URL:

https://ccleaner.tools.avcdn.net

Full analysis: https://app.any.run/tasks/e0eb0b35-bef5-43d4-82d7-01d33ab85171
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 28, 2024, 05:27:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
loader
amsi-bypass
Indicators:
MD5:

94029D0C6F906C84D204CB8E80F179AE

SHA1:

76EE3E1D653E6D870DB3AC16AD63B7367A90221F

SHA256:

D6FC9FD757F861BA0336E37D89CFE6B9979F7C7DC65C7CD7A9B7ED9BA4D82AB2

SSDEEP:

3:N8bOEuQwGBL/ARn:2yUwGBgn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads settings of System Certificates

      • avast_free_antivirus_online-installation.exe (PID: 1284)
      • avast_free_antivirus_online_setup.exe (PID: 3056)
      • icarus_ui.exe (PID: 3424)

    • Executable content was dropped or overwritten

      • avast_free_antivirus_online-installation.exe (PID: 1284)
      • avast_free_antivirus_online_setup.exe (PID: 3056)
      • icarus.exe (PID: 992)
      • icarus.exe (PID: 3772)
      • icarus.exe (PID: 3444)
      • drvinst.exe (PID: 2656)
      • AvEmUpdate.exe (PID: 2012)
      • aswOfferTool.exe (PID: 3412)
      • securebrowser_setup.exe (PID: 2248)
      • AvastSvc.exe (PID: 876)
      • AvastBrowserUpdateSetup.exe (PID: 4592)
      • AvastBrowserUpdate.exe (PID: 4608)
      • AvastBrowserInstaller.exe (PID: 4960)
      • SetupInf.exe (PID: 2948)

    • Checks for external IP

      • avast_free_antivirus_online-installation.exe (PID: 1284)
      • svchost.exe (PID: 1108)
      • AvEmUpdate.exe (PID: 2084)
      • AvEmUpdate.exe (PID: 1076)
      • AvEmUpdate.exe (PID: 2012)
      • AvastSvc.exe (PID: 876)
      • aswToolsSvc.exe (PID: 3360)

    • Starts itself from another location

      • icarus.exe (PID: 992)
      • AvastBrowserUpdate.exe (PID: 4608)

    • Reads security settings of Internet Explorer

      • icarus_ui.exe (PID: 3424)

    • Reads the Internet Settings

      • icarus_ui.exe (PID: 3424)

    • Checks Windows Trust Settings

      • icarus_ui.exe (PID: 3424)

    • The process creates files with name similar to system file names

      • icarus.exe (PID: 3772)

    • Process drops legitimate windows executable

      • icarus.exe (PID: 3772)

    • The process drops C-runtime libraries

      • icarus.exe (PID: 3772)

    • Creates a software uninstall entry

      • icarus.exe (PID: 3772)

    • Creates or modifies Windows services

      • icarus.exe (PID: 3772)

    • Drops a system driver (possible attempt to evade defenses)

      • icarus.exe (PID: 3772)
      • drvinst.exe (PID: 2656)
      • SetupInf.exe (PID: 2948)

    • Creates/Modifies COM task schedule object

      • icarus.exe (PID: 3772)

    • Adds/modifies Windows certificates

      • SetupInf.exe (PID: 2948)

    • Application launched itself

      • AvEmUpdate.exe (PID: 2012)
      • setup.exe (PID: 5004)

    • Potential Corporate Privacy Violation

      • AvEmUpdate.exe (PID: 2012)
      • AvastBrowserUpdate.exe (PID: 4820)

    • Executes as Windows Service

      • wsc_proxy.exe (PID: 2620)
      • aswidsagent.exe (PID: 2368)
      • aswToolsSvc.exe (PID: 3360)
      • afwServ.exe (PID: 2644)
      • AvastSvc.exe (PID: 876)
      • AvastBrowserUpdate.exe (PID: 4820)

    • The process verifies whether the antivirus software is installed

      • icarus.exe (PID: 3772)

    • Connects to unusual port

      • AvastSvc.exe (PID: 876)

    • Process requests binary or script from the Internet

      • AvastBrowserUpdate.exe (PID: 4820)

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1608)
      • wmpnscfg.exe (PID: 3204)
      • wmpnscfg.exe (PID: 3612)

    • Reads the computer name

      • wmpnscfg.exe (PID: 1608)
      • wmpnscfg.exe (PID: 3204)
      • avast_free_antivirus_online-installation.exe (PID: 1284)
      • avast_free_antivirus_online_setup.exe (PID: 3056)
      • icarus.exe (PID: 992)
      • icarus_ui.exe (PID: 3424)
      • SetupInf.exe (PID: 900)
      • SetupInf.exe (PID: 1104)
      • SetupInf.exe (PID: 2628)
      • SetupInf.exe (PID: 2948)
      • icarus.exe (PID: 3772)
      • icarus.exe (PID: 3444)
      • drvinst.exe (PID: 2656)

    • Checks supported languages

      • wmpnscfg.exe (PID: 1608)
      • wmpnscfg.exe (PID: 3204)
      • avast_free_antivirus_online-installation.exe (PID: 1284)
      • avast_free_antivirus_online_setup.exe (PID: 3056)
      • icarus_ui.exe (PID: 3424)
      • icarus.exe (PID: 992)
      • icarus.exe (PID: 3772)
      • SetupInf.exe (PID: 3416)
      • engsup.exe (PID: 3736)
      • SetupInf.exe (PID: 900)
      • SetupInf.exe (PID: 1004)
      • SetupInf.exe (PID: 1104)
      • SetupInf.exe (PID: 2628)
      • SetupInf.exe (PID: 2572)
      • SetupInf.exe (PID: 2948)
      • icarus.exe (PID: 3444)
      • drvinst.exe (PID: 2656)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 1620)
      • iexplore.exe (PID: 1252)

    • Application launched itself

      • iexplore.exe (PID: 1252)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1252)

    • The process uses the downloaded file

      • iexplore.exe (PID: 1252)

    • Reads the machine GUID from the registry

      • avast_free_antivirus_online-installation.exe (PID: 1284)
      • avast_free_antivirus_online_setup.exe (PID: 3056)
      • icarus.exe (PID: 992)
      • icarus_ui.exe (PID: 3424)
      • icarus.exe (PID: 3772)
      • icarus.exe (PID: 3444)
      • SetupInf.exe (PID: 2948)

    • Reads the software policy settings

      • avast_free_antivirus_online-installation.exe (PID: 1284)
      • avast_free_antivirus_online_setup.exe (PID: 3056)
      • icarus_ui.exe (PID: 3424)

    • Creates files in the program directory

      • avast_free_antivirus_online_setup.exe (PID: 3056)
      • icarus.exe (PID: 992)
      • icarus_ui.exe (PID: 3424)
      • icarus.exe (PID: 3772)

    • Create files in a temporary directory

      • avast_free_antivirus_online_setup.exe (PID: 3056)

    • Reads CPU info

      • icarus_ui.exe (PID: 3424)
      • icarus.exe (PID: 992)
      • icarus.exe (PID: 3444)
      • icarus.exe (PID: 3772)
      • engsup.exe (PID: 3736)
      • SetupInf.exe (PID: 3416)
      • SetupInf.exe (PID: 900)
      • SetupInf.exe (PID: 2020)
      • SetupInf.exe (PID: 1104)
      • SetupInf.exe (PID: 2628)
      • SetupInf.exe (PID: 2572)
      • SetupInf.exe (PID: 2948)

    • Checks proxy server information

      • icarus_ui.exe (PID: 3424)

    • Creates files or folders in the user directory

      • icarus_ui.exe (PID: 3424)

    • Reads Environment values

      • icarus.exe (PID: 3772)

    • Sends debugging messages

      • securebrowser_setup.exe (PID: 2248)
      • AvastSvc.exe (PID: 876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
100
Monitored processes
53
Malicious processes
11
Suspicious processes
2

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs wmpnscfg.exe no specs svchost.exe avast_free_antivirus_online-installation.exe no specs avast_free_antivirus_online-installation.exe avast_free_antivirus_online_setup.exe icarus.exe icarus_ui.exe icarus.exe icarus.exe engsup.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe drvinst.exe avemupdate.exe no specs avemupdate.exe avemupdate.exe avemupdate.exe regsvr.exe no specs wsc_proxy.exe no specs wsc_proxy.exe no specs afwserv.exe no specs avastsvc.exe aswtoolssvc.exe aswengsrv.exe no specs aswoffertool.exe aswidsagent.exe no specs unsecapp.exe no specs icarus.exe securebrowser_setup.exe icarus.exe wmpnscfg.exe no specs keytool.exe no specs icacls.exe no specs keytool.exe no specs avastbrowserupdatesetup.exe avastbrowserupdate.exe avastbrowserupdate.exe no specs avastbrowserupdate.exe no specs avastbrowserupdate.exe avastbrowserupdate.exe no specs avastbrowserupdate.exe avastbrowserinstaller.exe setup.exe no specs setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
820"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\avast_free_antivirus_online-installation.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\avast_free_antivirus_online-installation.exe—iexplore.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
MEDIUM
Description:
Avast Installer
Exit code:
3221226540
Version:
2.1.133.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\78rfyb7z\avast_free_antivirus_online-installation.exe
c:\windows\system32\ntdll.dll
876"C:\Program Files\Avast Software\Avast\AvastSvc.exe" /runassvcC:\Program Files\Avast Software\Avast\AvastSvc.exe
services.exe
User:
SYSTEM
Company:
Gen Digital Inc.
Integrity Level:
SYSTEM
Description:
Avast Service
Version:
24.11.9615.0
Modules
Images
c:\program files\avast software\avast\avastsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shlwapi.dll
900"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /netservice:aswNdisFlt /catalog:aswNdisFlt.catC:\Program Files\Avast Software\Avast\SetupInf.exe—icarus.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
24.11.9615.0
Modules
Images
c:\program files\avast software\avast\setupinf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
992C:\Windows\Temp\asw-5a863273-23c3-4fce-823e-e67c2638e6e0\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-5a863273-23c3-4fce-823e-e67c2638e6e0\icarus-info.xml /install /cookie:mmm_ava_998_999_000_m:brs_msft:dlid_FAV-ONLINE-HP /edat_dir:C:\Windows\Temp\asw.5a56ccbaf4cc58fe /geo:DE /track-guid:4ac27c19-03c7-4c3a-9367-1d183c989fc6 /sssid:3056C:\Windows\Temp\asw-5a863273-23c3-4fce-823e-e67c2638e6e0\common\icarus.exe
avast_free_antivirus_online_setup.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Installer
Version:
24.11.8270.0
Modules
Images
c:\windows\temp\asw-5a863273-23c3-4fce-823e-e67c2638e6e0\common\icarus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1004"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRdr2.catC:\Program Files\Avast Software\Avast\SetupInf.exe—icarus.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
24.11.9615.0
Modules
Images
c:\program files\avast software\avast\setupinf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1016"C:\Program Files\Common Files\Avast Software\Icarus\avast-av-vps\icarus.exe" /checkforupdates:avast-av-vps /silentC:\Program Files\Common Files\Avast Software\Icarus\avast-av-vps\icarus.exe
AvastSvc.exe
User:
SYSTEM
Company:
Gen Digital Inc.
Integrity Level:
SYSTEM
Description:
Avast Installer
Exit code:
0
Version:
24.11.8270.0
1076AvEmUpdate.exe /installer /emupdater /applydll "C:\Program Files\Avast Software\Avast\Setup\71811d12-d3a8-46a4-ad85-24b950e4f4aa.dll"C:\Program Files\Avast Software\Avast\AvEmUpdate.exe
AvEmUpdate.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Emergency Update
Exit code:
0
Version:
24.11.9615.0
Modules
Images
c:\program files\avast software\avast\avemupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
1104"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswHwid.catC:\Program Files\Avast Software\Avast\SetupInf.exe—icarus.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
24.11.9615.0
Modules
Images
c:\program files\avast software\avast\setupinf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1108C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1252"C:\Program Files\Internet Explorer\iexplore.exe" "https://ccleaner.tools.avcdn.net"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
101 866
Read events
99 195
Write events
2 469
Delete events
202

Modification events

(PID) Process:(1252) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(1252) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
795045504
(PID) Process:(1252) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31146326
(PID) Process:(1252) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(1252) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31146326
(PID) Process:(1252) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1252) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1252) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1252) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1252) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
753
Suspicious files
1 459
Text files
446
Unknown types
9

Dropped files

PID
Process
Filename
Type
1620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:DF09F5B55114891F4FC2FA19ADF10C44
SHA256:2F539FA56118CA7FE93202A68D2EA48E9F22922FA4D75EED81E86C31AC9FB054
1108svchost.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cab9282.tmpcompressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
1108svchost.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Tar9283.tmpcat
MD5:78785956AB4E54D6116D673C3491EDFF
SHA256:C514DBDBB13632CBB378C59086C1EBB0BC9B25FFB0A349F2B052B065C0D913E6
1108svchost.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cab809C.tmpcompressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
1108svchost.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Tar80AE.tmpbinary
MD5:78785956AB4E54D6116D673C3491EDFF
SHA256:C514DBDBB13632CBB378C59086C1EBB0BC9B25FFB0A349F2B052B065C0D913E6
1620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:018BDE1ACABD72214A6A52C7146A51EE
SHA256:D60588AA94F35C565E8CEA0E430F87843F72D8A63EB6C7FC030AE5BF88B34DB5
1252iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
1108svchost.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cab80AD.tmpcompressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
1108svchost.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Tar9285.tmpcat
MD5:78785956AB4E54D6116D673C3491EDFF
SHA256:C514DBDBB13632CBB378C59086C1EBB0BC9B25FFB0A349F2B052B065C0D913E6
1252iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[2].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
81
TCP/UDP connections
446
DNS requests
316
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1620
iexplore.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?651840a0ef66a591
unknown
—
—
whitelisted
1252
iexplore.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?19bcfd70676951c9
unknown
—
—
whitelisted
1620
iexplore.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b1cc525a3e4304ca
unknown
—
—
whitelisted
1252
iexplore.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7895ee4110a5ff98
unknown
—
—
whitelisted
1620
iexplore.exe
GET
302
2.19.225.229:80
http://www.avast.com/
unknown
—
—
whitelisted
1252
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1620
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
1620
iexplore.exe
GET
200
142.250.185.227:80
http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCA2A0i4p2rOgqWBJocbuh0
unknown
—
—
whitelisted
1620
iexplore.exe
GET
200
142.250.186.131:80
http://c.pki.goog/r/r1.crl
unknown
—
—
whitelisted
1620
iexplore.exe
GET
200
142.250.186.131:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1620
iexplore.exe
2.16.100.155:443
ccleaner.tools.avcdn.net
Akamai International B.V.
DE
whitelisted
1108
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1620
iexplore.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted
1620
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1252
iexplore.exe
2.23.209.185:443
www.bing.com
Akamai International B.V.
GB
whitelisted
1252
iexplore.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted
1252
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
  • 172.217.18.110
whitelisted
ccleaner.tools.avcdn.net
  • 2.16.100.155
  • 2.16.100.161
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.23.209.185
  • 2.23.209.133
  • 2.23.209.179
  • 2.23.209.182
  • 2.23.209.149
  • 2.23.209.130
  • 2.23.209.187
  • 2.23.209.177
  • 2.23.209.189
whitelisted
www.avast.com
  • 2.19.225.229
whitelisted
cdn.cookielaw.org
  • 104.18.87.42
  • 104.18.86.42
whitelisted
static3.avast.com
  • 104.102.54.39
whitelisted
assets.adobedtm.com
  • 23.32.184.226
whitelisted

Threats

PID
Process
Class
Message
1108
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
1108
svchost.exe
Potentially Bad Traffic
ET INFO Suspicious Domain (polyfill .io) in DNS Lookup
1108
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
1284
avast_free_antivirus_online-installation.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
2012
AvEmUpdate.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
1108
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
2012
AvEmUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1108
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
1076
AvEmUpdate.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
1108
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://ccleaner.tools.avcdn.net