| URL: | https://www.browserling.com/browse/win10/tor14.5/https://guh.alwaysdata.net/collab-vm/ |
| Full analysis: | https://app.any.run/tasks/9074be6e-5ca9-4e87-9c4a-1e18741de600 |
| Verdict: | Malicious activity |
| Analysis date: | May 16, 2025, 21:43:08 |
| OS: | Ubuntu 22.04.2 |
| Indicators: | |
| MD5: | 3C88B0C8CEC79754D17C9F04759E9249 |
| SHA1: | 62CD51B32470D3B93A68C3456EAEC14BD14CF6E2 |
| SHA256: | 0A46E6C51232E157D4ED8E343988832EBB0CEAFDC8D608D71545D288218826D3 |
| SSDEEP: | 3:N8DSL3KcI7K3IDMRX3W0ZisTHKJJEoj:2OLIvDMRX3W0BHSJEK |
MALICIOUS
No malicious indicators.SUSPICIOUS
Check the Environment Variables Related to System Identification (os-release)
- snap-store (PID: 40173)
- snapctl (PID: 40218)
- snapctl (PID: 40225)
Executes commands using command-line interpreter
- chrome (PID: 39861)
- sudo (PID: 39858)
- gio (PID: 40172)
Executes the "rm" command to delete files or directories
- snap-store (PID: 40173)
Checks DMI information (probably VM detection)
- udevadm (PID: 1739)
INFO
Checks timezone
- chrome (PID: 39861)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
385
Monitored processes
256
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | /sbin/init splash | /usr/lib/systemd/systemd | — | — | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 211 | /lib/systemd/systemd-journald | /usr/lib/systemd/systemd-journald | — | systemd | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 269 | /lib/systemd/systemd-udevd | /usr/bin/udevadm | — | systemd | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 379 | /lib/systemd/systemd-fsckd | /usr/lib/systemd/systemd-fsckd | — | systemd | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 432 | /lib/systemd/systemd-oomd | /usr/lib/systemd/systemd-oomd | — | systemd | |||||||||||
User: systemd-oom Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 438 | /lib/systemd/systemd-resolved | /usr/lib/systemd/systemd-resolved | — | systemd | |||||||||||
User: systemd-resolve Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 479 | /usr/libexec/accounts-daemon | /usr/libexec/accounts-daemon | — | systemd | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 480 | /usr/sbin/acpid | /usr/sbin/acpid | — | systemd | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 482 | "avahi-daemon: running [ubuntu22\.local]" | /usr/sbin/avahi-daemon | systemd | ||||||||||||
User: avahi Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
| 483 | /usr/sbin/cron -f -P | /usr/sbin/cron | — | systemd | |||||||||||
User: root Integrity Level: UNKNOWN Exit code: 0 Modules
| |||||||||||||||
Executable files
9
Suspicious files
266
Text files
17
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 39861 | chrome | /home/user/.config/google-chrome/ShaderCache/data_3 | binary | |
MD5:— | SHA256:— | |||
| 39861 | chrome | /home/user/.config/google-chrome/ShaderCache/data_2 | binary | |
MD5:— | SHA256:— | |||
| 39861 | chrome | /home/user/.config/google-chrome/ShaderCache/data_0 | binary | |
MD5:— | SHA256:— | |||
| 39861 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_3 | binary | |
MD5:— | SHA256:— | |||
| 39861 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_2 | binary | |
MD5:— | SHA256:— | |||
| 39861 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_0 | binary | |
MD5:— | SHA256:— | |||
| 39905 | chrome | /home/user/.cache/mesa_shader_cache/index | binary | |
MD5:— | SHA256:— | |||
| 40006 | chrome | /home/user/.cache/mesa_shader_cache/index | binary | |
MD5:— | SHA256:— | |||
| 39861 | chrome | /home/user/.config/google-chrome/Default/History | binary | |
MD5:— | SHA256:— | |||
| 39861 | chrome | /home/user/.config/google-chrome/Default/DawnWebGPUCache/data_3 | binary | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
77
DNS requests
68
Threats
84
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 185.125.190.48:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | whitelisted |
39907 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aclxnidwwkj5di3vduduj2gqpgpq_4.10.2891.0/oimompecagnajdejgnnjijobebaeigek_4.10.2891.0_linux_b4hin3q5s66ws2322cyyfp35lu.crx3 | unknown | — | — | whitelisted |
39907 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aevtvjsxpcrwhjvp5w32fej6zq_9.56.0/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.56.0_all_acq3rupi4ymeq53so4pzqroatfea.crx3 | unknown | — | — | whitelisted |
39907 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/h26xvwhuftpziwnfucve6pheoe_3069/jflookgnkcckhobaglndicnbbgbonegd_3069_all_jd5jon3opnt3ka3niwggalpawu.crx3 | unknown | — | — | whitelisted |
39907 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/n5ouyrgsfmdvdv4r3gayov6oqe_2025.5.14.1143/ggkkehgbnfjpeggfpleeakpidbkibbmn_2025.5.14.1143_all_acngthuaib5pb6qba3burvg5zhla.crx3 | unknown | — | — | whitelisted |
39907 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adwdqefnrh6jcp5ptk2i66n6jgmq_509/lmelglejhemejginpboagddgdfbepgmp_509_all_ZZ_acp4huqh7tmiljgxwbhvehnsy56a.crx3 | unknown | — | — | whitelisted |
39907 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/lnu3li27zsanbe2hcsfjuvm5fq_1.0.7.1744928549/laoigpblnllgcgjnjnllmfolckpjlhki_1.0.7.1744928549_all_ady56p6vtubsna6mhkx6lu2qml3a.crx3 | unknown | — | — | whitelisted |
39907 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acduabwvto2ryjkf3l66uk27zaxa_20250427.755145031.14/obedbbhbpmojnkanicioggnmelmoomoc_20250427.755145031.14_all_ENGB500000_acw2lwbx6cqtps7a7s4zuvcd56ca.crx3 | unknown | — | — | whitelisted |
39907 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ktyagi2aeozubwzo2hlk3u6dni_1313/efniojlnjndmcbiieegkicadnoecjjef_1313_all_p4rv2wtycprx24knn2sn7g2ag4.crx3 | unknown | — | — | whitelisted |
39907 | chrome | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/jiygesn2ebu7tw7ndkwxlz53qu_9788/hfnkpimlhhgieaddgfemjhofmfblmnib_9788_all_ac7v2jex2bb7fnbyxejb4xjynxjq.crx3 | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
484 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 185.125.190.96:80 | optimizationguide-pa.googleapis.com | Canonical Group Limited | GB | whitelisted |
— | — | 185.125.190.18:80 | optimizationguide-pa.googleapis.com | Canonical Group Limited | GB | whitelisted |
— | — | 37.19.194.80:443 | odrs.gnome.org | Datacamp Limited | DE | whitelisted |
— | — | 185.125.190.48:80 | optimizationguide-pa.googleapis.com | Canonical Group Limited | GB | whitelisted |
512 | snapd | 185.125.188.54:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
512 | snapd | 185.125.188.57:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
39907 | chrome | 216.58.212.138:443 | safebrowsingohttpgateway.googleapis.com | GOOGLE | US | whitelisted |
39907 | chrome | 142.250.186.163:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
39907 | chrome | 52.6.10.88:443 | www.browserling.com | AMAZON-AES | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
odrs.gnome.org |
| whitelisted |
api.snapcraft.io |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
safebrowsingohttpgateway.googleapis.com |
| whitelisted |
www.browserling.com |
| whitelisted |
accounts.google.com |
| whitelisted |
content-autofill.googleapis.com |
| whitelisted |
queue2.browserling.com |
| whitelisted |
encoder-148-113-211-154.browserling.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
39907 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
39907 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
39907 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
39907 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
39907 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
39907 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
39907 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
39907 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
39907 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
39907 | chrome | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |