URL:

https://www.apponic.com/

Full analysis: https://app.any.run/tasks/091e9a6f-86f4-4f51-ac6c-c8dbc4a4cb13
Verdict: Malicious activity
Analysis date: April 03, 2024, 18:07:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

C1046B23ECCE54841230A505E041D014

SHA1:

011162140533F8B80AFCA0C8887D50E2533B93D6

SHA256:

0D680113D0DB121810A3EEB87DE29898620F976A20B43A7B5732F7079EFB2FA7

SSDEEP:

3:N8DSLEZGZ3:2OLE4Z3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • PixelSee_id4078696id.exe (PID: 392)
      • DriverUpdater.exe (PID: 3888)
      • CustomDllSurrogate.x32.exe (PID: 4892)
      • DriverUpdater.exe (PID: 4664)
      • setup_filerecovery.tmp (PID: 6100)

    • Drops the executable file immediately after the start

      • Windows-outbyte-driver-updater.exe (PID: 3684)
      • lum_inst.exe (PID: 2088)
      • PixelSee_id4078696id.exe (PID: 392)
      • luminati-m-controller.exe (PID: 2100)
      • lum_inst.tmp (PID: 3596)
      • net_updater32.exe (PID: 3452)
      • Installer.exe (PID: 1848)
      • luminati-m-controller.exe (PID: 5392)
      • DriverUpdater.exe (PID: 4664)
      • setup_filerecovery.tmp (PID: 6100)
      • setup_filerecovery.exe (PID: 6092)

    • Creates a writable file in the system directory

      • net_updater32.exe (PID: 3452)

    • Changes the autorun value in the registry

      • pixelsee.exe (PID: 3768)

    • Steals credentials from Web Browsers

      • DriverUpdater.exe (PID: 3888)
      • setup_filerecovery.tmp (PID: 6100)
      • taskhost.exe (PID: 3920)

    • Registers / Runs the DLL via REGSVR32.EXE

      • DriverUpdater.exe (PID: 4664)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • PixelSee_id4078696id.exe (PID: 392)
      • Installer.exe (PID: 1848)
      • lum_inst.tmp (PID: 3596)
      • luminati-m-controller.exe (PID: 2100)
      • DriverUpdater.exe (PID: 3888)
      • DriverUpdater.exe (PID: 4664)
      • CustomDllSurrogate.x32.exe (PID: 4892)
      • setup_filerecovery.tmp (PID: 6100)

    • Reads Microsoft Outlook installation path

      • PixelSee_id4078696id.exe (PID: 392)

    • Reads the Internet Settings

      • PixelSee_id4078696id.exe (PID: 392)
      • Windows-outbyte-driver-updater.exe (PID: 3684)
      • Installer.exe (PID: 1848)
      • lum_inst.tmp (PID: 3596)
      • luminati-m-controller.exe (PID: 2100)
      • pixelsee.exe (PID: 3768)
      • DriverUpdater.exe (PID: 4664)
      • CustomDllSurrogate.x32.exe (PID: 4892)
      • luminati-m-controller.exe (PID: 5392)
      • taskhost.exe (PID: 3920)
      • setup_filerecovery.tmp (PID: 6100)

    • Reads Internet Explorer settings

      • PixelSee_id4078696id.exe (PID: 392)

    • Process drops legitimate windows executable

      • PixelSee_id4078696id.exe (PID: 392)
      • luminati-m-controller.exe (PID: 2100)

    • Reads settings of System Certificates

      • Installer.exe (PID: 1848)
      • luminati-m-controller.exe (PID: 2100)
      • net_updater32.exe (PID: 2536)
      • pixelsee.exe (PID: 3768)
      • DriverUpdater.exe (PID: 3888)
      • DriverUpdater.exe (PID: 4664)
      • CustomDllSurrogate.x32.exe (PID: 4892)

    • The process drops C-runtime libraries

      • PixelSee_id4078696id.exe (PID: 392)
      • luminati-m-controller.exe (PID: 2100)

    • Checks Windows Trust Settings

      • Installer.exe (PID: 1848)
      • net_updater32.exe (PID: 3452)
      • DriverUpdater.exe (PID: 3888)
      • DriverUpdater.exe (PID: 4664)
      • CustomDllSurrogate.x32.exe (PID: 4892)

    • Reads the Windows owner or organization settings

      • lum_inst.tmp (PID: 3596)
      • Installer.exe (PID: 1848)
      • setup_filerecovery.tmp (PID: 6100)

    • Reads the BIOS version

      • Installer.exe (PID: 1848)
      • DriverUpdater.exe (PID: 3888)
      • DriverUpdater.exe (PID: 4664)
      • setup_filerecovery.tmp (PID: 6100)

    • Creates a software uninstall entry

      • PixelSee_id4078696id.exe (PID: 392)
      • Installer.exe (PID: 1848)

    • Detected use of alternative data streams (AltDS)

      • luminati-m-controller.exe (PID: 2100)
      • net_updater32.exe (PID: 3452)
      • luminati-m-controller.exe (PID: 5392)

    • Non-standard symbols in registry

      • lum_inst.tmp (PID: 3596)
      • DriverUpdater.exe (PID: 3888)
      • setup_filerecovery.tmp (PID: 6100)

    • Adds/modifies Windows certificates

      • luminati-m-controller.exe (PID: 2100)
      • Installer.exe (PID: 1848)
      • DriverUpdater.exe (PID: 3888)
      • DriverUpdater.exe (PID: 4664)

    • Executes as Windows Service

      • net_updater32.exe (PID: 3452)
      • ServiceHelper.Agent.exe (PID: 3588)
      • VSSVC.exe (PID: 4248)
      • taskhost.exe (PID: 3920)

    • Process drops SQLite DLL files

      • Installer.exe (PID: 1848)
      • setup_filerecovery.tmp (PID: 6100)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • PixelSee_id4078696id.exe (PID: 392)

    • Searches for installed software

      • dllhost.exe (PID: 4216)
      • DriverUpdater.exe (PID: 3888)
      • DriverUpdater.exe (PID: 4664)

    • Mutex name with non-standard characters

      • DriverUpdater.exe (PID: 4664)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 4876)

  • INFO

    • Drops the executable file immediately after the start

      • chrome.exe (PID: 3500)

    • Checks proxy server information

      • PixelSee_id4078696id.exe (PID: 392)
      • Windows-outbyte-driver-updater.exe (PID: 3684)
      • Installer.exe (PID: 1848)
      • luminati-m-controller.exe (PID: 2100)
      • CustomDllSurrogate.x32.exe (PID: 4892)
      • DriverUpdater.exe (PID: 4664)
      • setup_filerecovery.tmp (PID: 6100)

    • Checks supported languages

      • PixelSee_id4078696id.exe (PID: 392)
      • wmpnscfg.exe (PID: 3656)
      • Windows-outbyte-driver-updater.exe (PID: 3684)
      • Installer.exe (PID: 1848)
      • luminati-m-controller.exe (PID: 2100)
      • lum_inst.exe (PID: 2088)
      • lum_inst.tmp (PID: 3596)
      • test_wpf.exe (PID: 2032)
      • net_updater32.exe (PID: 2536)
      • net_updater32.exe (PID: 3452)
      • test_wpf.exe (PID: 2296)
      • idle_report.exe (PID: 2784)
      • brightdata.exe (PID: 1880)
      • ServiceHelper.Agent.exe (PID: 3924)
      • ServiceHelper.Agent.exe (PID: 3588)
      • pixelsee.exe (PID: 3768)
      • pixelsee_crashpad_handler.exe (PID: 2068)
      • DriverUpdater.exe (PID: 3888)
      • DriverUpdater.exe (PID: 4664)
      • CustomDllSurrogate.x32.exe (PID: 4892)
      • idle_report.exe (PID: 5260)
      • luminati-m-controller.exe (PID: 5392)
      • test_wpf.exe (PID: 5408)
      • setup_filerecovery.exe (PID: 6092)
      • idle_report.exe (PID: 5792)
      • setup_filerecovery.tmp (PID: 6100)
      • reader.exe (PID: 6120)

    • Reads the computer name

      • PixelSee_id4078696id.exe (PID: 392)
      • wmpnscfg.exe (PID: 3656)
      • Installer.exe (PID: 1848)
      • Windows-outbyte-driver-updater.exe (PID: 3684)
      • lum_inst.tmp (PID: 3596)
      • net_updater32.exe (PID: 2536)
      • test_wpf.exe (PID: 2032)
      • luminati-m-controller.exe (PID: 2100)
      • net_updater32.exe (PID: 3452)
      • test_wpf.exe (PID: 2296)
      • idle_report.exe (PID: 2784)
      • brightdata.exe (PID: 1880)
      • pixelsee.exe (PID: 3768)
      • ServiceHelper.Agent.exe (PID: 3924)
      • ServiceHelper.Agent.exe (PID: 3588)
      • DriverUpdater.exe (PID: 3888)
      • DriverUpdater.exe (PID: 4664)
      • CustomDllSurrogate.x32.exe (PID: 4892)
      • idle_report.exe (PID: 5260)
      • luminati-m-controller.exe (PID: 5392)
      • test_wpf.exe (PID: 5408)
      • idle_report.exe (PID: 5792)
      • setup_filerecovery.tmp (PID: 6100)

    • The process uses the downloaded file

      • chrome.exe (PID: 2172)
      • chrome.exe (PID: 3500)
      • chrome.exe (PID: 1028)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3656)
      • explorer.exe (PID: 5640)

    • Reads the machine GUID from the registry

      • PixelSee_id4078696id.exe (PID: 392)
      • Installer.exe (PID: 1848)
      • test_wpf.exe (PID: 2032)
      • luminati-m-controller.exe (PID: 2100)
      • net_updater32.exe (PID: 3452)
      • test_wpf.exe (PID: 2296)
      • net_updater32.exe (PID: 2536)
      • idle_report.exe (PID: 2784)
      • brightdata.exe (PID: 1880)
      • pixelsee.exe (PID: 3768)
      • DriverUpdater.exe (PID: 3888)
      • DriverUpdater.exe (PID: 4664)
      • CustomDllSurrogate.x32.exe (PID: 4892)
      • idle_report.exe (PID: 5260)
      • luminati-m-controller.exe (PID: 5392)
      • test_wpf.exe (PID: 5408)
      • idle_report.exe (PID: 5792)
      • setup_filerecovery.tmp (PID: 6100)

    • Create files in a temporary directory

      • PixelSee_id4078696id.exe (PID: 392)
      • Windows-outbyte-driver-updater.exe (PID: 3684)
      • lum_inst.exe (PID: 2088)
      • Installer.exe (PID: 1848)
      • setup_filerecovery.tmp (PID: 6100)
      • setup_filerecovery.exe (PID: 6092)

    • Process checks computer location settings

      • Windows-outbyte-driver-updater.exe (PID: 3684)
      • Installer.exe (PID: 1848)
      • luminati-m-controller.exe (PID: 2100)
      • net_updater32.exe (PID: 3452)
      • DriverUpdater.exe (PID: 4664)
      • luminati-m-controller.exe (PID: 5392)
      • setup_filerecovery.tmp (PID: 6100)

    • Reads the software policy settings

      • Installer.exe (PID: 1848)
      • luminati-m-controller.exe (PID: 2100)
      • net_updater32.exe (PID: 3452)
      • net_updater32.exe (PID: 2536)
      • DriverUpdater.exe (PID: 3888)
      • DriverUpdater.exe (PID: 4664)
      • CustomDllSurrogate.x32.exe (PID: 4892)

    • Creates files or folders in the user directory

      • Installer.exe (PID: 1848)
      • PixelSee_id4078696id.exe (PID: 392)
      • luminati-m-controller.exe (PID: 2100)
      • pixelsee.exe (PID: 3768)
      • pixelsee_crashpad_handler.exe (PID: 2068)
      • DriverUpdater.exe (PID: 4664)
      • CustomDllSurrogate.x32.exe (PID: 4892)
      • taskhost.exe (PID: 3920)

    • Application launched itself

      • chrome.exe (PID: 3500)

    • Reads Windows Product ID

      • Installer.exe (PID: 1848)
      • DriverUpdater.exe (PID: 3888)
      • DriverUpdater.exe (PID: 4664)
      • setup_filerecovery.tmp (PID: 6100)

    • Creates files in the program directory

      • Installer.exe (PID: 1848)
      • luminati-m-controller.exe (PID: 2100)
      • net_updater32.exe (PID: 2536)
      • net_updater32.exe (PID: 3452)
      • brightdata.exe (PID: 1880)
      • DriverUpdater.exe (PID: 3888)
      • CustomDllSurrogate.x32.exe (PID: 4892)
      • DriverUpdater.exe (PID: 4664)
      • luminati-m-controller.exe (PID: 5392)
      • setup_filerecovery.tmp (PID: 6100)

    • Reads Environment values

      • luminati-m-controller.exe (PID: 2100)
      • net_updater32.exe (PID: 3452)
      • brightdata.exe (PID: 1880)
      • pixelsee.exe (PID: 3768)
      • luminati-m-controller.exe (PID: 5392)

    • Reads Microsoft Office registry keys

      • DriverUpdater.exe (PID: 4664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
172
Monitored processes
111
Malicious processes
19
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs pixelsee_id4078696id.exe no specs pixelsee_id4078696id.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs wmpnscfg.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs windows-outbyte-driver-updater.exe no specs windows-outbyte-driver-updater.exe installer.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs lum_inst.exe no specs lum_inst.tmp no specs chrome.exe no specs luminati-m-controller.exe test_wpf.exe no specs net_updater32.exe net_updater32.exe test_wpf.exe no specs idle_report.exe no specs brightdata.exe no specs chrome.exe no specs servicehelper.agent.exe no specs servicehelper.agent.exe no specs netsh.exe no specs netsh.exe no specs pixelsee.exe pixelsee_crashpad_handler.exe no specs driverupdater.exe SPPSurrogate no specs vssvc.exe no specs driverupdater.exe regsvr32.exe no specs regsvr32.exe no specs customdllsurrogate.x32.exe idle_report.exe no specs chrome.exe no specs luminati-m-controller.exe test_wpf.exe no specs explorer.exe no specs chrome.exe no specs idle_report.exe no specs chrome.exe no specs chrome.exe no specs setup_filerecovery.exe no specs setup_filerecovery.tmp reader.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs taskhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=5212 --field-trial-handle=1168,i,10976330724926442215,11423318362585401399,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
392"C:\Users\admin\Downloads\PixelSee_id4078696id.exe" C:\Users\admin\Downloads\PixelSee_id4078696id.exe
chrome.exe
User:
admin
Company:
SIA Circle Solutions
Integrity Level:
HIGH
Description:
PixelSee Player Installer
Version:
14.0.0.0
Modules
Images
c:\users\admin\downloads\pixelsee_id4078696id.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
548"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=3528 --field-trial-handle=1168,i,10976330724926442215,11423318362585401399,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
568"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --mojo-platform-channel-handle=3940 --field-trial-handle=1168,i,10976330724926442215,11423318362585401399,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
568"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --mojo-platform-channel-handle=828 --field-trial-handle=1168,i,10976330724926442215,11423318362585401399,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
668"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3724 --field-trial-handle=1168,i,10976330724926442215,11423318362585401399,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
668"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=72 --mojo-platform-channel-handle=4880 --field-trial-handle=1168,i,10976330724926442215,11423318362585401399,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
844"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3128 --field-trial-handle=1168,i,10976330724926442215,11423318362585401399,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
884"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=4696 --field-trial-handle=1168,i,10976330724926442215,11423318362585401399,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
908"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3960 --field-trial-handle=1168,i,10976330724926442215,11423318362585401399,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
126 329
Read events
124 963
Write events
1 182
Delete events
184

Modification events

(PID) Process:(3500) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3500) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3500) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3500) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3500) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3500) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3500) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3500) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3500) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(3500) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
575
Suspicious files
175
Text files
182
Unknown types
286

Dropped files

PID
Process
Filename
Type
3500chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:—
SHA256:—
3500chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Variationsbinary
MD5:—
SHA256:—
3500chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:—
SHA256:—
3500chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF182872.TMPtext
MD5:—
SHA256:—
3500chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
3500chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF182872.TMPtext
MD5:—
SHA256:—
3500chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
3500chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF182872.TMP —
MD5:—
SHA256:—
3500chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3500chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\03de5d0b-6db9-43fc-bacb-b99bf66fa746.tmpbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
45
TCP/UDP connections
425
DNS requests
540
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
856
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
—
956
chrome.exe
GET
200
192.229.221.95:80
http://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt
unknown
—
—
—
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
—
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
—
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
—
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
—
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
—
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
—
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
—
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
956
chrome.exe
142.251.166.84:443
accounts.google.com
GOOGLE
US
unknown
3500
chrome.exe
239.255.255.250:1900
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
956
chrome.exe
66.206.12.122:443
www.apponic.com
HVC-AS
US
unknown
956
chrome.exe
142.250.185.194:443
pagead2.googlesyndication.com
GOOGLE
US
unknown
956
chrome.exe
142.250.186.131:443
fonts.gstatic.com
GOOGLE
US
whitelisted
956
chrome.exe
13.225.78.65:443
cdn.apponic.com
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
accounts.google.com
  • 142.251.166.84
unknown
www.apponic.com
  • 66.206.12.122
unknown
cdn.apponic.com
  • 13.225.78.65
  • 13.225.78.104
  • 13.225.78.53
  • 13.225.78.103
unknown
img.apponic.com
  • 13.225.78.32
  • 13.225.78.77
  • 13.225.78.119
  • 13.225.78.4
unknown
pagead2.googlesyndication.com
  • 142.250.185.194
  • 172.217.16.194
unknown
fonts.gstatic.com
  • 142.250.186.131
  • 142.250.185.227
unknown
fonts.googleapis.com
  • 142.250.186.170
  • 172.217.18.10
  • 142.250.186.42
unknown
tpc.googlesyndication.com
  • 142.250.186.65
  • 142.250.186.33
unknown
www.googletagservices.com
  • 142.250.185.194
unknown
adservice.google.com
  • 216.58.206.66
  • 142.250.185.66
unknown

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code.jquery .com)
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
—
—
Potential Corporate Privacy Violation
ET POLICY Dropbox.com Offsite File Backup in Use
Process
Message
pixelsee.exe
QWindowsEGLStaticContext::create: Could not initialize EGL display: error 0x3001
pixelsee.exe
QWindowsEGLStaticContext::create: When using ANGLE, check if d3dcompiler_4x.dll is available
pixelsee.exe
> __thiscall Application::Application(int &,char *[])
pixelsee.exe
os version: "6.1.7601v" __ os name: "Windows 7 Version 6.1 (Build 7601: SP 1)"
pixelsee.exe
> int __thiscall Application::exec(void)
pixelsee.exe
> __thiscall PixelseeSettings::PixelseeSettings(void)
pixelsee.exe
INSTALL ID: "" _ OLD ID: ""
pixelsee.exe
reseller - "" installId ""
pixelsee.exe
> void __thiscall PixelseeSettings::flushSettings(void)
pixelsee.exe
main libvlc debug: VLC media player - 3.0.16 Vetinari
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.apponic.com/