b64C:\Program Files\AVG\Browser\Application\AVGBrowser.exe—AVGBrowser.exe
User:
admin
Company:
AVG Technologies
Integrity Level:
MEDIUM
Description:
AVG Secure Browser
Version:
109.0.25992.121
Modules
Images
c:\program files\avg\browser\application\avgbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\avg\antivirus\aswhook.dll
c:\windows\system32\kernelbase.dll
c:\program files\avg\browser\application\109.0.25992.121\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
656C:\Windows\Temp\asw-fc4f9037-72d5-45a3-aa6c-626626ece134\common\icarus_ui.exe /cookie:mmm_bav_998_999_000_m:dlid_FREEGSR /edat_dir:C:\Windows\Temp\asw.ddc401324e3aec1c /geo:NL /track-guid:22a3067c-89c9-49bc-94a1-9b8bd2206dd3 /sssid:2308 /er_master:master_ep_fce3affd-35b1-4dec-9e74-6a0a762004f6 /er_ui:ui_ep_e24fbd53-f5e2-4860-a237-3bc4ad4a2ef8C:\Windows\Temp\asw-fc4f9037-72d5-45a3-aa6c-626626ece134\common\icarus_ui.exe
icarus.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
AVG UI
Version:
25.6.9397.0
Modules
Images
c:\windows\temp\asw-fc4f9037-72d5-45a3-aa6c-626626ece134\common\icarus_ui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\userenv.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\profapi.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\shell32.dll
820"C:\Program Files\AVG\Antivirus\AVGSvc.exe" /runassvcC:\Program Files\AVG\Antivirus\AVGSvc.exe
services.exe
User:
SYSTEM
Company:
Gen Digital Inc.
Integrity Level:
SYSTEM
Description:
AVG Service
Version:
25.6.10221.0
Modules
Images
c:\program files\avg\antivirus\avgsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shlwapi.dll
xor-url
(PID) Process(820) AVGSvc.exe
Decrypted-URLs (2)http://dl.dropbox.com/
http://jabox.ru/
(PID) Process(820) AVGSvc.exe
Decrypted-URLs (1)https://i.imgurn
(PID) Process(820) AVGSvc.exe
Decrypted-URLs (3)http://u.to/
http://www.pussy.com
http://www.ultra.com
(PID) Process(820) AVGSvc.exe
Decrypted-URLs (90)http://aa.18dd.net/ww/new
http://api.xxxxxxxxxxxx
http://apis.googlestorge.ru/apis/
http://app2.tsmon.co.kr/filenmsbr/nmsbr
http://buy.haote.com/?
http://cmp.torrentsma
http://ct.chameleontom.org/
http://data.down
http://develsee.info/taveara?q=
http://elongoogle.info/taveara?q=A
http://errors.fullmanlock.com/utility.gif?report=fdata&f&
http://errors.localkeymappeer.com/utility.gif?report=fda9l@
http://errors.localkeymappeer.com/utility.gifou_B
http://errors.neomapobjectrack.com/utility.gif?report=fd
http://errors.nodedomax.com/utility.gif?report=fd
http://errors.staticclientstorage.com/utility.gif?report=fdata&f=]H
http://errors.staticclientstorage.com/utility.gif?report=fdata&y
http://errors.staticinputserv.com/utility.gif?re
http://file.ietab.co.kr/dst/InsideTool_I
http://file.ietab.co.kr/dst/InsideTool_IT
http://get.dribbla.xyzK
http://kcyber.info/pub/dsct.exe
http://kkpic.net/ggg/adc/U~
http://livestatscounter.com/Generic/am.php?pr=
http://logs.clientstaticserv.com/monetization.gif?event=3&ibi
http://logs.datagenserv.com/monetization.gif?event=5&ibic=
http://logs.democlientnet.com/monetization.gif?event=
http://logs.demogensrv.com/monetization.gif?event=5&i
http://logs.geninfocloud.com/monetization.gif?event=5&ibic=
http://logs.genstatsnet.com/monetization.gif?event=5&
http://logs.infodatacloud.com/monetization.gif?event=
http://logs.infogenservice.com/monetization.gif?event=
http://logs.infostatsserv.com/monetization.gif?event=4'
http://logs.loadclientinputsrv.com/monetization.gif?evenA
http://logs.localkeymappeer.com/monetization.gif?event=5
http://logs.neomapobjectrack.com/monetization.gif?eve
http://logs.neomapobjectrack.com/monetization.gif?event=
http://logs.neomapobjectrack.com/monetization.gif?event=Y
http://logs.newclientonlinestorage.com/monetization.gif?event=5&ibic=
http://logs.newdatastatsserv.com/monetization.gif?ev
http://logs.newdatastatsserv.com/monetization.gif?event=
http://logs.newdatastatsserv.com/monetization.gif?event=5&ibic=
http://logs.newinfoclientstack.com/monetization.g
http://logs.newstaticinputserv.com/monetization.gif?event=5&ibic=
http://logs.newstatsd
http://logs.ourstaticdatastorage.com/monetization.gif?ev
http://logs.ourstatsstaticstack.com/monetization.gif?evea8r
http://logs.staticclientstorage.com/monetization.gif?eveZ
http://logs.staticclientstorage.com/monetization.gif?p
http://logs.staticinputserv.com/monetization.gif?event=
http://logs.staticinputserv.com/monetization.gif?event=5.
http://logs.staticinputserv.com/monetization.gif?event=5=
http://malta.pushmonkey.life/lv7.php?p=&
http://malta.pushmonkey.life/lv7.php?p=&pid=
http://mfd.malavida.org/
http://outware.info/taveara?q=
http://pe-ento.com/launch_v3.php?p=
http://pe-ento.com/start_v2.php?p=Y
http://pe-mainin.com/launch.php?p=sevenzip&pid=
http://pf.dlwvit.com/s/
http://pf.dlwvit.com/s/2/
http://powerdry.info/taveara?q=
http://qvc.com/qic/
http://sd.dlwvit.com/s/
http://sd.dlwvit.com/s/1
http://sniff.su
http://softvers.in/adobe.php?ver=93
http://speeddownload.co.uk/?sid=
http://strong.girlsmist.online/lvx7.php?p=sevenzip&tid=:S
http://strong.girlsmist.online/lvx7.php?p=sevenzip&tid=R
http://tap.frip783.xyz/stats.php?bu=
http://up.ic-upp.xyz/stats.php?[
http://up.ic-upp.xyz/stats.php?bu=
http://update.vaccineclean.co.kr/inst
http://www.bitcoinplus.com/generate?for=
http://www.espejosescorts.com/
http://x.azjmp.com/c.php?o=10580&
https://api-torrent.ru/api/offer2/get?s
https://api-torrent.ru/api/offer2/get?st
https://api-torrent.ru/api/offer?torrent_id=
https://api-torrentzz.ru/api/offer2/get?st
https://gosoftdl.mail.ru/switcher_pd_3_9.exe
https://loderka.ru/api/offer?v=
https://loderka.ru/api/offer?v=Z
https://loderka.ru/api/soft/launch?torrent_id=
https://loderka.ru/api/soft/open?torrent_id=
https://moytorrent.ru/api/soft/launch?torrent_id=
https://my-games-online.ru/site/?gid=
https://torrent-apis.ru/api/offer?id=
https://www.runonpc.com
872"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3124 --field-trial-handle=1164,i,12210161467858944343,15603037487734219157,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
880"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2036 --field-trial-handle=1164,i,12210161467858944343,15603037487734219157,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
892"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1164,i,12210161467858944343,15603037487734219157,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1072"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:sw_avgNdisC:\Program Files\AVG\Antivirus\SetupInf.exe—icarus.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
AVG Antivirus Installer
Exit code:
0
Version:
25.6.10221.0
Modules
Images
c:\program files\avg\antivirus\setupinf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1120"C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:avgNdisFlt /catalog:avgNdisFlt.catC:\Program Files\AVG\Antivirus\SetupInf.exe—icarus.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
AVG Antivirus Installer
Exit code:
0
Version:
25.6.10221.0
Modules
Images
c:\program files\avg\antivirus\setupinf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1276"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3772 --field-trial-handle=1104,i,10509269214779822398,10342702116726936407,131072 /prefetch:8C:\Program Files\AVG\Browser\Application\AVGBrowser.exe—AVGBROWSER.EXE
User:
admin
Company:
AVG Technologies
Integrity Level:
LOW
Description:
AVG Secure Browser
Exit code:
0
Version:
109.0.25992.121
Modules
Images
c:\program files\avg\browser\application\avgbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\avg\antivirus\aswhook.dll
c:\windows\system32\kernelbase.dll
c:\program files\avg\browser\application\109.0.25992.121\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
Total events
119 310
Read events
115 996
Write events
3 140
Delete events
174

Modification events

(PID) Process:(2932) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2932) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2932) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2932) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2932) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2932) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2932) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(2932) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2932) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2932) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
744
Suspicious files
1 884
Text files
1 057
Unknown types
419

Dropped files

PID
Process
Filename
Type
2932chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF180c9d.TMP —
MD5:—
SHA256:—
2932chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
2932chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
2932chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Variationsbinary
MD5:961E3604F228B0D10541EBF921500C86
SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
2932chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old~RF180d88.TMPtext
MD5:9AEF4FC2E5E6CB2A6B007C4E055E4E2B
SHA256:09690C7F1A6D998629F06D10A8BDA6F1270051DC9DACFFF4C486EEA27259B5C1
2932chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\f5c21504-55db-4a66-9f11-64077fe8812f.tmpbinary
MD5:5058F1AF8388633F609CADB75A75DC9D
SHA256:—
2932chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.oldtext
MD5:BA7689060D5F63DFDFBA8C8E0F41F595
SHA256:24EDAB7802B11854E0F0E84B88324BBCC89406A67108BE429ACD1B7E7F5C7935
2932chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:7834F0F4F84436FBA53DBD269A0EF489
SHA256:13FAEF8B1666BE211F6A0FD9E8DF64B79AAC81C55C5F2FAAF913C82BADC9A060
2932chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF1810c4.TMP —
MD5:—
SHA256:—
2932chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
43
TCP/UDP connections
246
DNS requests
259
Threats
31

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1880
avg_antivirus_free_setup.exe
POST
200
142.250.186.78:80
http://www.google-analytics.com/collect
unknown
—
—
whitelisted
1880
avg_antivirus_free_setup.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
unknown
—
—
whitelisted
1880
avg_antivirus_free_setup.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
unknown
—
—
whitelisted
1880
avg_antivirus_free_setup.exe
POST
200
142.250.186.78:80
http://www.google-analytics.com/collect
unknown
—
—
whitelisted
656
icarus_ui.exe
GET
200
2.16.168.117:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?26accff6c9ce40d2
unknown
—
—
whitelisted
656
icarus_ui.exe
GET
200
216.58.206.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
656
icarus_ui.exe
GET
200
216.58.206.67:80
http://o.pki.goog/s/wr3/dY4/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEHWOSH6KlFk1Eq36xtAHpVc%3D
unknown
—
—
whitelisted
860
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAtN2FlY2ZjMDg0NmNj/1.0.0.17_llkgjffcdpffmhiakmfcdcblohccpfmo.crx
unknown
—
—
whitelisted
656
icarus_ui.exe
GET
200
142.250.185.163:80
http://c.pki.goog/r/r1.crl
unknown
—
—
whitelisted
656
icarus_ui.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2856
chrome.exe
23.212.219.226:443
www.avg.com
AKAMAI-AS
AU
whitelisted
2932
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
2856
chrome.exe
142.250.102.84:443
accounts.google.com
GOOGLE
US
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2856
chrome.exe
104.18.87.42:443
cdn.cookielaw.org
CLOUDFLARENET
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2856
chrome.exe
69.192.160.133:443
s.go-mpulse.net
AKAMAI-AS
DE
whitelisted
2856
chrome.exe
23.35.236.237:443
assets.adobedtm.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.212.174
whitelisted
accounts.google.com
  • 142.250.102.84
whitelisted
www.avg.com
  • 23.212.219.226
whitelisted
cdn.cookielaw.org
  • 104.18.87.42
  • 104.18.86.42
whitelisted
static2.avg.com
  • 23.212.219.226
whitelisted
s.go-mpulse.net
  • 69.192.160.133
whitelisted
assets.adobedtm.com
  • 23.35.236.237
whitelisted
www.googletagmanager.com
  • 142.250.185.104
whitelisted
geolocation.onetrust.com
  • 104.18.32.137
  • 172.64.155.119
whitelisted
dpm.demdex.net
  • 34.243.141.18
  • 79.125.53.58
  • 52.215.126.84
  • 34.253.17.119
  • 34.249.192.123
  • 54.76.215.115
  • 52.209.167.50
  • 34.247.130.49
whitelisted

Threats

PID
Process
Class
Message
2856
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2856
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2856
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2856
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
1080
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
1880
avg_antivirus_free_setup.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
1080
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
3408
AvEmUpdate.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
3408
AvEmUpdate.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
1080
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
Process
Message
afwServ.exe
[2025-07-02 11:52:04.252] [error ] [afwAnen ] [ 3352: 4060] [47CF5B:3557] Setting NLA supress registry failed with error: {} Exception: Insufficient registry permissions: Cannot create registry key (on path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard) Code: 0x00000005 (5)
AVGSvc.exe
[2025-07-02 11:52:04.971] [error ] [events_rep ] [ 820: 3428] [244FEC: 49] asw::burger_event::regular_burger_event_reporter_holder::start_all : starting of class asw::burger_event::data_sharing_preference_report failed with an exception : Identity of Burger client was not set.
AVGSvc.exe
[2025-07-02 11:52:08.096] [error ] [dnsdoh ] [ 820: 3484] [4D6837: 73] failed to restore usage statistics Exception: corrupted file
AVGSvc.exe
[2025-07-02 11:52:09.565] [info ] [nsf_urlinfo] [ 820: 3484] [C22399: 39] Initialize UrlInfoMgr
AVGSvc.exe
[2025-07-02 11:52:09.565] [info ] [nsf_urlinfo] [ 820: 3484] [BA6D43: 46] Starting UrlInfo
AVGSvc.exe
[2025-07-02 11:52:09.581] [info ] [nsf_urlinfo] [ 820: 3484] [C22399: 72] UrlInfoMgr initialized
AVGSvc.exe
[2025-07-02 11:52:09.737] [error ] [av_pp_prov ] [ 820: 1324] [FAB8CB: 268] p_pcage: failed to get bios date
AVGSvc.exe
[2025-07-02 11:52:09.737] [error ] [av_pp_prov ] [ 820: 3424] [FAB8CB: 268] p_pcage: failed to get bios date
AVGSvc.exe
[2025-07-02 11:52:09.768] [error ] [av_pp_prov ] [ 820: 1376] [FAB8CB: 268] p_pcage: failed to get bios date
AVGSvc.exe
[2025-07-02 11:52:10.284] [error ] [AlphaClient] [ 820: 1324] [C005A1: 13] ~sqNfYYjPFZXV/7ITvx1wybS3IHCU3imMj/u0I70OXNaCpgtn0uQVuI/soziBD0rIsosTep+VP4nA/7IpsA8Bw7y9E3aYlXjRmb/1eepeGZ39jxphjuQugtLo/G6wBHDJtLcafY/eaMvC5Kg4uxNbn6+gC0yOzz6T/uqwE7ICTPq+vBpwl5U6lc7ooz+tNF3RqfoeZZDSJ7jU+6ITvR5d14K4FnDS1SWLyOjoK7sfcMG4uRBMkNIpydTlpziqDkHBgA==
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.avg.com/cs-cz/download-thank-you.php?product=FREEGSR