File name:

http://sdl.adaware.com/cdn/avast_free_antivirus_setup_online.exe

Full analysis: https://app.any.run/tasks/93be6dc6-93df-4f75-9d0f-d066b6b5c561
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 10, 2019, 16:06:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

906009D6E7927189F1803DB099B0A162

SHA1:

897D13FE64140A2EC3656180AAE2DE7F06A4E7A1

SHA256:

D833649B72DE406E636081E1A6271310DF0CD62B9E141B8374ED1DE02D7B0701

SSDEEP:

3072:64UW6InDFMe4aLNHmSQcOCK9v/pUABPQ9LWvYEvVUmuJv5Rhr+F7mFIecRYW0cQb:6NWLnD+5VEK93phlRv3UZvyhYW02GkDK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • avast_free_antivirus_setup_online.exe (PID: 3768)
      • instup.exe (PID: 3116)
      • instup.exe (PID: 2488)
      • sbr.exe (PID: 2468)
      • 8ba921a8-0cf1-4086-8c28-748df44b4367.exe (PID: 3528)
      • CCUpdate.exe (PID: 2920)
      • CCUpdate.exe (PID: 2284)
      • CCUpdate.exe (PID: 2544)
      • CCUpdate.exe (PID: 2756)
      • AvastSvc.exe (PID: 3856)
      • AvastNM.exe (PID: 2120)
      • AvEmUpdate.exe (PID: 3716)
      • AvEmUpdate.exe (PID: 2988)
      • AvEmUpdate.exe (PID: 2300)
      • AvEmUpdate.exe (PID: 2376)
      • instup.exe (PID: 3148)
      • instup.exe (PID: 3840)
      • RegSvr.exe (PID: 3712)
      • RegSvr.exe (PID: 3800)
      • overseer.exe (PID: 2672)
      • SetupInf.exe (PID: 3692)
      • SetupInf.exe (PID: 3856)
      • SetupInf.exe (PID: 2748)
      • SetupInf.exe (PID: 2316)
      • wsc_proxy.exe (PID: 2560)
      • aswRunDll.exe (PID: 2280)
      • AvEmUpdate.exe (PID: 1744)
      • AvastUI.exe (PID: 2928)
      • aswOfferTool.exe (PID: 2648)
      • instup.exe (PID: 2728)
      • AvastUI.exe (PID: 3852)

    • Loads dropped or rewritten executable

      • instup.exe (PID: 3116)
      • engsup.exe (PID: 2900)
      • AvEmUpdate.exe (PID: 3716)
      • AvEmUpdate.exe (PID: 2300)
      • instup.exe (PID: 2488)
      • AvEmUpdate.exe (PID: 2988)
      • AvEmUpdate.exe (PID: 2376)
      • RegSvr.exe (PID: 3800)
      • RegSvr.exe (PID: 3712)
      • aswRunDll.exe (PID: 2280)
      • AvastSvc.exe (PID: 3856)
      • engsup.exe (PID: 3916)
      • instup.exe (PID: 3148)
      • instup.exe (PID: 3840)
      • AvEmUpdate.exe (PID: 1744)
      • AvastUI.exe (PID: 2928)
      • instup.exe (PID: 2728)
      • rundll32.exe (PID: 3420)
      • AvastUI.exe (PID: 3852)
      • rundll32.exe (PID: 1380)

    • Downloads executable files from the Internet

      • avast_free_antivirus_setup_online.exe (PID: 3868)
      • AvEmUpdate.exe (PID: 3716)
      • CCUpdate.exe (PID: 2756)

    • Changes settings of System certificates

      • instup.exe (PID: 2488)
      • AvastSvc.exe (PID: 3856)

    • Loads the Task Scheduler COM API

      • AvEmUpdate.exe (PID: 2300)
      • AvEmUpdate.exe (PID: 3716)
      • CCUpdate.exe (PID: 2756)
      • CCUpdate.exe (PID: 2632)
      • overseer.exe (PID: 2672)
      • AvEmUpdate.exe (PID: 1744)

    • Changes the autorun value in the registry

      • instup.exe (PID: 2488)
      • instup.exe (PID: 3840)

    • Stealing of credential data

      • AvastUI.exe (PID: 2928)

  • SUSPICIOUS

    • Creates files in the program directory

      • avast_free_antivirus_setup_online.exe (PID: 3768)
      • instup.exe (PID: 3116)
      • engsup.exe (PID: 2900)
      • instup.exe (PID: 2488)
      • AvEmUpdate.exe (PID: 3716)
      • CCUpdate.exe (PID: 2920)
      • CCUpdate.exe (PID: 2284)
      • CCUpdate.exe (PID: 2756)
      • CCUpdate.exe (PID: 2632)
      • AvastNM.exe (PID: 2120)
      • engsup.exe (PID: 3916)
      • AvastSvc.exe (PID: 3856)
      • instup.exe (PID: 3148)
      • wsc_proxy.exe (PID: 2560)
      • instup.exe (PID: 3840)
      • aswOfferTool.exe (PID: 2648)
      • AvastUI.exe (PID: 2928)

    • Creates files in the Windows directory

      • avast_free_antivirus_setup_online.exe (PID: 3868)
      • avast_free_antivirus_setup_online.exe (PID: 3768)
      • instup.exe (PID: 3116)
      • instup.exe (PID: 2488)
      • AvastSvc.exe (PID: 3856)
      • keytool.exe (PID: 2364)
      • keytool.exe (PID: 1860)

    • Low-level read access rights to disk partition

      • avast_free_antivirus_setup_online.exe (PID: 3868)
      • instup.exe (PID: 3116)
      • avast_free_antivirus_setup_online.exe (PID: 3768)
      • instup.exe (PID: 2488)
      • AvEmUpdate.exe (PID: 3716)
      • AvEmUpdate.exe (PID: 2988)
      • CCUpdate.exe (PID: 2920)
      • AvEmUpdate.exe (PID: 2376)
      • CCUpdate.exe (PID: 2284)
      • CCUpdate.exe (PID: 2756)
      • CCUpdate.exe (PID: 2632)
      • CCUpdate.exe (PID: 2544)
      • overseer.exe (PID: 2672)
      • AvastSvc.exe (PID: 3856)
      • wsc_proxy.exe (PID: 2560)
      • instup.exe (PID: 3840)
      • instup.exe (PID: 3148)
      • AvEmUpdate.exe (PID: 1744)
      • AvastUI.exe (PID: 2928)
      • instup.exe (PID: 2728)
      • AvastUI.exe (PID: 3852)

    • Executable content was dropped or overwritten

      • avast_free_antivirus_setup_online.exe (PID: 3868)
      • avast_free_antivirus_setup_online.exe (PID: 3768)
      • instup.exe (PID: 3116)
      • instup.exe (PID: 2488)
      • AvEmUpdate.exe (PID: 3716)
      • AvEmUpdate.exe (PID: 2376)
      • CCUpdate.exe (PID: 2920)
      • CCUpdate.exe (PID: 2284)
      • AvastSvc.exe (PID: 3856)
      • instup.exe (PID: 3840)
      • aswOfferTool.exe (PID: 2648)

    • Removes files from Windows directory

      • instup.exe (PID: 3116)
      • instup.exe (PID: 2488)
      • avast_free_antivirus_setup_online.exe (PID: 3768)
      • AvastSvc.exe (PID: 3856)

    • Starts itself from another location

      • instup.exe (PID: 3116)
      • CCUpdate.exe (PID: 2284)

    • Adds / modifies Windows certificates

      • instup.exe (PID: 2488)

    • Creates a software uninstall entry

      • instup.exe (PID: 2488)
      • AvEmUpdate.exe (PID: 2376)

    • Modifies the open verb of a shell class

      • instup.exe (PID: 2488)

    • Creates COM task schedule object

      • instup.exe (PID: 2488)
      • RegSvr.exe (PID: 3800)
      • RegSvr.exe (PID: 3712)

    • Creates files in the driver directory

      • instup.exe (PID: 2488)

    • Creates or modifies windows services

      • instup.exe (PID: 2488)
      • AvastSvc.exe (PID: 3856)

    • Application launched itself

      • AvEmUpdate.exe (PID: 3716)
      • CCUpdate.exe (PID: 2756)
      • AvastUI.exe (PID: 2928)

    • Reads Environment values

      • AvastSvc.exe (PID: 3856)
      • AvastUI.exe (PID: 2928)

    • Reads the cookies of Mozilla Firefox

      • engsup.exe (PID: 3916)
      • AvastUI.exe (PID: 2928)
      • AvastSvc.exe (PID: 3856)

    • Reads the cookies of Google Chrome

      • engsup.exe (PID: 3916)
      • AvastUI.exe (PID: 2928)
      • AvastSvc.exe (PID: 3856)

    • Reads Internet Cache Settings

      • instup.exe (PID: 2488)
      • AvastUI.exe (PID: 2928)

    • Reads CPU info

      • AvastSvc.exe (PID: 3856)
      • AvastUI.exe (PID: 2928)

    • Reads the date of Windows installation

      • AvastSvc.exe (PID: 3856)

    • Uses RUNDLL32.EXE to load library

      • AvastUI.exe (PID: 2928)

    • Searches for installed software

      • AvastSvc.exe (PID: 3856)
      • rundll32.exe (PID: 3420)
      • AvastUI.exe (PID: 2928)
      • rundll32.exe (PID: 1380)

    • Loads DLL from Mozilla Firefox

      • rundll32.exe (PID: 3420)
      • rundll32.exe (PID: 1380)

    • Creates files in the user directory

      • AvastUI.exe (PID: 2928)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • instup.exe (PID: 2488)
      • instup.exe (PID: 3840)

    • Reads settings of System Certificates

      • AvastSvc.exe (PID: 3856)
      • AvastUI.exe (PID: 2928)

    • Reads Microsoft Office registry keys

      • AvastUI.exe (PID: 2928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:01:03 17:42:16+01:00
PEType: PE32
LinkerVersion: 14.15
CodeSize: 128512
InitializedDataSize: 76800
UninitializedDataSize: -
EntryPoint: 0x10d0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 2.1.1252.0
ProductVersionNumber: 2.1.1252.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: AVAST Software
Edition: 1
FileDescription: Avast Antivirus Installer
FileVersion: 2.1.1252.0
InternalName: microstub
LegalCopyright: Copyright (c) 2019 AVAST Software
OriginalFileName: microstub.exe
ProductName: Avast MicroInstaller
ProductVersion: 2.1.1252.0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 03-Jan-2019 16:42:16
Detected languages:
  • English - United States
Debug artifacts:
  • D:\BUILD\work\00\ec99741887596299\projects\avast\microstub\x86\Release\microstub.pdb
CompanyName: AVAST Software
Edition: 1
FileDescription: Avast Antivirus Installer
FileVersion: 2.1.1252.0
InternalName: microstub
LegalCopyright: Copyright (c) 2019 AVAST Software
OriginalFilename: microstub.exe
ProductName: Avast MicroInstaller
ProductVersion: 2.1.1252.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 03-Jan-2019 16:42:16
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0001F57A
0x0001F600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.57927
.rdata
0x00021000
0x00009204
0x00009400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.30132
.data
0x0002B000
0x00001574
0x00000A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.7944
.didat
0x0002D000
0x00000030
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.479587
.rsrc
0x0002E000
0x000063E8
0x00006400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.9466
.reloc
0x00035000
0x00001B88
0x00001C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.62801

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.32507
1079
UNKNOWN
English - United States
RT_MANIFEST
2
2.7408
4264
UNKNOWN
English - United States
RT_ICON
3
2.68291
1128
UNKNOWN
English - United States
RT_ICON
63
3.10916
1058
UNKNOWN
English - United States
RT_STRING
69
3.17186
274
UNKNOWN
English - United States
RT_STRING
70
1.60795
76
UNKNOWN
English - United States
RT_STRING
100
2.45849
48
UNKNOWN
English - United States
RT_GROUP_ICON
126
2.57629
148
UNKNOWN
English - United States
RT_STRING
132
2.85598
324
UNKNOWN
English - United States
RT_STRING
133
2.50805
134
UNKNOWN
English - United States
RT_STRING

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
USER32.dll
VERSION.dll (delay-loaded)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
79
Monitored processes
40
Malicious processes
24
Suspicious processes
6

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start avast_free_antivirus_setup_online.exe avast_free_antivirus_setup_online.exe instup.exe instup.exe sbr.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs setupinf.exe no specs engsup.exe no specs avemupdate.exe no specs avemupdate.exe avemupdate.exe 8ba921a8-0cf1-4086-8c28-748df44b4367.exe no specs avemupdate.exe ccupdate.exe ccupdate.exe ccupdate.exe ccupdate.exe ccupdate.exe regsvr.exe no specs regsvr.exe no specs aswrundll.exe no specs avastnm.exe no specs overseer.exe avastsvc.exe engsup.exe no specs wsc_proxy.exe no specs instup.exe no specs instup.exe keytool.exe no specs keytool.exe no specs avemupdate.exe avastui.exe aswoffertool.exe instup.exe no specs rundll32.exe no specs avastui.exe no specs rundll32.exe no specs avast_free_antivirus_setup_online.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1380"C:\Windows\system32\rundll32.exe" "C:\Program Files\AVAST Software\Avast\firefox_pass.dll",_firefox_collectSiteCredentialsInView@16C:\Windows\system32\rundll32.exe—AvastUI.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1744"C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe" /installer2C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe
instup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Emergency Update
Exit code:
0
Version:
19.2.4186.0
Modules
Images
c:\program files\avast software\avast\avemupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
1860"C:\Program Files\Java\jre1.8.0_92\bin\keytool.exe" -importcert -alias "Avastsslscannerroot" -file "C:\ProgramData\AVAST Software\Avast\wscert.der" -keystore "C:\Program Files\Java\jre1.8.0_92\lib\security\cacerts" -storepass changeit -nopromptC:\Program Files\Java\jre1.8.0_92\bin\keytool.exe—AvastSvc.exe
User:
SYSTEM
Company:
Oracle Corporation
Integrity Level:
SYSTEM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\keytool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\java\jre1.8.0_92\bin\jli.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
2120"C:\Program Files\AVAST Software\Avast\AvastNM.exe" /installC:\Program Files\AVAST Software\Avast\AvastNM.exe—instup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\avast software\avast\avastnm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2280"C:\Program Files\AVAST Software\Avast\aswRunDll.exe" "C:\Program Files\AVAST Software\Avast\ashMaiSv.dll,Install"C:\Program Files\AVAST Software\Avast\aswRunDll.exe—instup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
19.2.4186.0
Modules
Images
c:\program files\avast software\avast\aswrundll.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2284CCUpdate.exe /emupdater /applyupdate "C:\Program Files\CCleaner\Setup\1e34223a-40ba-4aa8-8d4e-f26cc38132ad\update.xml"C:\Program Files\CCleaner\Setup\1e34223a-40ba-4aa8-8d4e-f26cc38132ad\CCUpdate.exe
CCUpdate.exe
User:
admin
Company:
Piriform Ltd
Integrity Level:
HIGH
Description:
CCleaner emergency updater
Exit code:
0
Version:
18.6.553.0
Modules
Images
c:\program files\ccleaner\setup\1e34223a-40ba-4aa8-8d4e-f26cc38132ad\ccupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2300"C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe" /installer /regC:\Program Files\AVAST Software\Avast\AvEmUpdate.exe—instup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Emergency Update
Exit code:
0
Version:
19.2.4186.0
Modules
Images
c:\program files\avast software\avast\avemupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
2316"C:\Program Files\AVAST Software\Avast\SetupInf.exe" /catalog:aswVmm.cat /uninstallC:\Program Files\AVAST Software\Avast\SetupInf.exe—instup.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Antivirus Installer
Exit code:
0
Version:
19.2.4186.0
Modules
Images
c:\program files\avast software\avast\setupinf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2364"C:\Program Files\Java\jre1.8.0_92\bin\keytool.exe" -exportcert -alias "Avastsslscannerroot" -keystore "C:\Program Files\Java\jre1.8.0_92\lib\security\cacerts" -storepass changeitC:\Program Files\Java\jre1.8.0_92\bin\keytool.exe—AvastSvc.exe
User:
SYSTEM
Company:
Oracle Corporation
Integrity Level:
SYSTEM
Description:
Java(TM) Platform SE binary
Exit code:
1
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\keytool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\java\jre1.8.0_92\bin\jli.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
2376AvEmUpdate.exe /installer1 /emupdater /applydll "C:\Program Files\AVAST Software\Avast\Setup\2a9d526f-2e0f-4f31-9a1b-66e5a785a2f9.dll"C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe
AvEmUpdate.exe
User:
admin
Company:
AVAST Software
Integrity Level:
HIGH
Description:
Avast Emergency Update
Exit code:
0
Version:
19.2.4186.0
Modules
Images
c:\program files\avast software\avast\avemupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
Total events
11 118
Read events
4 136
Write events
6 971
Delete events
11

Modification events

(PID) Process:(3868) avast_free_antivirus_setup_online.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Windows\Temp\asw.83e2cebe156d9b00
(PID) Process:(3768) avast_free_antivirus_setup_online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
Operation:writeName:SfxInstProgress
Value:
0
(PID) Process:(3768) avast_free_antivirus_setup_online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
Operation:writeName:SfxInstProgress
Value:
6
(PID) Process:(3768) avast_free_antivirus_setup_online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
Operation:writeName:SfxInstProgress
Value:
13
(PID) Process:(3768) avast_free_antivirus_setup_online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
Operation:writeName:SfxInstProgress
Value:
20
(PID) Process:(3768) avast_free_antivirus_setup_online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
Operation:writeName:SfxInstProgress
Value:
26
(PID) Process:(3768) avast_free_antivirus_setup_online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
Operation:writeName:SfxInstProgress
Value:
33
(PID) Process:(3768) avast_free_antivirus_setup_online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
Operation:writeName:SfxInstProgress
Value:
40
(PID) Process:(3768) avast_free_antivirus_setup_online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
Operation:writeName:SfxInstProgress
Value:
46
(PID) Process:(3768) avast_free_antivirus_setup_online.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage
Operation:writeName:SfxInstProgress
Value:
53
Executable files
336
Suspicious files
525
Text files
277
Unknown types
46

Dropped files

PID
Process
Filename
Type
3768avast_free_antivirus_setup_online.exeSetup.log —
MD5:—
SHA256:—
3768avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.1d9340ba44724009\part-vps_windows-19020506.vpxbinary
MD5:—
SHA256:—
3768avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.1d9340ba44724009\instup_ais-93c.vpx —
MD5:—
SHA256:—
3116instup.exeC:\Windows\Temp\asw.1d9340ba44724009\config.def.new —
MD5:—
SHA256:—
3768avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.1d9340ba44724009\prod-vps.vpxbinary
MD5:—
SHA256:—
3116instup.exeevent_manager.log —
MD5:—
SHA256:—
3768avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.1d9340ba44724009\uat.vpxbinary
MD5:—
SHA256:—
3768avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.1d9340ba44724009\part-jrog2-237.vpxbinary
MD5:—
SHA256:—
3768avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.1d9340ba44724009\part-setup_ais-1302093c.vpxbinary
MD5:—
SHA256:—
3768avast_free_antivirus_setup_online.exeC:\Windows\Temp\asw.1d9340ba44724009\HTMLayout.dllexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
168
TCP/UDP connections
145
DNS requests
166
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3868
avast_free_antivirus_setup_online.exe
POST
204
5.62.40.204:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
DE
—
—
whitelisted
3116
instup.exe
GET
200
95.101.13.51:80
http://m9761227.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
unknown
binary
526 b
whitelisted
2488
instup.exe
GET
200
95.101.13.75:80
http://g5041154.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
unknown
binary
526 b
whitelisted
2488
instup.exe
GET
200
95.101.13.43:80
http://f3355109.vps18tiny.u.avcdn.net/vps18tiny/jrog2-93.vpx
unknown
binary
984 Kb
whitelisted
3116
instup.exe
GET
200
95.101.13.51:80
http://m9761227.iavs9x.u.avast.com/iavs9x/avbugreport_ais-93c.vpx
unknown
binary
773 Kb
whitelisted
2488
instup.exe
POST
204
77.234.45.54:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
DE
—
—
whitelisted
2488
instup.exe
GET
200
95.101.13.43:80
http://f3355109.vps18tiny.u.avcdn.net/vps18tiny/prod-vps.vpx
unknown
binary
340 b
whitelisted
3768
avast_free_antivirus_setup_online.exe
POST
204
5.62.40.204:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
DE
—
—
whitelisted
3868
avast_free_antivirus_setup_online.exe
POST
204
5.62.40.204:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
DE
—
—
whitelisted
3116
instup.exe
GET
200
95.101.13.51:80
http://m9761227.iavs9x.u.avast.com/iavs9x/avdump_x86_ais-93c.vpx
unknown
binary
315 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3768
avast_free_antivirus_setup_online.exe
5.62.40.204:80
v7event.stats.avast.com
AVAST Software s.r.o.
DE
malicious
3868
avast_free_antivirus_setup_online.exe
5.62.40.204:80
v7event.stats.avast.com
AVAST Software s.r.o.
DE
malicious
3116
instup.exe
77.234.46.22:443
shepherd.ff.avast.com
AVAST Software s.r.o.
US
unknown
2488
instup.exe
8.8.8.8:53
—
Google Inc.
US
malicious
2488
instup.exe
95.101.13.43:80
f3355109.vps18tiny.u.avcdn.net
Akamai International B.V.
—
whitelisted
2488
instup.exe
95.101.13.75:80
k5854113.iavs9x.u.avast.com
Akamai International B.V.
—
whitelisted
2488
instup.exe
5.62.38.17:443
alpha-license-dealer.ff.avast.com
AVAST Software s.r.o.
NL
unknown
2488
instup.exe
77.234.46.22:443
shepherd.ff.avast.com
AVAST Software s.r.o.
US
unknown
2488
instup.exe
77.234.45.249:443
alpha-iqs.ff.avast.com
AVAST Software s.r.o.
DE
unknown
2488
instup.exe
77.234.45.54:80
v7event.stats.avast.com
AVAST Software s.r.o.
DE
unknown

DNS requests

Domain
IP
Reputation
iavs9x.u.avast.com
  • 2.16.186.50
  • 2.16.186.104
whitelisted
v7event.stats.avast.com
  • 5.62.40.204
  • 77.234.45.54
  • 5.62.53.224
  • 5.45.59.11
  • 5.62.40.203
whitelisted
www.google-analytics.com
  • 216.58.210.14
whitelisted
shepherd.ff.avast.com
  • 5.62.40.202
  • 77.234.46.22
whitelisted
k5854113.iavs9x.u.avast.com
  • 95.101.13.75
  • 95.101.13.51
whitelisted
l2350042.iavs9x.u.avast.com
  • 95.101.13.51
  • 95.101.13.75
whitelisted
p3357684.iavs9x.u.avast.com
  • 95.101.13.51
  • 95.101.13.75
whitelisted
m9761227.iavs9x.u.avast.com
  • 95.101.13.75
  • 95.101.13.51
whitelisted
s-iavs9x.avcdn.net
  • 2.17.212.166
whitelisted
s0383910.iavs9x.u.avast.com
  • 95.101.13.51
  • 95.101.13.75
whitelisted

Threats

PID
Process
Class
Message
3868
avast_free_antivirus_setup_online.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2488
instup.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
3716
AvEmUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2376
AvEmUpdate.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
2756
CCUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3840
instup.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
3840
instup.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
Process
Message
AvastSvc.exe
[2019-02-10 16:08:25.875] [error ] [av_pp_prov ] [ 3856: 3284] Exception: Request 'app.pam.GetBrowserLeakedPassword' was not processed. Routing parameters:
AvastSvc.exe
[2019-02-10 16:08:25.906] [error ] [av_pp_prov ] [ 3856: 2944] Exception: Request 'app.pam.GetBrowserLeakedPassword' was not processed. Routing parameters:
AvastSvc.exe
[2019-02-10 16:08:27.188] [info ] [nsf_urlinfo] [ 3856: 3020] Init UrlInfo
AvastSvc.exe
[2019-02-10 16:08:28.078] [error ] [av_pp_prov ] [ 3856: 2944] Exception: Request 'app.pam.GetBrowserLeakedPassword' was not processed. Routing parameters:
AvastSvc.exe
[2019-02-10 16:08:28.235] [error ] [av_pp_prov ] [ 3856: 3324] Exception: Request 'app.pam.GetBrowserLeakedPassword' was not processed. Routing parameters:
AvastSvc.exe
[2019-02-10 16:08:28.797] [error ] [av_pp_prov ] [ 3856: 3300] Exception: Request 'app.pam.GetBrowserLeakedPassword' was not processed. Routing parameters:
AvastSvc.exe
[2019-02-10 16:08:31.281] [error ] [av_pp_prov ] [ 3856: 3332] Exception: Request 'app.pam.GetBrowserLeakedPassword' was not processed. Routing parameters:
AvastSvc.exe
[2019-02-10 16:08:31.610] [error ] [ffl2 ] [ 3856: 3828] failed to load key 0 (error 2)
AvastSvc.exe
[2019-02-10 16:08:31.610] [error ] [ffl2 ] [ 3856: 3828] failed to load key 0 (error 2)
AvastSvc.exe
[2019-02-10 16:08:31.922] [error ] [av_pp_prov ] [ 3856: 3876] Exception: Request 'app.pam.GetBrowserLeakedPassword' was not processed. Routing parameters:
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://sdl.adaware.com/cdn/avast_free_antivirus_setup_online.exe