URL:

http://download.huawei.com/edownload/enterprise/download!download.action?contentType=NEWS&contentId=NEWS1000000152&partNo=2001&idPath=

Full analysis: https://app.any.run/tasks/cf724a64-420e-4e90-ba55-30bd49fecc8a
Verdict: Malicious activity
Analysis date: December 05, 2018, 19:14:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

7CA8A81BACDCEB8023432F2FFF5B4C12

SHA1:

D9731EAE8690D23B843C92DF1748EC324A1E6A97

SHA256:

0A39549A65E5969194327FDA0D9F2A10BE2CDA5B284C43872E2DC1235EB01479

SSDEEP:

3:N1KaKElcD4EXuPWAaKFBK4nWlukAG3kda2uHh8ReYFVUDMp:Ca5q6W0pnWluJG3kYLYFVHp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 612)
      • HedExLite.exe (PID: 3192)
      • HedExReg.exe (PID: 3296)
      • regsvr32.exe (PID: 2480)
      • HedExLite.exe (PID: 3964)
      • HedExHS.exe (PID: 2544)
      • HedExMiniDesktop.exe (PID: 3976)
      • HedExIndexProcessor.exe (PID: 920)
      • HedExMsgManager.exe (PID: 2700)
      • HedExBee.exe (PID: 2204)
      • VfExtractText.exe (PID: 2472)
      • VfExtractText.exe (PID: 2408)
      • HedExExtractText.exe (PID: 1796)
      • VfExtractText.exe (PID: 3148)
      • VfExtractText.exe (PID: 1484)
      • VfExtractText.exe (PID: 2300)
      • HedExExtractText.exe (PID: 2344)
      • VfExtractText.exe (PID: 956)
      • VfExtractText.exe (PID: 2352)
      • VfExtractText.exe (PID: 1456)
      • VfExtractText.exe (PID: 2856)
      • VfExtractText.exe (PID: 2612)
      • HedExExtractText.exe (PID: 2756)
      • VfExtractText.exe (PID: 2096)
      • VfExtractText.exe (PID: 1440)
      • VfExtractText.exe (PID: 3532)
      • VfExtractText.exe (PID: 456)
      • HedExExtractText.exe (PID: 2264)
      • VfExtractText.exe (PID: 992)
      • VfExtractText.exe (PID: 2780)
      • VfExtractText.exe (PID: 2584)
      • HedExExtractText.exe (PID: 2520)
      • VfExtractText.exe (PID: 2088)
      • VfExtractText.exe (PID: 3128)
      • VfExtractText.exe (PID: 2724)
      • VfExtractText.exe (PID: 2300)
      • VfExtractText.exe (PID: 1440)
      • HedExExtractText.exe (PID: 3816)
      • VfExtractText.exe (PID: 2688)
      • VfExtractText.exe (PID: 2568)
      • HedExExtractText.exe (PID: 2420)
      • VfExtractText.exe (PID: 792)
      • HedExExtractText.exe (PID: 3916)
      • VfExtractText.exe (PID: 2804)
      • VfExtractText.exe (PID: 2332)
      • VfExtractText.exe (PID: 2944)
      • VfExtractText.exe (PID: 1664)
      • HedExExtractText.exe (PID: 2452)
      • VfExtractText.exe (PID: 2432)
      • VfExtractText.exe (PID: 2432)
      • VfExtractText.exe (PID: 2220)
      • HedExExtractText.exe (PID: 2796)
      • VfExtractText.exe (PID: 2820)
      • VfExtractText.exe (PID: 2420)
      • VfExtractText.exe (PID: 3340)
      • HedExExtractText.exe (PID: 1404)
      • VfExtractText.exe (PID: 2040)
      • VfExtractText.exe (PID: 456)
      • VfExtractText.exe (PID: 2760)
      • HedExExtractText.exe (PID: 408)
      • VfExtractText.exe (PID: 2376)
      • VfExtractText.exe (PID: 2516)
      • HedExExtractText.exe (PID: 2820)
      • VfExtractText.exe (PID: 1004)

    • Application was dropped or rewritten from another process

      • Startup.exe (PID: 2656)
      • HedExLite.exe (PID: 3192)
      • HedExReg.exe (PID: 2572)
      • HedExReg.exe (PID: 3296)
      • Startup.exe (PID: 3328)
      • HedExLite.exe (PID: 3964)
      • HedExIndexProcessor.exe (PID: 920)
      • HedExHS.exe (PID: 2544)
      • HedExMsgManager.exe (PID: 2700)
      • HedExMiniDesktop.exe (PID: 3976)
      • VfExtractText.exe (PID: 2472)
      • VfExtractText.exe (PID: 2408)
      • VfExtractText.exe (PID: 3148)
      • HedExExtractText.exe (PID: 1796)
      • VfExtractText.exe (PID: 2300)
      • VfExtractText.exe (PID: 1484)
      • HedExExtractText.exe (PID: 2344)
      • VfExtractText.exe (PID: 456)
      • HedExBee.exe (PID: 2204)
      • VfExtractText.exe (PID: 956)
      • VfExtractText.exe (PID: 2612)
      • VfExtractText.exe (PID: 1456)
      • VfExtractText.exe (PID: 1440)
      • VfExtractText.exe (PID: 2856)
      • HedExExtractText.exe (PID: 2756)
      • VfExtractText.exe (PID: 2096)
      • VfExtractText.exe (PID: 3532)
      • HedExExtractText.exe (PID: 2264)
      • VfExtractText.exe (PID: 2352)
      • VfExtractText.exe (PID: 2780)
      • VfExtractText.exe (PID: 2584)
      • HedExExtractText.exe (PID: 2520)
      • VfExtractText.exe (PID: 2088)
      • VfExtractText.exe (PID: 3128)
      • VfExtractText.exe (PID: 2724)
      • HedExExtractText.exe (PID: 3816)
      • VfExtractText.exe (PID: 992)
      • VfExtractText.exe (PID: 2688)
      • VfExtractText.exe (PID: 2300)
      • VfExtractText.exe (PID: 1440)
      • HedExExtractText.exe (PID: 3916)
      • VfExtractText.exe (PID: 2804)
      • HedExExtractText.exe (PID: 2420)
      • VfExtractText.exe (PID: 456)
      • VfExtractText.exe (PID: 792)
      • VfExtractText.exe (PID: 2568)
      • VfExtractText.exe (PID: 2332)
      • VfExtractText.exe (PID: 2944)
      • VfExtractText.exe (PID: 1664)
      • HedExExtractText.exe (PID: 2452)
      • VfExtractText.exe (PID: 2220)
      • HedExExtractText.exe (PID: 2796)
      • VfExtractText.exe (PID: 2820)
      • VfExtractText.exe (PID: 2420)
      • VfExtractText.exe (PID: 2040)
      • VfExtractText.exe (PID: 2432)
      • HedExExtractText.exe (PID: 1404)
      • VfExtractText.exe (PID: 3340)
      • VfExtractText.exe (PID: 2432)
      • VfExtractText.exe (PID: 2376)
      • VfExtractText.exe (PID: 1004)
      • VfExtractText.exe (PID: 2516)
      • HedExExtractText.exe (PID: 2820)
      • VfExtractText.exe (PID: 1004)
      • VfExtractText.exe (PID: 2760)
      • HedExExtractText.exe (PID: 408)

    • Registers / Runs the DLL via REGSVR32.EXE

      • HedExReg.exe (PID: 3296)

    • Changes the autorun value in the registry

      • HedExLite.exe (PID: 3192)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 772)
      • HedExLite.exe (PID: 3192)
      • HedExReg.exe (PID: 3296)

    • Creates files in the user directory

      • HedExLite.exe (PID: 3192)
      • HedExReg.exe (PID: 3296)
      • HedExBee.exe (PID: 2204)

    • Modifies the open verb of a shell class

      • HedExReg.exe (PID: 3296)

    • Starts Internet Explorer

      • HedExLite.exe (PID: 3192)
      • HedExMiniDesktop.exe (PID: 3976)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 2976)
      • iexplore.exe (PID: 3848)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 2976)
      • iexplore.exe (PID: 3728)
      • iexplore.exe (PID: 3704)

    • Dropped object may contain Bitcoin addresses

      • HedExHS.exe (PID: 2544)
      • HedExIndexProcessor.exe (PID: 920)

    • Changes internet zones settings

      • iexplore.exe (PID: 3848)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3728)
      • iexplore.exe (PID: 3704)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
119
Monitored processes
81
Malicious processes
61
Suspicious processes
4

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe searchprotocolhost.exe no specs startup.exe no specs hedexlite.exe hedexreg.exe no specs hedexreg.exe regsvr32.exe no specs startup.exe no specs hedexlite.exe no specs hedexhs.exe hedexindexprocessor.exe no specs iexplore.exe iexplore.exe hedexminidesktop.exe hedexmsgmanager.exe no specs hedexbee.exe vfextracttext.exe no specs vfextracttext.exe no specs hedexextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs hedexextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs hedexextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs hedexextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs hedexextracttext.exe no specs vfextracttext.exe no specs iexplore.exe no specs iexplore.exe vfextracttext.exe no specs vfextracttext.exe no specs hedexextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs hedexextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs hedexextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs hedexextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs hedexextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs hedexextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs hedexextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs vfextracttext.exe no specs hedexextracttext.exe no specs vfextracttext.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
408"C:\Users\admin\Desktop\HedEx Lite\BIN\HedExExtractText.exe" "C:\Users\admin\Desktop\HedEx Lite\bin\hedexbeeskin\finished_menu.html" "C:/Users/admin/Desktop/HedEx Lite/BIN/vfresource/1544037413/index/ETText.txt" "C:/Users/admin/Desktop/HedEx Lite/BIN/vfresource/1544037413/index/ETAttri.txt" "C:/Users/admin/Desktop/HedEx Lite/BIN/log/system.log" BCC9CCA4-AA6B-4EA7-8AAC-4933BB98046AC:\Users\admin\Desktop\HedEx Lite\BIN\HedExExtractText.exe—VfExtractText.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\hedex lite\bin\hedexextracttext.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\query.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
456"C:\Users\admin\Desktop\HedEx Lite\BIN\VfExtractText.exe" "false;false;0fda45dc3f4dfbf1d5c1217f47f22cd0.txt;false;C:\Users\admin\Desktop\HedEx Lite\;1544037413;C:/Users/admin/Desktop/HedEx Lite/BIN/;C:/Users/admin/Desktop/HedEx Lite/bin/appearance/kse.txt;C:/Users/admin/Desktop/HedEx Lite/;C:/Users/admin/Desktop/HedEx Lite/BIN/vfresource/1544037413/index;null" "AddIndex"C:\Users\admin\Desktop\HedEx Lite\BIN\VfExtractText.exe—HedExHS.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\hedex lite\bin\vfextracttext.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\hedex lite\bin\search-core.dll
c:\users\admin\desktop\hedex lite\bin\msvcp100.dll
c:\users\admin\desktop\hedex lite\bin\msvcr100.dll
c:\users\admin\desktop\hedex lite\bin\search-shared.dll
c:\users\admin\desktop\hedex lite\bin\search-paoding.dll
c:\users\admin\desktop\hedex lite\bin\hedexutils.dll
456"C:\Users\admin\Desktop\HedEx Lite\BIN\VfExtractText.exe" "false;false;2df8ece2b1f29fafaa1fafeb2141d05a.html;false;C:\Users\admin\Desktop\HedEx Lite\;1544037413;C:/Users/admin/Desktop/HedEx Lite/BIN/;C:/Users/admin/Desktop/HedEx Lite/bin/hedexbeeskin/delhdxtasktip.html;C:/Users/admin/Desktop/HedEx Lite/;C:/Users/admin/Desktop/HedEx Lite/BIN/vfresource/1544037413/index;null" "AddIndex"C:\Users\admin\Desktop\HedEx Lite\BIN\VfExtractText.exe—HedExHS.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\users\admin\desktop\hedex lite\bin\search-paoding.dll
c:\users\admin\desktop\hedex lite\bin\msvcr100.dll
c:\users\admin\desktop\hedex lite\bin\search-core.dll
c:\windows\system32\kernel32.dll
c:\users\admin\desktop\hedex lite\bin\vfextracttext.exe
c:\systemroot\system32\ntdll.dll
612"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
772"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\HedEx_Lite_V200R006C00SPC007_English_forEnterprise.zip"C:\Program Files\WinRAR\WinRAR.exe
chrome.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
792"C:\Users\admin\Desktop\HedEx Lite\BIN\VfExtractText.exe" "C:/Users/admin/Desktop/HedEx Lite/bin/hedexbeeskin/commonctrl.html;C:/Users/admin/Desktop/HedEx Lite/BIN/vfresource/1544037413/index;C:/Users/admin/Desktop/HedEx Lite/BIN/" "QueryIndex"C:\Users\admin\Desktop\HedEx Lite\BIN\VfExtractText.exe—HedExHS.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\hedex lite\bin\vfextracttext.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\hedex lite\bin\search-core.dll
c:\users\admin\desktop\hedex lite\bin\msvcp100.dll
c:\users\admin\desktop\hedex lite\bin\msvcr100.dll
c:\users\admin\desktop\hedex lite\bin\search-shared.dll
c:\users\admin\desktop\hedex lite\bin\search-paoding.dll
c:\users\admin\desktop\hedex lite\bin\hedexutils.dll
920"C:\Users\admin\Desktop\HedEx Lite\BIN\HedExIndexProcessor.exe" "createnewnavi" "C:\Users\admin\Desktop\HedEx Lite\BIN\resources\1000002\01\index_temp" "C:\Users\admin\Desktop\HedEx Lite\BIN\resources\1000002\01\navi.xml"C:\Users\admin\Desktop\HedEx Lite\BIN\HedExIndexProcessor.exe—HedExHS.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2005
Modules
Images
c:\users\admin\desktop\hedex lite\bin\hedexindexprocessor.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\hedex lite\bin\expat.dll
c:\users\admin\desktop\hedex lite\bin\msvcr100.dll
c:\users\admin\desktop\hedex lite\bin\search-core.dll
c:\users\admin\desktop\hedex lite\bin\msvcp100.dll
c:\users\admin\desktop\hedex lite\bin\search-shared.dll
c:\users\admin\desktop\hedex lite\bin\search-paoding.dll
956"C:\Users\admin\Desktop\HedEx Lite\BIN\VfExtractText.exe" "C:/Users/admin/Desktop/HedEx Lite/bin/appearance/SpellCheckIndex.zip;C:/Users/admin/Desktop/HedEx Lite/BIN/vfresource/1544037413/index;C:/Users/admin/Desktop/HedEx Lite/BIN/" "QueryIndex"C:\Users\admin\Desktop\HedEx Lite\BIN\VfExtractText.exe—HedExHS.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\hedex lite\bin\vfextracttext.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\hedex lite\bin\search-core.dll
c:\users\admin\desktop\hedex lite\bin\msvcp100.dll
c:\users\admin\desktop\hedex lite\bin\msvcr100.dll
c:\users\admin\desktop\hedex lite\bin\search-shared.dll
c:\users\admin\desktop\hedex lite\bin\search-paoding.dll
c:\users\admin\desktop\hedex lite\bin\hedexutils.dll
992"C:\Users\admin\Desktop\HedEx Lite\BIN\VfExtractText.exe" "false;false;925feff05ae1b2bef3e6ae53fc8b75f6.html;false;C:\Users\admin\Desktop\HedEx Lite\;1544037413;C:/Users/admin/Desktop/HedEx Lite/BIN/;C:/Users/admin/Desktop/HedEx Lite/bin/hedexbeeskin/AddTask.html;C:/Users/admin/Desktop/HedEx Lite/;C:/Users/admin/Desktop/HedEx Lite/BIN/vfresource/1544037413/index;null" "AddIndex"C:\Users\admin\Desktop\HedEx Lite\BIN\VfExtractText.exe—HedExHS.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\hedex lite\bin\vfextracttext.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\hedex lite\bin\search-core.dll
c:\users\admin\desktop\hedex lite\bin\msvcp100.dll
c:\users\admin\desktop\hedex lite\bin\msvcr100.dll
c:\users\admin\desktop\hedex lite\bin\search-shared.dll
c:\users\admin\desktop\hedex lite\bin\search-paoding.dll
c:\users\admin\desktop\hedex lite\bin\hedexutils.dll
1004"C:\Users\admin\Desktop\HedEx Lite\BIN\VfExtractText.exe" "C:/Users/admin/Desktop/HedEx Lite/bin/hedexbeeskin/main.html;C:/Users/admin/Desktop/HedEx Lite/BIN/vfresource/1544037413/index;C:/Users/admin/Desktop/HedEx Lite/BIN/" "QueryIndex"C:\Users\admin\Desktop\HedEx Lite\BIN\VfExtractText.exe—HedExHS.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\hedex lite\bin\vfextracttext.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\hedex lite\bin\search-core.dll
c:\users\admin\desktop\hedex lite\bin\msvcp100.dll
c:\users\admin\desktop\hedex lite\bin\msvcr100.dll
c:\users\admin\desktop\hedex lite\bin\search-shared.dll
c:\users\admin\desktop\hedex lite\bin\search-paoding.dll
c:\users\admin\desktop\hedex lite\bin\hedexutils.dll
Total events
2 517
Read events
2 278
Write events
234
Delete events
5

Modification events

(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2924) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:2976-13188510891354875
Value:
259
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3516-13180984670829101
Value:
0
(PID) Process:(2976) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:2976-13188510891354875
Value:
259
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
39
Suspicious files
55
Text files
1 260
Unknown types
57

Dropped files

PID
Process
Filename
Type
2976chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\83f5afba-a556-4815-9882-34b2f247f92e.tmp —
MD5:—
SHA256:—
2976chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp —
MD5:—
SHA256:—
2976chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp —
MD5:—
SHA256:—
2976chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\2d4a9104-d308-4750-9be7-666d59d3b0dc.tmp —
MD5:—
SHA256:—
2976chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.oldtext
MD5:—
SHA256:—
2976chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Thumbnails\LOG.old~RF246d03.TMPtext
MD5:—
SHA256:—
2976chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Translate Ranker Modelbinary
MD5:—
SHA256:—
2976chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Translate Ranker Model~RF246f06.TMPbinary
MD5:—
SHA256:—
2976chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:—
SHA256:—
2976chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Thumbnails\LOG.oldtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
12
DNS requests
9
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3192
HedExLite.exe
GET
200
23.0.40.144:80
http://support.huawei.com/da/da/hedex/online?at=1
NL
—
—
malicious
2976
chrome.exe
GET
200
23.37.61.100:80
http://download.huawei.com/edownload/enterprise/download!download.action?contentType=NEWS&contentId=NEWS1000000152&partNo=2001&idPath=
NL
compressed
15.0 Mb
whitelisted
3192
HedExLite.exe
GET
200
23.37.61.100:80
http://download.huawei.com/dl/download.do?actionFlag=download&nid=HDX1000000052&partNo=3001&mid=SUP_HDXLITE
NL
xml
231 b
whitelisted
3848
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3848
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3848
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2976
chrome.exe
172.217.21.227:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2976
chrome.exe
23.37.61.100:80
download.huawei.com
Akamai Technologies, Inc.
NL
whitelisted
2976
chrome.exe
172.217.21.237:443
accounts.google.com
Google Inc.
US
whitelisted
2976
chrome.exe
172.217.21.238:443
sb-ssl.google.com
Google Inc.
US
whitelisted
3192
HedExLite.exe
23.0.40.144:80
support.huawei.com
Akamai Technologies, Inc.
NL
whitelisted
3192
HedExLite.exe
23.37.61.100:80
download.huawei.com
Akamai Technologies, Inc.
NL
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 172.217.21.227
whitelisted
download.huawei.com
  • 23.37.61.100
whitelisted
www.gstatic.com
  • 172.217.21.227
whitelisted
accounts.google.com
  • 172.217.21.237
shared
sb-ssl.google.com
  • 172.217.21.238
whitelisted
ssl.gstatic.com
  • 172.217.21.227
whitelisted
support.huawei.com
  • 23.0.40.144
malicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

PID
Process
Class
Message
2976
chrome.exe
Web Application Attack
SC WEB_APPLICATION_ATTACK Suspicious Generic - Path Traversal for Windows in Zip archive
2976
chrome.exe
Web Application Attack
SC WEB_APPLICATION_ATTACK Suspicious Generic - Path Traversal for Unix in Zip archive
2976
chrome.exe
Generic Protocol Command Decode
SURICATA Applayer Wrong direction first Data
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://download.huawei.com/edownload/enterprise/download!download.action?contentType=NEWS&contentId=NEWS1000000152&partNo=2001&idPath=