URL:

https://download-subway-surfers.ru/game/minecraft/skachat-minecraft-na-kompyuter.html

Full analysis: https://app.any.run/tasks/28caa85b-e3d3-479d-b68a-639b7e1d09e3
Verdict: Malicious activity
Analysis date: May 08, 2020, 11:19:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

42092467F0531F3F2836852225122052

SHA1:

01A6B8FE2D683DA0F100FC05578D13AD6EAA63ED

SHA256:

239181016E010568B4F0293693DFD56B5958E5789167C4AF19D853A0B3BFBE03

SSDEEP:

3:N8SEmWQH7jqHsKvN8GUhISV0IJ:2SYQHyMKvNkeSVP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • minecraft_1-15-1.exe (PID: 3072)
      • minecraft_1-15-1.exe (PID: 3884)
      • javaw.exe (PID: 1792)
      • javaw.exe (PID: 3276)

    • Loads dropped or rewritten executable

      • minecraft_1-15-1.exe (PID: 3884)
      • javaw.exe (PID: 1792)
      • javaw.exe (PID: 3276)

    • Actions looks like stealing of personal data

      • javaw.exe (PID: 3276)

  • SUSPICIOUS

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 440)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3092)
      • chrome.exe (PID: 440)
      • minecraft_1-15-1.exe (PID: 3072)
      • minecraft_1-15-1.exe (PID: 3884)

    • Starts itself from another location

      • minecraft_1-15-1.exe (PID: 3072)

    • Reads Environment values

      • minecraft_1-15-1.exe (PID: 3884)

    • Uses ICACLS.EXE to modify access control list

      • javaw.exe (PID: 1792)

    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 3276)

    • Executes scripts

      • cmd.exe (PID: 3860)

    • Creates files in the program directory

      • javaw.exe (PID: 1792)

    • Starts application with an unusual extension

      • javaw.exe (PID: 3276)

    • Creates files in the user directory

      • minecraft_1-15-1.exe (PID: 3884)
      • javaw.exe (PID: 3276)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 440)
      • chrome.exe (PID: 3092)

    • Reads settings of System Certificates

      • chrome.exe (PID: 3092)
      • minecraft_1-15-1.exe (PID: 3884)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 440)

    • Dropped object may contain Bitcoin addresses

      • chrome.exe (PID: 3092)
      • javaw.exe (PID: 3276)

    • Application launched itself

      • chrome.exe (PID: 440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
86
Monitored processes
40
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs minecraft_1-15-1.exe minecraft_1-15-1.exe javaw.exe no specs icacls.exe no specs javaw.exe chcp.com no specs cmd.exe no specs cscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
440"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://download-subway-surfers.ru/game/minecraft/skachat-minecraft-na-kompyuter.html"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
480"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,12754365783303283576,4879310694962724411,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17426277539784592149 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
744"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,12754365783303283576,4879310694962724411,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7380478368670245555 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
848"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,12754365783303283576,4879310694962724411,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=7106852918822648081 --mojo-platform-channel-handle=4796 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
872"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,12754365783303283576,4879310694962724411,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=4019287114455621050 --mojo-platform-channel-handle=4016 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
984"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,12754365783303283576,4879310694962724411,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=3292786029283855085 --mojo-platform-channel-handle=4992 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1672"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,12754365783303283576,4879310694962724411,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9173819264081042146 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1792"C:\Users\admin\AppData\Roaming\.tlauncher\jre\win86\bin\javaw.exe" -versionC:\Users\admin\AppData\Roaming\.tlauncher\jre\win86\bin\javaw.exe—minecraft_1-15-1.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1810.13
Modules
Images
c:\users\admin\appdata\roaming\.tlauncher\jre\win86\bin\javaw.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1812"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,12754365783303283576,4879310694962724411,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=6687481105360613565 --mojo-platform-channel-handle=4884 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1852"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,12754365783303283576,4879310694962724411,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=6632129596565956206 --mojo-platform-channel-handle=4808 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
1 885
Read events
1 747
Write events
133
Delete events
5

Modification events

(PID) Process:(440) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(440) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(440) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(440) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(440) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3232) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:440-13233410399887750
Value:
259
(PID) Process:(440) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(440) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(440) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3120-13213713943555664
Value:
0
(PID) Process:(440) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
174
Suspicious files
187
Text files
480
Unknown types
507

Dropped files

PID
Process
Filename
Type
440chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5EB54060-1B8.pma —
MD5:—
SHA256:—
440chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old —
MD5:—
SHA256:—
440chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\a4b9df57-3a0a-467d-8a7a-bdcdbd76bce5.tmp —
MD5:—
SHA256:—
440chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
440chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RFa873c7.TMPtext
MD5:—
SHA256:—
440chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
440chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RFa873c7.TMPtext
MD5:—
SHA256:—
440chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.oldtext
MD5:—
SHA256:—
440chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
440chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RFa875bb.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
53
TCP/UDP connections
166
DNS requests
90
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3092
chrome.exe
GET
302
41.178.51.21:80
http://lookup.tpay.me/idxml.ashx/getmsisdn?redirectUrl=http%3A%2F%2Fbilling.virgopass.com%2Fenrichment.php%3Fservice%3Denrichment%26rid%3D64cf130a-99a0-44ed-8ac9-6600f5fa808c&date=2020-05-08+11%3A20%3A40Z&autoRedirect=true&orderId=64cf130a-99a0-44ed-8ac9-6600f5fa808c&signature=ZhI9mnrAhwtxHvtSvA8y%3Ab877304d609bc5f81ba3127220cdbcb345695cb9bb0c8872799bf8359aaf54cd
EG
—
—
unknown
3092
chrome.exe
GET
302
34.250.182.35:80
http://billing.virgopass.com/enrichment.php?service=enrichment&rid=64cf130a-99a0-44ed-8ac9-6600f5fa808c&Status=Error&Msisdn=&OperatorCode=&OrderId=64cf130a-99a0-44ed-8ac9-6600f5fa808c&Details=Failed+To+Get+MSISDN&Signature=ZhI9mnrAhwtxHvtSvA8y%3a4646fd6a5191f5b70871086ea63d0e60f62354e3502789b8d896db2b9cbc6a1d&SessionToken=Cz4zVRPvEaQVlMi4JjB9g
IE
—
—
unknown
3092
chrome.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ2xvBYPgmu%2FP%2FmXiVKe%2BjES00TfwQU78EqlQwy2vtzMNyKE9gVS%2FcT6PgCEG8uQSIolB1kqNt7vj9%2B2M4%3D
US
der
278 b
whitelisted
3092
chrome.exe
GET
200
13.224.186.35:80
http://dszxbe84pigtp.cloudfront.net/nautilus/templates/common/files/opr/42402.png
US
image
6.38 Kb
whitelisted
3092
chrome.exe
GET
302
172.217.21.238:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjY5QUFXTEQwc2RPVXhRY3picjhxblh1dw/7619.603.0.2_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
526 b
whitelisted
3092
chrome.exe
GET
200
13.224.186.35:80
http://dszxbe84pigtp.cloudfront.net/nautilus/templates/AE/ppwzae/files/lp_fleche/download.png
US
image
2.33 Kb
whitelisted
3092
chrome.exe
GET
200
151.139.128.14:80
http://ocsp.trust-provider.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEHbYt4bR81JP7pU%2BcUA9mdU%3D
US
der
471 b
whitelisted
3092
chrome.exe
GET
200
173.194.183.103:80
http://r2---sn-aigl6nek.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjY5QUFXTEQwc2RPVXhRY3picjhxblh1dw/7619.603.0.2_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mh=Qx&mip=185.217.117.152&mm=28&mn=sn-aigl6nek&ms=nvh&mt=1588936703&mv=m&mvi=1&pl=24&shardbypass=yes
US
crx
816 Kb
whitelisted
3092
chrome.exe
GET
200
13.224.186.35:80
http://dszxbe84pigtp.cloudfront.net/nautilus/templates/common/files/opr/42403.png
US
image
4.36 Kb
whitelisted
3092
chrome.exe
GET
200
143.204.97.46:80
http://promo.playweez-uae.com/ppwzae/lp_fleche/?ext_code=Google-c-c---387922226385-download-subway-surfers.ru&gclid=EAIaIQobChMIp_DG8JKk6QIVCAiLCh2_uQd-EAEYASAAEgKAIvD_BwE
US
html
33.3 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3092
chrome.exe
216.58.205.227:443
www.gstatic.com
Google Inc.
US
whitelisted
3092
chrome.exe
37.140.192.22:443
download-subway-surfers.ru
Domain names registrar REG.RU, Ltd
RU
malicious
3092
chrome.exe
172.217.22.2:443
pagead2.googlesyndication.com
Google Inc.
US
whitelisted
3092
chrome.exe
172.217.16.173:443
accounts.google.com
Google Inc.
US
whitelisted
3092
chrome.exe
87.240.139.194:443
clientservices.googleapis.com
VKontakte Ltd
RU
suspicious
3092
chrome.exe
217.69.133.145:443
top-fwz1.mail.ru
Limited liability company Mail.Ru
RU
suspicious
3092
chrome.exe
172.217.22.34:443
adservice.google.ae
Google Inc.
US
whitelisted
3092
chrome.exe
172.217.16.194:443
adservice.google.com
Google Inc.
US
whitelisted
3092
chrome.exe
172.217.23.162:443
partner.googleadservices.com
Google Inc.
US
whitelisted
3092
chrome.exe
172.217.18.98:443
googleads.g.doubleclick.net
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
download-subway-surfers.ru
  • 37.140.192.22
suspicious
clientservices.googleapis.com
  • 87.240.139.194
  • 87.240.137.158
  • 87.240.190.67
  • 87.240.190.72
  • 87.240.190.78
  • 93.186.225.208
whitelisted
accounts.google.com
  • 172.217.16.173
shared
vk.com
  • —
whitelisted
pagead2.googlesyndication.com
  • 172.217.22.2
whitelisted
top-fwz1.mail.ru
  • 217.69.133.145
whitelisted
adservice.google.ae
  • 172.217.22.34
whitelisted
adservice.google.com
  • 172.217.16.194
whitelisted
partner.googleadservices.com
  • 172.217.23.162
whitelisted
googleads.g.doubleclick.net
  • 172.217.18.98
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET INFO JAVA - Java Archive Download
—
—
A Network Trojan was detected
ET INFO JAVA - Java Archive Download
—
—
A Network Trojan was detected
ET INFO JAVA - Java Archive Download
—
—
A Network Trojan was detected
ET INFO JAVA - Java Archive Download
—
—
A Network Trojan was detected
ET INFO JAVA - Java Archive Download
—
—
A Network Trojan was detected
ET INFO JAVA - Java Archive Download
—
—
A Network Trojan was detected
ET INFO JAVA - Java Archive Download
—
—
A Network Trojan was detected
ET INFO JAVA - Java Archive Download
—
—
A Network Trojan was detected
ET INFO JAVA - Java Archive Download
—
—
A Network Trojan was detected
ET INFO JAVA - Java Archive Download
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://download-subway-surfers.ru/game/minecraft/skachat-minecraft-na-kompyuter.html