File name:

avast_free_antivirus_setup_online.exe

Full analysis: https://app.any.run/tasks/688236b6-8d9c-4338-a1be-c96109eaba77
Verdict: Malicious activity
Analysis date: November 04, 2024, 02:04:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

0FBBA8D724D56137EE15A8D3F2B58160

SHA1:

64C3D85F9B62C902422C460AEA35E7D35594B64B

SHA256:

C4B6D99E29D643906FA474CABA493243F9F10C749967B3AF364968C73AB803FB

SSDEEP:

6144:MIuaJEM/Jt1zJR+c0mbOoDTdu1hVs9zwLN:MIuaJEiH+cBdDhu1hVpLN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Antivirus name has been found in the command line (generic signature)

      • AvastUI.exe (PID: 6376)
      • AvastUI.exe (PID: 8788)
      • AvastUI.exe (PID: 8072)
      • AvastUI.exe (PID: 8180)
      • AvastUI.exe (PID: 7968)
      • AvastUI.exe (PID: 3744)
      • AvastUI.exe (PID: 8168)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • avast_free_antivirus_setup_online.exe (PID: 6232)
      • avast_free_antivirus_online_setup.exe (PID: 528)
      • icarus.exe (PID: 6740)
      • engsup.exe (PID: 4816)
      • AvEmUpdate.exe (PID: 5284)
      • AvastSvc.exe (PID: 3728)
      • icarus.exe (PID: 6952)
      • icarus.exe (PID: 6904)
      • aswOfferTool.exe (PID: 5912)

    • The process drops C-runtime libraries

      • icarus.exe (PID: 6904)

    • Process drops legitimate windows executable

      • icarus.exe (PID: 6904)

    • Checks for external IP

      • AvEmUpdate.exe (PID: 5284)
      • avast_free_antivirus_setup_online.exe (PID: 6232)
      • aswToolsSvc.exe (PID: 5100)
      • AvastUI.exe (PID: 6376)
      • AvastSvc.exe (PID: 3728)

    • Drops a system driver (possible attempt to evade defenses)

      • icarus.exe (PID: 6904)
      • engsup.exe (PID: 4816)

    • Executes as Windows Service

      • afwServ.exe (PID: 6636)
      • wsc_proxy.exe (PID: 2652)
      • aswToolsSvc.exe (PID: 5100)
      • AvastSvc.exe (PID: 3728)
      • aswidsagent.exe (PID: 7220)

    • Starts itself from another location

      • icarus.exe (PID: 6952)

    • Application launched itself

      • AvastUI.exe (PID: 6376)

    • Potential Corporate Privacy Violation

      • AvastUI.exe (PID: 6376)

  • INFO

    • Checks supported languages

      • avast_free_antivirus_setup_online.exe (PID: 4228)
      • avast_free_antivirus_setup_online.exe (PID: 6692)
      • avast_free_antivirus_setup_online.exe (PID: 4032)
      • avast_free_antivirus_setup_online.exe (PID: 5980)
      • icarus.exe (PID: 6952)
      • avast_free_antivirus_setup_online.exe (PID: 6232)
      • avast_free_antivirus_online_setup.exe (PID: 528)

    • Manual execution by a user

      • avast_free_antivirus_setup_online.exe (PID: 6692)
      • avast_free_antivirus_setup_online.exe (PID: 6848)
      • avast_free_antivirus_setup_online.exe (PID: 6128)
      • avast_free_antivirus_setup_online.exe (PID: 4032)
      • avast_free_antivirus_setup_online.exe (PID: 5980)
      • avast_free_antivirus_setup_online.exe (PID: 7032)
      • avast_free_antivirus_setup_online.exe (PID: 6232)
      • avast_free_antivirus_setup_online.exe (PID: 5652)
      • AvastUI.exe (PID: 6376)

    • Reads the computer name

      • avast_free_antivirus_setup_online.exe (PID: 4228)
      • avast_free_antivirus_setup_online.exe (PID: 6692)
      • avast_free_antivirus_setup_online.exe (PID: 4032)
      • avast_free_antivirus_setup_online.exe (PID: 5980)
      • avast_free_antivirus_setup_online.exe (PID: 6232)
      • avast_free_antivirus_online_setup.exe (PID: 528)
      • icarus.exe (PID: 6952)

    • Reads the machine GUID from the registry

      • avast_free_antivirus_setup_online.exe (PID: 4228)
      • avast_free_antivirus_setup_online.exe (PID: 6692)
      • avast_free_antivirus_setup_online.exe (PID: 4032)
      • avast_free_antivirus_setup_online.exe (PID: 6232)
      • avast_free_antivirus_online_setup.exe (PID: 528)
      • icarus.exe (PID: 6952)

    • Reads the software policy settings

      • avast_free_antivirus_setup_online.exe (PID: 6232)
      • avast_free_antivirus_online_setup.exe (PID: 528)

    • Creates files in the program directory

      • avast_free_antivirus_online_setup.exe (PID: 528)
      • icarus.exe (PID: 6952)

    • Create files in a temporary directory

      • avast_free_antivirus_online_setup.exe (PID: 528)

    • Checks proxy server information

      • avast_free_antivirus_online_setup.exe (PID: 528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:09:20 07:47:50+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 142336
InitializedDataSize: 97792
UninitializedDataSize: -
EntryPoint: 0x1020
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 2.1.133.0
ProductVersionNumber: 2.1.133.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Gen Digital Inc.
Edition: 1
FileDescription: Avast Installer
FileVersion: 2.1.133.0
InternalName: microstub
LegalCopyright: Copyright © 2024 Gen Digital Inc. All rights reserved.
OriginalFileName: microstub.exe
ProductName: Avast
ProductVersion: 2.1.133.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
196
Monitored processes
53
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start avast_free_antivirus_setup_online.exe avast_free_antivirus_setup_online.exe no specs avast_free_antivirus_setup_online.exe avast_free_antivirus_setup_online.exe no specs avast_free_antivirus_setup_online.exe avast_free_antivirus_setup_online.exe no specs avast_free_antivirus_setup_online.exe avast_free_antivirus_setup_online.exe no specs avast_free_antivirus_setup_online.exe avast_free_antivirus_online_setup.exe icarus.exe icarus_ui.exe icarus.exe icarus.exe engsup.exe setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs avemupdate.exe no specs avemupdate.exe regsvr.exe no specs regsvr.exe no specs setupinf.exe no specs wsc_proxy.exe no specs wsc_proxy.exe no specs afwserv.exe no specs avastsvc.exe aswtoolssvc.exe aswengsrv.exe no specs avastnm.exe no specs avastui.exe overseer.exe no specs engsup.exe no specs aswidsagent.exe no specs wpr.exe no specs conhost.exe no specs unsecapp.exe no specs icarus.exe icarus.exe aswoffertool.exe icarus.exe aswoffertool.exe no specs avastui.exe no specs avastui.exe no specs avastui.exe no specs avastui.exe no specs avastui.exe no specs avastui.exe no specs icarus.exe no specs avast_free_antivirus_setup_online.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
528"C:\WINDOWS\Temp\asw.4da634e5ec7afbcb\avast_free_antivirus_online_setup.exe" /cookie:mmm_cdl_ppi_007_703_g /ga_clientid:fbbff6d8-47d9-4008-ba20-e14e24daa882 /edat_dir:C:\WINDOWS\Temp\asw.4da634e5ec7afbcb /geo:DEC:\Windows\Temp\asw.4da634e5ec7afbcb\avast_free_antivirus_online_setup.exe
avast_free_antivirus_setup_online.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Self-Extract Package
Exit code:
0
Version:
24.10.8051.0
Modules
Images
c:\windows\temp\asw.4da634e5ec7afbcb\avast_free_antivirus_online_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
1068"C:\Program Files\Avast Software\Avast\wsc_proxy.exe" /svc /register /ppl_svcC:\Program Files\Avast Software\Avast\wsc_proxy.exe—icarus.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast remediation exe
Exit code:
0
Version:
21.4.6162.0
Modules
Images
c:\program files\avast software\avast\wsc_proxy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\avast software\avast\wsc.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1172"C:\Program Files\Common Files\Avast Software\Icarus\avast-av\aswOfferTool.exe" -checkChromeReactivation -bc=AVFCC:\Program Files\Common Files\Avast Software\Icarus\avast-av\aswOfferTool.exe—AvastSvc.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
MEDIUM
Description:
Avast Offer Installation Tool
Exit code:
0
Version:
24.10.8051.0
Modules
Images
c:\program files\common files\avast software\icarus\avast-av\aswoffertool.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\program files\avast software\avast\x86\aswhook.dll
c:\windows\syswow64\advapi32.dll
1568"C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer /regC:\Program Files\Avast Software\Avast\AvEmUpdate.exe—icarus.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Emergency Update
Exit code:
0
Version:
24.10.9535.0
Modules
Images
c:\program files\avast software\avast\avemupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
1752"C:\Program Files\Avast Software\Avast\x86\RegSvr.exe" "C:\Program Files\Avast Software\Avast\x86\aswAMSI.dll"C:\Program Files\Avast Software\Avast\x86\RegSvr.exe—icarus.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
24.10.9535.0
Modules
Images
c:\program files\avast software\avast\x86\regsvr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\rpcrt4.dll
2652"C:\Program Files\Avast Software\Avast\wsc_proxy.exe" /runassvc /rpcserverC:\Program Files\Avast Software\Avast\wsc_proxy.exe—services.exe
User:
SYSTEM
Company:
AVAST Software
Integrity Level:
SYSTEM
Description:
Avast remediation exe
Version:
21.4.6162.0
Modules
Images
c:\program files\avast software\avast\wsc_proxy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\avast software\avast\wsc.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\userenv.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\user32.dll
3008"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /netservice:sw_aswNdisC:\Program Files\Avast Software\Avast\SetupInf.exe—icarus.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
24.10.9535.0
Modules
Images
c:\program files\avast software\avast\setupinf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
3728"C:\Program Files\Avast Software\Avast\AvastSvc.exe" /runassvcC:\Program Files\Avast Software\Avast\AvastSvc.exe
services.exe
User:
SYSTEM
Company:
Gen Digital Inc.
Integrity Level:
SYSTEM
Description:
Avast Service
Version:
24.10.9535.0
Modules
Images
c:\program files\avast software\avast\avastsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\ole32.dll
3744"C:\Program Files\Avast Software\Avast\AvastUI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=5044,7968820030276890214,3810667415790912066,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --lang=en-US --service-sandbox-type=utility --no-sandbox --force-wave-audio --log-file="C:\Users\admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --log-severity=error --user-agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.3.3626.1895 Safari/537.36 Avastium (0.0.0) (Windows 10.0)" --lang=en-US --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --pack_loading_disabled=1 --log-file="C:\Users\admin\AppData\Roaming\Avast Software\Avast\log\cef_log.txt" --mojo-platform-channel-handle=9312 /prefetch:8C:\Program Files\Avast Software\Avast\AvastUI.exe—AvastUI.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
MEDIUM
Description:
Avast Antivirus
Version:
24.10.9535.0
4032"C:\Users\admin\Desktop\avast_free_antivirus_setup_online.exe" C:\Users\admin\Desktop\avast_free_antivirus_setup_online.exe
explorer.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Installer
Exit code:
2250
Version:
2.1.133.0
Modules
Images
c:\users\admin\desktop\avast_free_antivirus_setup_online.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
32 839
Read events
31 529
Write events
1 194
Delete events
116

Modification events

(PID) Process:(528) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:5FD38555-4B16-40AE-9A09-E2C969CB74AF
Value:
F6D4F52220BB5A3D7246A004278BB23F
(PID) Process:(528) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F
Operation:writeName:7CCD586D-2ABC-42FF-A23B-3731F4F183D9
Value:
F6D4F52220BB5A3D7246A004278BB23F
(PID) Process:(528) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:8C5CFDF4-AB05-4EB0-8EF6-7B4620DC2CF3
Value:
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAesZlDGviXkqpTkZ8zTDMOgQAAAACAAAAAAAQZgAAAAEAACAAAADLgyzWBTg9YWpOSJeXrpyZ355EJuBEoq9eLaF85UuuFAAAAAAOgAAAAAIAACAAAAB0Q4dYnX3nFrLTvr7Z/zlGtlRjkkZN9O/mHidJK4BfIVAAAABIaqTVJ1LZDFnMI5Z1LIIvyDSe0mpiM8yk6QjtAcuDzHNAlhGyVMdVAMwqV08NOPAaQWfCSRX/BmQ+Y/KsJhMb4Eo8il96cJUtPbV4D90rGkAAAACeS34zXTy/Di7+hGTmNHWHZD6/DtQvYburueWGTjIOMQnIEuZAdXbQ0aaOo/32jLuuJSMBj8lOYUGug4fwxdFF
(PID) Process:(528) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F
Operation:writeName:5E1D6A55-0134-486E-A166-38C2E4919BB1
Value:
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAesZlDGviXkqpTkZ8zTDMOgQAAAACAAAAAAAQZgAAAAEAACAAAADLgyzWBTg9YWpOSJeXrpyZ355EJuBEoq9eLaF85UuuFAAAAAAOgAAAAAIAACAAAAB0Q4dYnX3nFrLTvr7Z/zlGtlRjkkZN9O/mHidJK4BfIVAAAABIaqTVJ1LZDFnMI5Z1LIIvyDSe0mpiM8yk6QjtAcuDzHNAlhGyVMdVAMwqV08NOPAaQWfCSRX/BmQ+Y/KsJhMb4Eo8il96cJUtPbV4D90rGkAAAACeS34zXTy/Di7+hGTmNHWHZD6/DtQvYburueWGTjIOMQnIEuZAdXbQ0aaOo/32jLuuJSMBj8lOYUGug4fwxdFF
(PID) Process:(528) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:144807F0-DE37-4C62-9C05-EB4CC64A7A2F
Value:
ccbba44e-f121-4413-af11-8b275830f46f
(PID) Process:(528) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F
Operation:writeName:56C7A9DA-4B11-406A-8B1A-EFF157C294D6
Value:
ccbba44e-f121-4413-af11-8b275830f46f
(PID) Process:(6952) icarus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:144807F0-DE37-4C62-9C05-EB4CC64A7A2F
Value:
ccbba44e-f121-4413-af11-8b275830f46f
(PID) Process:(6952) icarus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:5FD38555-4B16-40AE-9A09-E2C969CB74AF
Value:
F6D4F52220BB5A3D7246A004278BB23F
(PID) Process:(6808) icarus_ui.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6808) icarus_ui.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
742
Suspicious files
2 073
Text files
313
Unknown types
5

Dropped files

PID
Process
Filename
Type
528avast_free_antivirus_online_setup.exeC:\ProgramData\Avast Software\Icarus\Logs\sfx.logtext
MD5:ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA256:F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
6232avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.4da634e5ec7afbcb\avast_free_antivirus_online_setup.exeexecutable
MD5:F30938F2969CE6E9623D410834FEE888
SHA256:DCACFC66439594590A4EFA119DB9C17971B43B988196E15DD85D01F6AEAE8883
528avast_free_antivirus_online_setup.exeC:\Users\admin\AppData\Local\Temp\D566D7D7-DCD6-471C-8109-BE0AD33199E3binary
MD5:51CACEA0FBAE8346C20FB94EFEEF8809
SHA256:5749457FC3E5EE160FE41B6BC0743A890B38FD3F09965828BD19FE269E5BD434
528avast_free_antivirus_online_setup.exeC:\Windows\Temp\asw-cc30dfea-e2eb-47d1-b002-ab7b1e056e1a\common\product-info.xmlxml
MD5:FC92E716B4EC9B43CBDA2C10779ABA43
SHA256:A8504F6015816C3B107C6E70BAC85D61519A4F092070072F27A8955D7331AC92
6232avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.4da634e5ec7afbcb\ecoo.edattext
MD5:EBC76FAAE8A32F1768109B6C5BC631B6
SHA256:3A7BB489AC2AA2BB2DBD9FB0F2D53016E6C55E66F9C2E9AEE7A03B87ACAAF23F
528avast_free_antivirus_online_setup.exeC:\Windows\Temp\asw-cc30dfea-e2eb-47d1-b002-ab7b1e056e1a\common\6d903ff4-da5a-467a-b768-1cc8413f8c5acompressed
MD5:EA34DFDE53D47E1A6146A5758E87D1D1
SHA256:0F37BDEA72DAE09E4719D311E6DF07CED19B5B04D7C451C7C985104C3DA197F1
528avast_free_antivirus_online_setup.exeC:\Users\admin\AppData\Local\Temp\F07D8C6A-04B6-4025-869C-70A788D7B5C0binary
MD5:20072F2F51AA43E357F3D460E3A02615
SHA256:E8EA033B174414D7207BCB462EECB3BA7E0D83AD37A270B6A2174805511FE35A
528avast_free_antivirus_online_setup.exeC:\Windows\Temp\asw-cc30dfea-e2eb-47d1-b002-ab7b1e056e1a\common\fe62b5cc-4f83-45e1-9422-f125631aafb3compressed
MD5:62715702188FE5506873E0A3722BCD02
SHA256:BEAE12C88D0FE15EEA3DEB2384D7AC7AD23FAE52A517BF60343CD59D2402BC5D
528avast_free_antivirus_online_setup.exeC:\Windows\Temp\asw-cc30dfea-e2eb-47d1-b002-ab7b1e056e1a\common\icarus_mod.dllexecutable
MD5:09CF0CFBBDD32727D9B610CA41F2F66E
SHA256:3B97B3825AD9B251600E7081CFB24696E4406CEE64C78A03A47C8554AAC5C0D1
6952icarus.exeC:\ProgramData\Avast Software\Icarus\Logs\report.log —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
74
TCP/UDP connections
380
DNS requests
395
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4228
avast_free_antivirus_setup_online.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
unknown
—
—
whitelisted
4228
avast_free_antivirus_setup_online.exe
POST
200
142.250.186.46:80
http://www.google-analytics.com/collect
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6692
avast_free_antivirus_setup_online.exe
POST
200
142.250.186.46:80
http://www.google-analytics.com/collect
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5980
avast_free_antivirus_setup_online.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
unknown
—
—
whitelisted
5980
avast_free_antivirus_setup_online.exe
POST
200
142.250.186.46:80
http://www.google-analytics.com/collect
unknown
—
—
whitelisted
944
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6232
avast_free_antivirus_setup_online.exe
POST
200
142.250.186.46:80
http://www.google-analytics.com/collect
unknown
—
—
whitelisted
4032
avast_free_antivirus_setup_online.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4292
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4228
avast_free_antivirus_setup_online.exe
34.117.223.223:80
v7event.stats.avast.com
GOOGLE-CLOUD-PLATFORM
US
whitelisted
4228
avast_free_antivirus_setup_online.exe
142.250.186.46:80
www.google-analytics.com
GOOGLE
US
whitelisted
6944
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.238
  • 142.250.185.142
  • 216.58.206.46
whitelisted
www.google-analytics.com
  • 142.250.186.46
  • 216.239.34.178
  • 216.239.38.178
  • 216.239.36.178
  • 216.239.32.178
  • 216.58.206.46
whitelisted
v7event.stats.avast.com
  • 34.117.223.223
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.123
  • 2.23.209.130
  • 2.23.209.133
  • 2.23.209.187
  • 2.23.209.149
  • 2.23.209.182
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.73
  • 40.126.31.67
  • 20.190.159.75
  • 20.190.159.23
  • 40.126.31.71
  • 20.190.159.2
  • 20.190.159.0
  • 20.190.159.73
whitelisted
th.bing.com
  • 104.126.37.163
  • 104.126.37.131
  • 104.126.37.139
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
6232
avast_free_antivirus_setup_online.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
2172
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
5284
AvEmUpdate.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
2172
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
2172
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
5100
aswToolsSvc.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
3728
AvastSvc.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
3728
AvastSvc.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
3728
AvastSvc.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
Process
Message
AvastSvc.exe
[2024-11-04 02:08:50.656] [info ] [nsf_urlinfo] [ 3728: 5652] [239E0C: 46] Starting UrlInfo
AvastSvc.exe
[2024-11-04 02:08:50.656] [info ] [nsf_urlinfo] [ 3728: 5652] [5C9BCB: 39] Initialize UrlInfoMgr
AvastSvc.exe
[2024-11-04 02:08:50.703] [info ] [nsf_urlinfo] [ 3728: 5652] [5C9BCB: 72] UrlInfoMgr initialized
AvastSvc.exe
[2024-11-04 02:08:53.797] [error ] [AlphaClient] [ 3728: 2808] [FDBEAE: 13] ~urYbftzJPpP++bI4qjRO04K4FnCj2CKCwuDoPKwETMCupyBhiM9kuP7U6Cu7H3DBuLkQTJDSKcnU5ac4qg5BwfOyHnqQ3i7Jk73+eO1eG5Dr7F9Imck4uMXutS/kSUHKgrgWcJnVOYKDp6UjsB9K3anuDWeI5DiT1f+ZLag0Q8y+ixx7mdghydH5qS+7GFz6r6ALPZ3NJo7M1LM8ujRM0K+mIH+V2GSJzuevL/AMStGCsBp+k+QmjsKlsyK/H1vAs7Ai
AvastUI.exe
[2024-11-04 02:08:55.281] [error ] [UI:Brows:1 ] [ 6376: 6864] [12AD5C: 83] Failed to get Trackers Count!
AvastUI.exe
[2024-11-04 02:08:55.281] [error ] [UI:Brows:1 ] [ 6376: 6864] [12AD5C: 80] Exception: Request 'app.Antitrack.GetCount' was not processed. Routing parameters:
AvastUI.exe
[2024-11-04 02:08:55.328] [error ] [UI:Brows:1 ] [ 6376: 7540] [12AD5C: 83] Failed to get Trackers Count!
AvastUI.exe
[2024-11-04 02:08:55.328] [error ] [UI:Brows:1 ] [ 6376: 7540] [12AD5C: 80] Exception: Request 'app.Antitrack.GetCount' was not processed. Routing parameters:
AvastUI.exe
[2024-11-04 02:08:55.359] [error ] [browserpass] [ 6376: 5324] [0D88F6: 22] Chrome based: failed to get user data path
AvastUI.exe
[2024-11-04 02:08:55.359] [error ] [browserpass] [ 6376: 5324] [E0557E: 37] AVGSB: failed to read data location(2)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
avast_free_antivirus_setup_online.exe