File name:

I3GSvcManager.exe

Full analysis: https://app.any.run/tasks/2cf884a7-515c-479e-b5d6-66477cacc5b7
Verdict: Malicious activity
Analysis date: March 05, 2024, 07:26:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2951F56151A0FF5B480A2A3EA348D232

SHA1:

44877AD743848348D175336F27D57FDFB6548747

SHA256:

23F13B42873C1A885E59F260CB9E37A98AC40F053D671BF7FA299945891A7B2F

SSDEEP:

98304:Sj+pzhreZxRMdRElX6ek1aBMU9VovGV7TB9czGm5N0QgMOmIz764XllNGOxUIADU:054du3Tg2gAA1yh2mqk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • I3GSvcManager.exe (PID: 2852)

    • Actions looks like stealing of personal data

      • I3GSvcManager.exe (PID: 2852)
      • certutil.exe (PID: 2100)
      • certutil.exe (PID: 980)

    • Changes the autorun value in the registry

      • I3GSvcManager.exe (PID: 2852)

    • Steals credentials from Web Browsers

      • I3GSvcManager.exe (PID: 2852)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • I3GSvcManager.exe (PID: 2852)

    • Reads the Internet Settings

      • I3GSvcManager.exe (PID: 2852)
      • I3GProc.exe (PID: 2804)
      • I3GInit.exe (PID: 3980)

    • Executable content was dropped or overwritten

      • I3GSvcManager.exe (PID: 2852)

    • Process drops legitimate windows executable

      • I3GSvcManager.exe (PID: 2852)

    • The process drops C-runtime libraries

      • I3GSvcManager.exe (PID: 2852)

    • Creates a software uninstall entry

      • I3GSvcManager.exe (PID: 2852)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • I3GSvcManager.exe (PID: 2852)

    • Reads security settings of Internet Explorer

      • I3GSvcManager.exe (PID: 2852)
      • I3GProc.exe (PID: 2804)
      • I3GInit.exe (PID: 3980)

    • Adds/modifies Windows certificates

      • certmgr.exe (PID: 3072)
      • I3GInit.exe (PID: 3980)

    • Executes as Windows Service

      • I3GMainSvc.exe (PID: 2336)

    • Checks Windows Trust Settings

      • I3GInit.exe (PID: 3980)

    • Reads the BIOS version

      • I3GProc.exe (PID: 2804)

    • Reads settings of System Certificates

      • I3GInit.exe (PID: 3980)

  • INFO

    • Checks supported languages

      • I3GSvcManager.exe (PID: 2852)
      • certmgr.exe (PID: 2340)
      • openssl.exe (PID: 2960)
      • openssl.exe (PID: 3776)
      • openssl.exe (PID: 1656)
      • openssl.exe (PID: 3308)
      • certmgr.exe (PID: 1692)
      • certmgr.exe (PID: 2692)
      • certmgr.exe (PID: 2420)
      • openssl.exe (PID: 1496)
      • I3GMainSvc.exe (PID: 680)
      • certutil.exe (PID: 2100)
      • certutil.exe (PID: 980)
      • I3GProc.exe (PID: 2804)
      • certmgr.exe (PID: 3072)
      • I3GMainSvc.exe (PID: 2336)
      • I3GMainSvc.exe (PID: 568)
      • I3GInit.exe (PID: 3980)

    • Reads Environment values

      • I3GSvcManager.exe (PID: 2852)

    • Creates files in the program directory

      • I3GSvcManager.exe (PID: 2852)
      • openssl.exe (PID: 3776)
      • openssl.exe (PID: 2960)
      • openssl.exe (PID: 1656)
      • openssl.exe (PID: 1496)
      • openssl.exe (PID: 3308)

    • Creates files or folders in the user directory

      • I3GSvcManager.exe (PID: 2852)
      • certutil.exe (PID: 980)
      • I3GInit.exe (PID: 3980)

    • Reads the computer name

      • I3GSvcManager.exe (PID: 2852)
      • certutil.exe (PID: 2100)
      • certutil.exe (PID: 980)
      • I3GMainSvc.exe (PID: 680)
      • I3GMainSvc.exe (PID: 568)
      • I3GMainSvc.exe (PID: 2336)
      • I3GProc.exe (PID: 2804)
      • I3GInit.exe (PID: 3980)

    • Reads the machine GUID from the registry

      • openssl.exe (PID: 1496)
      • openssl.exe (PID: 2960)
      • openssl.exe (PID: 1656)
      • openssl.exe (PID: 3776)
      • openssl.exe (PID: 3308)
      • certmgr.exe (PID: 3072)
      • I3GProc.exe (PID: 2804)
      • I3GInit.exe (PID: 3980)

    • Checks proxy server information

      • I3GSvcManager.exe (PID: 2852)
      • I3GInit.exe (PID: 3980)
      • I3GProc.exe (PID: 2804)

    • Reads the software policy settings

      • I3GInit.exe (PID: 3980)

    • Process checks whether UAC notifications are on

      • I3GProc.exe (PID: 2804)

    • Manual execution by a user

      • chrome.exe (PID: 2588)

    • Application launched itself

      • chrome.exe (PID: 2588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (38.9)
.exe | Win32 Executable MS Visual C++ (generic) (28.2)
.exe | Win64 Executable (generic) (25)
.exe | Win32 Executable (generic) (4)
.exe | Generic Win/DOS Executable (1.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:05:02 03:01:43+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 1236992
InitializedDataSize: 9635328
UninitializedDataSize: -
EntryPoint: 0x107d3b
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 3.0.0.24
ProductVersionNumber: 3.0.0.24
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Windows, Korea (Shift - KSC 5601)
Comments: I3GManager LWS Module Installer
CompanyName: Interezen. Co., Ltd.
FileDescription: I3GManager LWS Module Installer
FileVersion: 3.0.0.24
InternalName: I3GManager
LegalCopyright: Interezen. Copyright ⓒ 2009 ~
OriginalFileName: I3GSvcManager.exe
ProductName: I3GManager
ProductVersion: 3.0.0.24
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
89
Monitored processes
36
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start i3gsvcmanager.exe netsh.exe no specs certmgr.exe no specs certmgr.exe no specs certmgr.exe no specs certmgr.exe no specs openssl.exe no specs openssl.exe no specs openssl.exe no specs openssl.exe no specs openssl.exe no specs certmgr.exe no specs certutil.exe certutil.exe i3gproc.exe no specs i3gmainsvc.exe no specs i3gmainsvc.exe no specs i3gmainsvc.exe no specs i3ginit.exe no specs chrome.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs i3gsvcmanager.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=520 --field-trial-handle=1156,i,15715745929257462804,10208292196523398939,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
568"C:\Program Files\IPinside_LWS\I3GMainSvc.exe" -startC:\Program Files\IPinside_LWS\I3GMainSvc.exe—I3GSvcManager.exe
User:
admin
Company:
Interezen. Co., Ltd.
Integrity Level:
HIGH
Description:
Interezen Service Program
Exit code:
0
Version:
3.0.0.4
Modules
Images
c:\program files\ipinside_lws\i3gmainsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winspool.drv
572"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2096 --field-trial-handle=1156,i,15715745929257462804,10208292196523398939,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
680"C:\Program Files\IPinside_LWS\I3GMainSvc.exe" -installC:\Program Files\IPinside_LWS\I3GMainSvc.exe—I3GSvcManager.exe
User:
admin
Company:
Interezen. Co., Ltd.
Integrity Level:
HIGH
Description:
Interezen Service Program
Exit code:
0
Version:
3.0.0.4
Modules
Images
c:\program files\ipinside_lws\i3gmainsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winspool.drv
980"C:\Program Files\IPinside_LWS\certfr\certutil.exe" -A -n "Interezen CA" -t "CP,CP," -i "C:\Program Files\IPinside_LWS\interezen-rootca.crt" -d "sql:C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default"C:\Program Files\IPinside_LWS\certfr\certutil.exe
I3GSvcManager.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\ipinside_lws\certfr\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\ipinside_lws\certfr\nssutil3.dll
c:\program files\ipinside_lws\certfr\libplc4.dll
c:\program files\ipinside_lws\certfr\libnspr4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1124"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=1328 --field-trial-handle=1156,i,15715745929257462804,10208292196523398939,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1496"C:\Program Files\IPinside_LWS\openssl.exe" genrsa -out "C:\Program Files\IPinside_LWS\interezen-rootca.key" 2048C:\Program Files\IPinside_LWS\openssl.exe—I3GSvcManager.exe
User:
admin
Company:
The OpenSSL Project, https://www.openssl.org/
Integrity Level:
HIGH
Description:
OpenSSL application
Exit code:
0
Version:
3.0.7
Modules
Images
c:\program files\ipinside_lws\openssl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\ipinside_lws\libssl-3.dll
c:\program files\ipinside_lws\libcrypto-3.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
1656"C:\Program Files\IPinside_LWS\openssl.exe" genrsa -out "C:\Program Files\IPinside_LWS\interezenk.opt" 2048C:\Program Files\IPinside_LWS\openssl.exe—I3GSvcManager.exe
User:
admin
Company:
The OpenSSL Project, https://www.openssl.org/
Integrity Level:
HIGH
Description:
OpenSSL application
Exit code:
0
Version:
3.0.7
Modules
Images
c:\program files\ipinside_lws\openssl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\ipinside_lws\libssl-3.dll
c:\program files\ipinside_lws\libcrypto-3.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
1692"C:\Program Files\IPinside_LWS\certmgr.exe" /del /c /sha1 E2FF4E7BFC1931FD93B772BACA8BAC194FBCF746 /s /r localMachine RootC:\Program Files\IPinside_LWS\certmgr.exe—I3GSvcManager.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
ECM Certificate Manager
Exit code:
4294967295
Version:
5.131.1863.1
Modules
Images
c:\program files\ipinside_lws\certmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
2044"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3336 --field-trial-handle=1156,i,15715745929257462804,10208292196523398939,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
25 044
Read events
24 663
Write events
365
Delete events
16

Modification events

(PID) Process:(2852) I3GSvcManager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:ipinside-mgr
Value:
(PID) Process:(2852) I3GSvcManager.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
Operation:writeName:C:\Users\admin\AppData\Local\Temp\I3GSvcManager.exe
Value:
1
(PID) Process:(2852) I3GSvcManager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IPinside LWS Agent
Operation:writeName:DisplayIcon
Value:
C:\Program Files\IPinside_LWS\I3GSvcManager.exe
(PID) Process:(2852) I3GSvcManager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IPinside LWS Agent
Operation:writeName:DisplayName
Value:
IPinside LWS Agent
(PID) Process:(2852) I3GSvcManager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IPinside LWS Agent
Operation:writeName:DisplayVersion
Value:
3.0.0.24
(PID) Process:(2852) I3GSvcManager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IPinside LWS Agent
Operation:writeName:Publisher
Value:
interezen
(PID) Process:(2852) I3GSvcManager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IPinside LWS Agent
Operation:writeName:UninstallPath
Value:
C:\Program Files\IPinside_LWS\I3GSvcManager.exe
(PID) Process:(2852) I3GSvcManager.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IPinside LWS Agent
Operation:writeName:UninstallString
Value:
C:\Program Files\IPinside_LWS\I3GSvcManager.exe /uninstall
(PID) Process:(2852) I3GSvcManager.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2852) I3GSvcManager.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
66
Suspicious files
69
Text files
73
Unknown types
52

Dropped files

PID
Process
Filename
Type
2852I3GSvcManager.exeC:\Program Files\IPinside_LWS\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:E205DE17A85B0C3352A6857EF9B3C6DD
SHA256:29B23370474BE0C459CC47863603167CC7191F58318BD29877225FCBF2454215
2852I3GSvcManager.exeC:\Program Files\IPinside_LWS\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:405BB6A7CD56CBF5276C3A8DC631963D
SHA256:F654E56C4299F507BC34271B6BAA29290FD4919B853E17D7470596CAD779F063
2852I3GSvcManager.exeC:\Program Files\IPinside_LWS\api-ms-win-core-file-l1-1-0.dllexecutable
MD5:6B937FE1EFF0E440B124BBB9334DF34D
SHA256:71C87C14BC1BD0B20D9F68D4943E93C4C6DDC1B6CF252938BB15FE562552F93E
2852I3GSvcManager.exeC:\Program Files\IPinside_LWS\api-ms-win-core-file-l2-1-0.dllexecutable
MD5:3F224766FE9B090333FDB43D5A22F9EA
SHA256:AE5E73416EB64BC18249ACE99F6847024ECEEA7CE9C343696C84196460F3A357
2852I3GSvcManager.exeC:\Program Files\IPinside_LWS\api-ms-win-core-file-l1-2-0.dllexecutable
MD5:79EE4A2FCBE24E9A65106DE834CCDA4A
SHA256:9F7BDA59FAAFC8A455F98397A63A7F7D114EFC4E8A41808C791256EBF33C7613
2852I3GSvcManager.exeC:\Program Files\IPinside_LWS\api-ms-win-core-handle-l1-1-0.dllexecutable
MD5:0A0084D4B3635E4D8EBAB587DCFCC16C
SHA256:5089484C8C56AC8E095CADC3DC971DF71EDEB52F856940632821FD37E81AE5CA
2852I3GSvcManager.exeC:\Program Files\IPinside_LWS\api-ms-win-core-interlocked-l1-1-0.dllexecutable
MD5:13BBF7740AFC464172B00F9638BC4F81
SHA256:FF482F69F2183B5FD3C1B45D9006156524B8F8A5F518E33D6E92EA079787E64D
2852I3GSvcManager.exeC:\Program Files\IPinside_LWS\api-ms-win-core-processthreads-l1-1-0.dllexecutable
MD5:066874FF22E1C100DC56C4AE76D2E1C2
SHA256:979FF0E25E7EA00B8714C9EF2DC8417E69AFAC137EA88F77F8F5A9FFEAA31923
2852I3GSvcManager.exeC:\Program Files\IPinside_LWS\api-ms-win-core-libraryloader-l1-1-0.dllexecutable
MD5:8F239C629F09E1B49CF1F03304AB8E69
SHA256:D8D74FB87F94A587582D56934816362B992B712E47C39F13D957058F17724886
2852I3GSvcManager.exeC:\Program Files\IPinside_LWS\api-ms-win-core-memory-l1-1-0.dllexecutable
MD5:536F07C04C316AAC61AB64A492ED9191
SHA256:50BF87DA10AE3F442C457E42D6666993B0FCA7C5D4DF521E8CD0959995FBCDDC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
38
DNS requests
35
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
856
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx
unknown
—
—
unknown
856
svchost.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx
unknown
binary
3.07 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1124
chrome.exe
108.177.15.84:443
accounts.google.com
GOOGLE
US
unknown
2588
chrome.exe
239.255.255.250:1900
—
—
—
unknown
1124
chrome.exe
142.250.186.132:443
www.google.com
GOOGLE
US
whitelisted
1124
chrome.exe
142.250.186.163:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
1124
chrome.exe
142.250.186.99:443
update.googleapis.com
GOOGLE
US
whitelisted
2588
chrome.exe
224.0.0.251:5353
—
—
—
unknown
1124
chrome.exe
142.250.186.142:443
encrypted-tbn0.gstatic.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 142.250.186.163
whitelisted
accounts.google.com
  • 108.177.15.84
shared
www.google.com
  • 142.250.186.132
whitelisted
update.googleapis.com
  • 142.250.186.99
whitelisted
encrypted-tbn0.gstatic.com
  • 142.250.186.142
whitelisted
google.com
  • 142.250.186.174
whitelisted
www.gstatic.com
  • 142.250.186.163
whitelisted
content-autofill.googleapis.com
  • 142.250.181.234
  • 172.217.18.10
  • 216.58.206.42
  • 142.250.185.234
  • 142.250.185.138
  • 142.250.186.106
  • 142.250.186.42
  • 142.250.184.234
  • 142.250.185.170
  • 142.250.184.202
  • 142.250.185.106
  • 142.250.74.202
  • 172.217.16.202
  • 142.250.186.74
  • 142.250.185.202
  • 142.250.186.170
whitelisted
fonts.gstatic.com
  • 142.250.185.227
whitelisted
apis.google.com
  • 142.250.185.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
I3GSvcManager.exe