| URL: | https://notes.calicalidad.com/cz0yODM3NTMzNyZhPTI1MTMmYz0xMTI4NTMmZT0xMzUzMSZsPTYxNDg4NiZ0PWMmbHM9ODI2OTc3JmQ9JmY9MiZyZWRpcmVjdD1hSFIwY0hNNkx5OXVaWGh2Y0hKdkxuVnVjM1ZpTFhCaGNuUnVaWEp6TG1OdmJTOWxjeTlrWVhKelpTMWtaUzFpWVdwaFAyVnRZV2xzUFZzcVpXMWhhV3dxWFNacFpEMVdXRW8xUmxNd0pUSkdjbFF4ZDJKc1/YxQlhiVWhtYldKVWJFbExVa05WSlRKQ1pWUnZjMmxHYmpVM1ZqWjRhbGsyVEZoMVJHZDZRMmhyWjNGWmVqaHdSMVZEUkZWTVRWaEpabUY2VEVOa1ZWQjVRMlV4Ympsd09XMXdaR1ZIUmxNMllWUXlhMWsyYUdZelJrdElSWGxpVXlVeVJqQm9TQ1V5UWtGalNHdFpPRGx4Y0RJJTNEJmVtYWlsPVpHWnRZWEowYVVCdFlYQm1jbVV1WTI5dCZp/ZF9zZWdtZW50PU1BPT0mZG9tYWluPWJXRndabkpsJmJzX3RyYWNraW5nPU1URXlPRFV6WHpJMU1UTT0maWRfY2FtcGFpZ249TVRFeU9EVXombWQ1PVlUQmpOalJrWldRMk9UazVNR0ZrTm1NNU9XWmhOMll4T0RReU5EVmxZMlk9 |
| Full analysis: | https://app.any.run/tasks/b85c179e-93a6-4423-88a5-abde3eec3774 |
| Verdict: | Malicious activity |
| Analysis date: | October 08, 2023, 22:11:58 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| SHA1: | 1A7052E5DC2101ED4FFDBDC592A3A182B6A03753 |
| SHA256: | 0BECD4D5C491B07E46CAC105D92F7A328800CAADBBB9B51E4F98B8BA295764B2 |
| SSDEEP: | 12:22gWnJknYyQxdUsO2oP6Di7qfVyE5qXVdN637ZBqv64WQngP9es5RGvo:20s5QssO2x6qfVtq/oqGRYo |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1120 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3032 --field-trial-handle=1140,i,6938095780859753885,15050628722495532803,131072 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1144 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 --field-trial-handle=1140,i,6938095780859753885,15050628722495532803,131072 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 2276 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3512 --field-trial-handle=1140,i,6938095780859753885,15050628722495532803,131072 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 2412 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://notes.calicalidad.com/cz0yODM3NTMzNyZhPTI1MTMmYz0xMTI4NTMmZT0xMzUzMSZsPTYxNDg4NiZ0PWMmbHM9ODI2OTc3JmQ9JmY9MiZyZWRpcmVjdD1hSFIwY0hNNkx5OXVaWGh2Y0hKdkxuVnVjM1ZpTFhCaGNuUnVaWEp6TG1OdmJTOWxjeTlrWVhKelpTMWtaUzFpWVdwaFAyVnRZV2xzUFZzcVpXMWhhV3dxWFNacFpEMVdXRW8xUmxNd0pUSkdjbFF4ZDJKc1/YxQlhiVWhtYldKVWJFbExVa05WSlRKQ1pWUnZjMmxHYmpVM1ZqWjRhbGsyVEZoMVJHZDZRMmhyWjNGWmVqaHdSMVZEUkZWTVRWaEpabUY2VEVOa1ZWQjVRMlV4Ympsd09XMXdaR1ZIUmxNMllWUXlhMWsyYUdZelJrdElSWGxpVXlVeVJqQm9TQ1V5UWtGalNHdFpPRGx4Y0RJJTNEJmVtYWlsPVpHWnRZWEowYVVCdFlYQm1jbVV1WTI5dCZp/ZF9zZWdtZW50PU1BPT0mZG9tYWluPWJXRndabkpsJmJzX3RyYWNraW5nPU1URXlPRFV6WHpJMU1UTT0maWRfY2FtcGFpZ249TVRFeU9EVXombWQ1PVlUQmpOalJrWldRMk9UazVNR0ZrTm1NNU9XWmhOMll4T0RReU5EVmxZMlk9" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 2444 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=516 --field-trial-handle=1140,i,6938095780859753885,15050628722495532803,131072 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 2456 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3008 --field-trial-handle=1140,i,6938095780859753885,15050628722495532803,131072 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 2640 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=1912 --field-trial-handle=1140,i,6938095780859753885,15050628722495532803,131072 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 2672 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2024 --field-trial-handle=1140,i,6938095780859753885,15050628722495532803,131072 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 2796 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1468 --field-trial-handle=1140,i,6938095780859753885,15050628722495532803,131072 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 2948 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1348 --field-trial-handle=1140,i,6938095780859753885,15050628722495532803,131072 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| (PID) Process: | (2412) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (2412) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (2412) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (2412) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (2412) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (2412) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 1 | |||
| (PID) Process: | (2412) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (2412) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (2412) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid_installdate |
Value: 0 | |||
| (PID) Process: | (2412) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid_enableddate |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2412 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF151278.TMP | — | |
MD5:— | SHA256:— | |||
| 2412 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2412 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old~RF1514d9.TMP | text | |
MD5:561161B0FF5BCA89BF47F8AC972A7499 | SHA256:ECCA5CCFA0BEED7581B39FCE03D0FD3B694DF0F92BFFF780F702118AD51FC17D | |||
| 2412 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old~RF15149b.TMP | text | |
MD5:0917C6BFC618ACD47C1F53C7E7FFFF9C | SHA256:A5CAF56982DA7AE34B201E8609610786B4730371EF0812B7D418A2F9B73547BC | |||
| 2412 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF151278.TMP | text | |
MD5:D5C9ECBD2DCA29D89266782824D7AF99 | SHA256:D22D1243ACC064A30823180D0E583C853E9395367C78C2AD9DE59A463904F702 | |||
| 2412 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Version | text | |
MD5:9F941EA08DBDCA2EB3CFA1DBBBA6F5DC | SHA256:127F71DF0D2AD895D4F293E62284D85971AE047CA15F90B87BF6335898B0B655 | |||
| 2412 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF151844.TMP | — | |
MD5:— | SHA256:— | |||
| 2412 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2412 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old | text | |
MD5:513218482935B0D388C0A990D868387A | SHA256:8E39CBAAF4AACC3A01AFA74EA8C30FB24FE69A22B8B30728AFB1614FD68809D9 | |||
| 2412 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store\LOG.old~RF152b11.TMP | — | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
864 | svchost.exe | HEAD | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adasgb6qzo3kp62542i5hyaakdua_30.2/imefjhfbkmcmebodilednhmaccmincoa_30.2_win_kwiu22sehztwd3bii7gzgq4vri.crx3 | unknown | — | — | unknown |
3432 | chrome.exe | GET | 302 | 52.210.174.128:80 | http://info.rioyetarre.com/aff_c?offer_id=1936&aff_id=1353&source=5985&aff_sub5=68441&file_id=15576&url_id=16219 | unknown | html | 319 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2656 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3432 | chrome.exe | 142.250.184.237:443 | accounts.google.com | GOOGLE | US | unknown |
2412 | chrome.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3432 | chrome.exe | 62.210.31.251:443 | notes.calicalidad.com | Online S.a.s. | FR | unknown |
3432 | chrome.exe | 34.247.185.125:443 | nexopro.unsub-partners.com | AMAZON-02 | IE | unknown |
3432 | chrome.exe | 216.58.206.42:443 | content-autofill.googleapis.com | GOOGLE | US | whitelisted |
3432 | chrome.exe | 142.250.185.68:443 | www.google.com | GOOGLE | US | whitelisted |
2412 | chrome.exe | 224.0.0.251:5353 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3432 | chrome.exe | 142.250.185.170:443 | content-autofill.googleapis.com | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
accounts.google.com |
| shared |
notes.calicalidad.com |
| unknown |
nexopro.unsub-partners.com |
| unknown |
content-autofill.googleapis.com |
| whitelisted |
www.google.com |
| whitelisted |
optimizationguide-pa.googleapis.com |
| whitelisted |
www.googleapis.com |
| whitelisted |
eur03.safelinks.protection.outlook.com |
| whitelisted |
info.rioyetarre.com |
| unknown |
www.dyson.co.uk |
| unknown |
PID | Process | Class | Message |
|---|---|---|---|
3432 | chrome.exe | Potential Corporate Privacy Violation | AV POLICY Observed TikTok Domain in TLS SNI (tiktok.com) |