URL:

https://www.sohu.com

Full analysis: https://app.any.run/tasks/c018458f-6d6c-4fb8-991f-c98a0ed92386
Verdict: Malicious activity
Analysis date: January 15, 2022, 01:54:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

DEE97671174CD057D301B7B688DDE43C

SHA1:

3703E96140DC44C3ADF23E8134114D7C28BC1ED0

SHA256:

2795DDE18220FCCFDC91CB973C9693D67A9B62E122099B98AA1070E25E1E1D2D

SSDEEP:

3:N8DSLGdI:2OLp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Reads the computer name

      • chrome.exe (PID: 2172)
      • chrome.exe (PID: 4068)
      • chrome.exe (PID: 288)
      • chrome.exe (PID: 4092)
      • chrome.exe (PID: 2776)
      • chrome.exe (PID: 2176)
      • chrome.exe (PID: 3164)
    • Checks supported languages

      • chrome.exe (PID: 4092)
      • chrome.exe (PID: 288)
      • chrome.exe (PID: 2312)
      • chrome.exe (PID: 2980)
      • chrome.exe (PID: 3504)
      • chrome.exe (PID: 1512)
      • chrome.exe (PID: 2328)
      • chrome.exe (PID: 2172)
      • chrome.exe (PID: 2424)
      • chrome.exe (PID: 4068)
      • chrome.exe (PID: 2524)
      • chrome.exe (PID: 1648)
      • chrome.exe (PID: 2176)
      • chrome.exe (PID: 2776)
      • chrome.exe (PID: 3164)
    • Reads settings of System Certificates

      • chrome.exe (PID: 4092)
    • Reads the hosts file

      • chrome.exe (PID: 2172)
      • chrome.exe (PID: 4092)
    • Application launched itself

      • chrome.exe (PID: 2172)
    • Reads the date of Windows installation

      • chrome.exe (PID: 2776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
15
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2172"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://www.sohu.com"C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\winspool.drv
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\srvcli.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\winsta.dll
c:\windows\system32\mmdevapi.dll
c:\windows\system32\propsys.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\devobj.dll
c:\windows\system32\wpc.dll
c:\windows\system32\wevtapi.dll
c:\windows\system32\samcli.dll
c:\windows\system32\samlib.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\credssp.dll
c:\windows\system32\firewallapi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\kbdus.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\dui70.dll
c:\windows\system32\wlanapi.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn2.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wlanutil.dll
c:\windows\system32\wbem\wbemsvc.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\ehstorshell.dll
c:\windows\system32\cscui.dll
c:\windows\system32\cscdll.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\ntdsapi.dll
c:\windows\system32\slc.dll
c:\windows\system32\imageres.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\mscms.dll
c:\windows\system32\mf.dll
c:\windows\system32\atl.dll
c:\windows\system32\ksuser.dll
c:\windows\system32\mfplat.dll
c:\windows\system32\avrt.dll
c:\windows\system32\mfreadwrite.dll
c:\windows\system32\wship6.dll
2424"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6e7ed988,0x6e7ed998,0x6e7ed9a4C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\winmm.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4068"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,10086899816354379636,9943663010008505889,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1064 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\winmm.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\winspool.drv
c:\windows\system32\webio.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\mf.dll
c:\windows\system32\atl.dll
c:\windows\system32\mfplat.dll
c:\windows\system32\avrt.dll
c:\windows\system32\ksuser.dll
c:\windows\system32\msmpeg2vdec.dll
c:\windows\system32\evr.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\slc.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\dxva2.dll
c:\windows\system32\d3dcompiler_47.dll
c:\program files\google\chrome\application\86.0.4240.198\libglesv2.dll
c:\program files\google\chrome\application\86.0.4240.198\libegl.dll
c:\windows\system32\d3d11.dll
c:\windows\system32\d3d9.dll
4092"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1036,10086899816354379636,9943663010008505889,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1244 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\winmm.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\userenv.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\profapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\winspool.drv
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wship6.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\credssp.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\devobj.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\devrtl.dll
2312"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,10086899816354379636,9943663010008505889,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1236 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msctf.dll
c:\windows\system32\winmm.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\ole32.dll
c:\windows\system32\secur32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\winspool.drv
c:\windows\system32\dwrite.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\webio.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome.dll
2328"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,10086899816354379636,9943663010008505889,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1872 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\winmm.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\userenv.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\profapi.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\winspool.drv
c:\windows\system32\webio.dll
c:\windows\system32\dhcpcsvc.dll
2524"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,10086899816354379636,9943663010008505889,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2212 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\winmm.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\winspool.drv
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\nsi.dll
288"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,10086899816354379636,9943663010008505889,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2692 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\winmm.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\winspool.drv
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\mf.dll
c:\windows\system32\atl.dll
c:\windows\system32\mfplat.dll
c:\windows\system32\ksuser.dll
c:\windows\system32\avrt.dll
c:\windows\system32\msmpeg2vdec.dll
c:\windows\system32\evr.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\slc.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\dxva2.dll
c:\windows\system32\d3dcompiler_47.dll
c:\windows\system32\ddraw.dll
c:\windows\system32\dciman32.dll
c:\program files\google\chrome\application\86.0.4240.198\swiftshader\libglesv2.dll
2980"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,10086899816354379636,9943663010008505889,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\lpk.dll
c:\windows\system32\imm32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msctf.dll
c:\windows\system32\winmm.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\dwrite.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\winspool.drv
c:\windows\system32\webio.dll
c:\windows\system32\dhcpcsvc.dll
3504"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,10086899816354379636,9943663010008505889,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\imm32.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msctf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\psapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\profapi.dll
c:\windows\system32\userenv.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\winspool.drv
c:\windows\system32\dwrite.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\webio.dll
Total events
16 125
Read events
16 055
Write events
70
Delete events
0

Modification events

(PID) Process:(2172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2172) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
(PID) Process:(2172) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid_installdate
Value:
0
Executable files
0
Suspicious files
19
Text files
59
Unknown types
1

Dropped files

PID
Process
Filename
Type
2172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61E2294B-87C.pma
MD5:
SHA256:
2172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
2424chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pmabinary
MD5:03C4F648043A88675A920425D824E1B3
SHA256:F91DBB7C64B4582F529C968C480D2DCE1C8727390482F31E4355A27BB3D9B450
2172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:5BD3C311F2136A7A88D3E197E55CF902
SHA256:FA331915E1797E59979A3E4BCC2BD0D3DEAA039B94D4DB992BE251FD02A224B9
2172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:8FF312A95D60ED89857FEB720D80D4E1
SHA256:946A57FAFDD28C3164D5AB8AB4971B21BD5EC5BFFF7554DBF832CB58CC37700B
2172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC
SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731
2172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF112eed.TMPtext
MD5:64AD8ED3E666540337BA541C549F72F7
SHA256:BECBDB08B5B37D203A85F2E974407334053BB1D2270F0B3C9A4DB963896F2206
2172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old~RF113015.TMPtext
MD5:109A25C32EE1132ECD6D9F3ED9ADF01A
SHA256:DA6028DB9485C65E683643658326F02B1D0A1566DE14914EF28E5248EB94F0DD
2172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.oldtext
MD5:7721CDA9F5B73CE8A135471EB53B4E0E
SHA256:DD730C576766A46FFC84E682123248ECE1FF1887EC0ACAB22A5CE93A450F4500
2172chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF112edd.TMPtext
MD5:936EB7280DA791E6DD28EF3A9B46D39C
SHA256:CBAF2AFD831B32F6D1C12337EE5D2F090D6AE1F4DCB40B08BEF49BF52AD9721F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
166
DNS requests
87
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4092
chrome.exe
GET
200
101.33.11.29:80
http://statics.itc.cn/sohu-homepage/oldentrancetwo.png
CN
image
3.02 Kb
malicious
4092
chrome.exe
GET
200
52.169.16.184:80
http://www.sohu.com/upload/images/server/ghs.png
IE
image
18.8 Kb
malicious
4092
chrome.exe
GET
200
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?23973e4254f5fcda
US
compressed
59.9 Kb
whitelisted
4092
chrome.exe
GET
200
101.33.11.29:80
http://statics.itc.cn/sohu-homepage/oldentrancetwobg.png
CN
image
4.12 Kb
malicious
4092
chrome.exe
GET
200
101.33.11.29:80
http://statics.itc.cn/web/static/images/pic/preload.png
CN
image
2.01 Kb
malicious
4092
chrome.exe
GET
200
101.33.10.52:80
http://p8.itc.cn/q_70,a_auto,c_cut,x_0,y_0,w_799,h_533,c_zoom,w_640/images01/20210926/440461500962494a948ddd49ec877332.jpeg
CN
image
43.7 Kb
suspicious
4092
chrome.exe
GET
307
52.169.16.184:80
http://sports.sohu.com/upload/nbalogo/pacers.jpg
IE
html
180 b
malicious
4092
chrome.exe
GET
200
163.171.129.134:80
http://i2.itc.cn/20151026/361c_f8b89b9c_02ef_dd1d_a0d0_65600cead191_11.jpg
US
image
8.16 Kb
malicious
4092
chrome.exe
GET
307
52.169.16.184:80
http://sports.sohu.com/upload/nbalogo/pistons.jpg
IE
html
180 b
malicious
4092
chrome.exe
GET
307
52.169.16.184:80
http://sports.sohu.com/upload/nbalogo/suns.jpg
IE
html
180 b
malicious
4092
chrome.exe
GET
307
52.169.16.184:80
http://sports.sohu.com/upload/nbalogo/magic.jpg
IE
html
180 b
malicious
4092
chrome.exe
GET
307
52.169.16.184:80
http://sports.sohu.com/upload/nbalogo/celtics.jpg
IE
html
180 b
malicious
4092
chrome.exe
GET
200
101.33.11.29:80
http://i1.itc.cn/20130506/2f41_9d0ee937_cc9a_4d74_b8fb_f0e2ada905bb_2.jpg
CN
image
10.7 Kb
malicious
4092
chrome.exe
GET
307
52.169.16.184:80
http://sports.sohu.com/upload/nbalogo/bulls.jpg
IE
html
180 b
malicious
4092
chrome.exe
GET
200
163.171.129.134:80
http://i3.itc.cn/20151026/361c_f8b89b9c_02ef_dd1d_a0d0_65600cead191_5.jpg
US
image
8.65 Kb
malicious
4092
chrome.exe
GET
200
163.171.129.134:80
http://i3.itc.cn/20151026/361c_f8b89b9c_02ef_dd1d_a0d0_65600cead191_12.jpg
US
image
10.5 Kb
malicious
4092
chrome.exe
GET
307
52.169.16.184:80
http://sports.sohu.com/upload/teams//Te025.jpg
IE
html
180 b
malicious
4092
chrome.exe
GET
307
52.169.16.184:80
http://sports.sohu.com/upload/nbalogo/heat.jpg
IE
html
180 b
malicious
4092
chrome.exe
GET
200
163.171.129.134:80
http://i3.itc.cn/20151026/361c_f8b89b9c_02ef_dd1d_a0d0_65600cead191_7.jpg
US
image
12.0 Kb
malicious
4092
chrome.exe
GET
307
52.169.16.184:80
http://sports.sohu.com/upload/teams//Te002.jpg
IE
html
180 b
malicious
4092
chrome.exe
GET
307
52.169.16.184:80
http://sports.sohu.com/upload/teams//Te006.jpg
IE
html
180 b
malicious
4092
chrome.exe
GET
307
52.169.16.184:80
http://sports.sohu.com/upload/teams//Te030.jpg
IE
html
180 b
malicious
4092
chrome.exe
GET
307
52.169.16.184:80
http://sports.sohu.com/upload/teams//Te004.jpg
IE
html
180 b
malicious
4092
chrome.exe
GET
307
52.169.16.184:80
http://sports.sohu.com/upload/teams//Te027.jpg
IE
html
180 b
malicious
4092
chrome.exe
GET
307
52.169.16.184:80
http://sports.sohu.com/upload/teams//Te029.jpg
IE
html
180 b
malicious
4092
chrome.exe
GET
307
52.169.16.184:80
http://sports.sohu.com/upload/teams//Te008.jpg
IE
html
180 b
malicious
4092
chrome.exe
GET
200
110.43.83.43:80
http://match.sports.sohu.com/soccerpc/images/team/2673.png
CN
image
11.1 Kb
unknown
4092
chrome.exe
GET
200
110.43.83.43:80
http://match.sports.sohu.com/soccerpc/images/team/7.png
CN
image
18.9 Kb
unknown
4092
chrome.exe
GET
200
110.43.83.43:80
http://match.sports.sohu.com/soccerpc/images/team/30.png
CN
image
9.45 Kb
unknown
4092
chrome.exe
GET
200
110.43.83.43:80
http://match.sports.sohu.com/soccerpc/images/team/2538.png
CN
image
5.75 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4092
chrome.exe
142.250.185.174:443
clients2.google.com
Google Inc.
US
whitelisted
4092
chrome.exe
142.250.185.109:443
accounts.google.com
Google Inc.
US
suspicious
4092
chrome.exe
52.169.16.184:443
www.sohu.com
Microsoft Corporation
IE
suspicious
4092
chrome.exe
163.171.129.134:443
39d0825d09f05.cdn.sohucs.com
US
malicious
4092
chrome.exe
101.33.11.45:443
statics.itc.cn
CN
suspicious
4092
chrome.exe
163.181.56.168:443
images.sohu.com
US
suspicious
4092
chrome.exe
52.169.16.184:80
www.sohu.com
Microsoft Corporation
IE
suspicious
4092
chrome.exe
101.33.11.29:80
statics.itc.cn
CN
suspicious
4092
chrome.exe
13.69.222.243:443
txt.go.sohu.com
Microsoft Corporation
IE
suspicious
4092
chrome.exe
163.181.56.174:443
images.sohu.com
US
suspicious
4092
chrome.exe
79.133.177.225:443
p2.itc.cn
SOT LINE Limited Company
RU
malicious
4092
chrome.exe
113.105.172.35:443
cpro.baidustatic.com
CHINANET Guangdong province network
CN
suspicious
4092
chrome.exe
3.129.250.65:443
ads.vidoomy.com
US
unknown
4092
chrome.exe
52.169.150.217:443
www.sohu.com
Microsoft Corporation
IE
unknown
4092
chrome.exe
40.85.113.106:443
txt.go.sohu.com
Microsoft Corporation
IE
malicious
40.85.113.106:443
txt.go.sohu.com
Microsoft Corporation
IE
malicious
4092
chrome.exe
151.139.128.11:443
ad.lkqd.net
Highwinds Network Group, Inc.
US
malicious
4092
chrome.exe
67.27.235.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
unknown
4092
chrome.exe
66.155.71.149:443
pixel-sync.sitescout.com
Peer 1 Network (USA) Inc.
CA
suspicious
4092
chrome.exe
2.18.234.233:443
ads.stickyadstv.com
Akamai International B.V.
whitelisted
4092
chrome.exe
3.122.218.60:443
a.vidoomy.com
US
unknown
4092
chrome.exe
142.250.185.138:443
content-autofill.googleapis.com
Google Inc.
US
whitelisted
4092
chrome.exe
75.2.29.42:443
stg.vidoomy.com
AT&T Services, Inc.
US
unknown
4092
chrome.exe
182.61.200.109:443
pos.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
CN
suspicious
4092
chrome.exe
40.83.99.9:443
jincai.sohu.com
Microsoft Corporation
HK
unknown
4092
chrome.exe
79.133.177.230:443
p2.itc.cn
SOT LINE Limited Company
RU
malicious
4092
chrome.exe
18.196.253.68:443
x.bidswitch.net
Amazon.com, Inc.
DE
unknown
4092
chrome.exe
116.162.88.83:443
adv-sv-show.focus.cn
CN
suspicious
4092
chrome.exe
142.250.184.227:443
ssl.gstatic.com
Google Inc.
US
whitelisted
4092
chrome.exe
146.20.132.96:443
v.lkqd.net
Rackspace Ltd.
US
unknown
4092
chrome.exe
46.228.164.11:443
ad.turn.com
Turn Europe (UK) Ltd.
GB
suspicious
146.20.132.96:443
v.lkqd.net
Rackspace Ltd.
US
unknown
4092
chrome.exe
146.20.128.80:443
t.lkqd.net
Rackspace Ltd.
US
unknown
4092
chrome.exe
101.33.11.88:443
statics.itc.cn
CN
suspicious
4092
chrome.exe
168.119.168.187:443
bidswitch-eu.splicky.com
US
unknown
4092
chrome.exe
146.20.132.189:443
cs.lkqd.net
Rackspace Ltd.
US
unknown
4092
chrome.exe
220.195.22.129:443
qpb.sohu.com
CHINA UNICOM China169 Backbone
CN
suspicious
4092
chrome.exe
121.29.28.194:443
e8aeb8bbdbbd7.cdn.sohucs.com
CHINA UNICOM China169 Backbone
CN
unknown
4092
chrome.exe
142.250.74.202:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
101.33.11.48:443
statics.itc.cn
CN
suspicious
4092
chrome.exe
112.34.113.91:443
wn.pos.baidu.com
Guangdong Mobile Communication Co.Ltd.
CN
unknown
40.83.99.9:443
jincai.sohu.com
Microsoft Corporation
HK
unknown
101.33.10.52:80
statics.itc.cn
CN
suspicious
4092
chrome.exe
101.33.11.48:443
statics.itc.cn
CN
suspicious
4092
chrome.exe
124.236.104.35:443
lupic.cdn.bcebos.com
No.31,Jin-rong Street
CN
unknown
163.181.56.175:443
images.sohu.com
US
suspicious
163.177.118.127:443
e8aeb8bbdbbd7.cdn.sohucs.com
China Unicom IP network China169 Guangdong province
CN
unknown
4092
chrome.exe
163.177.118.127:443
e8aeb8bbdbbd7.cdn.sohucs.com
China Unicom IP network China169 Guangdong province
CN
unknown
4092
chrome.exe
110.242.68.137:443
eclick.baidu.com
CHINA UNICOM China169 Backbone
CN
unknown
110.242.68.137:443
eclick.baidu.com
CHINA UNICOM China169 Backbone
CN
unknown
4092
chrome.exe
110.43.83.35:443
hqm.stock.sohu.com
CN
unknown
163.171.129.134:443
39d0825d09f05.cdn.sohucs.com
US
malicious
163.171.129.134:80
39d0825d09f05.cdn.sohucs.com
US
malicious
4092
chrome.exe
163.171.129.134:80
39d0825d09f05.cdn.sohucs.com
US
malicious
4092
chrome.exe
110.43.83.43:80
match.sports.sohu.com
CN
unknown
4092
chrome.exe
163.181.56.171:443
images.sohu.com
US
suspicious
4092
chrome.exe
119.188.176.49:443
dup.baidustatic.com
CHINA UNICOM China169 Backbone
CN
unknown
4092
chrome.exe
101.33.11.110:80
statics.itc.cn
CN
suspicious
4092
chrome.exe
101.33.11.88:80
statics.itc.cn
CN
suspicious
101.33.11.29:443
statics.itc.cn
CN
suspicious
4092
chrome.exe
146.20.132.84:443
v.lkqd.net
Rackspace Ltd.
US
unknown
146.20.128.66:443
t.lkqd.net
Rackspace Ltd.
US
unknown
4092
chrome.exe
220.194.224.234:443
e8aeb8bbdbbd7.cdn.sohucs.com
CHINA UNICOM China169 Backbone
CN
unknown
4092
chrome.exe
18.198.95.145:443
x.bidswitch.net
Massachusetts Institute of Technology
US
unknown

DNS requests

Domain
IP
Reputation
accounts.google.com
  • 142.250.185.109
shared
www.sohu.com
  • 52.169.16.184
  • 52.169.150.217
malicious
clients2.google.com
  • 142.250.185.174
whitelisted
statics.itc.cn
  • 101.33.11.29
  • 101.33.11.110
  • 101.33.11.45
  • 101.33.10.52
  • 101.33.11.88
  • 101.33.11.48
malicious
p9.itc.cn
  • 101.33.11.45
  • 101.33.11.48
  • 101.33.11.110
  • 101.33.10.52
  • 101.33.11.88
  • 101.33.11.29
suspicious
39d0825d09f05.cdn.sohucs.com
  • 163.171.129.134
malicious
txt.go.sohu.com
  • 13.69.222.243
  • 40.85.113.106
malicious
images.sohu.com
  • 163.181.56.168
  • 163.181.56.171
  • 163.181.56.172
  • 163.181.56.174
  • 163.181.56.170
  • 163.181.56.175
  • 163.181.56.169
  • 163.181.56.173
malicious
p4.itc.cn
  • 101.33.11.110
  • 101.33.11.48
  • 101.33.11.88
  • 101.33.11.45
  • 101.33.11.29
  • 101.33.10.52
suspicious
p6.itc.cn
  • 101.33.11.45
  • 101.33.11.48
  • 101.33.10.52
  • 101.33.11.29
  • 101.33.11.110
  • 101.33.11.88
malicious
p1.itc.cn
  • 163.181.56.174
  • 163.181.56.168
  • 163.181.56.169
  • 163.181.56.170
  • 163.181.56.175
  • 163.181.56.171
  • 163.181.56.173
  • 163.181.56.172
malicious
p7.itc.cn
  • 101.33.11.88
  • 101.33.11.29
  • 101.33.10.52
  • 101.33.11.45
  • 101.33.11.110
  • 101.33.11.48
suspicious
p3.itc.cn
  • 163.171.129.134
malicious
p2.itc.cn
  • 79.133.177.225
  • 79.133.177.229
  • 79.133.177.228
  • 79.133.177.227
  • 79.133.177.232
  • 79.133.177.230
  • 79.133.177.231
  • 79.133.177.226
malicious
cpro.baidustatic.com
  • 113.105.172.35
whitelisted
v4.passport.sohu.com
  • 40.85.113.106
  • 13.69.222.243
malicious
cis.sohu.com
  • 40.85.113.106
  • 13.69.222.243
malicious
ads.vidoomy.com
  • 3.129.250.65
unknown
v2.sohu.com
  • 52.169.150.217
  • 52.169.16.184
malicious
track.sohu.com
  • 13.69.222.243
  • 40.85.113.106
malicious
pv.sohu.com
  • 40.85.113.106
  • 13.69.222.243
malicious
imp.optaim.com
  • 40.85.113.106
  • 13.69.222.243
malicious
imp.go.sohu.com
  • 13.69.222.243
  • 40.85.113.106
malicious
i.go.sohu.com
  • 40.85.113.106
  • 13.69.222.243
malicious
s.go.sohu.com
  • 13.69.222.243
  • 40.85.113.106
suspicious
ad.lkqd.net
  • 151.139.128.11
malicious
ctldl.windowsupdate.com
  • 67.27.235.254
  • 67.27.159.126
  • 67.26.139.254
  • 67.27.234.126
  • 8.248.117.254
whitelisted
pixel-sync.sitescout.com
  • 66.155.71.149
whitelisted
content-autofill.googleapis.com
  • 142.250.185.138
whitelisted
ads.stickyadstv.com
  • 2.18.234.233
whitelisted
pos.baidu.com
  • 182.61.200.109
whitelisted
a.vidoomy.com
  • 3.122.218.60
  • 52.58.61.12
  • 52.57.69.138
  • 52.28.186.152
  • 3.125.85.116
  • 3.122.131.186
unknown
x.bidswitch.net
  • 18.196.253.68
  • 18.198.95.145
  • 18.158.151.180
  • 18.194.0.84
  • 3.124.83.68
  • 3.123.163.195
  • 3.120.57.143
  • 52.29.51.56
shared
stg.vidoomy.com
  • 75.2.29.42
  • 99.83.189.147
unknown
jincai.sohu.com
  • 40.83.99.9
unknown
search.sohu.com
  • 13.69.222.243
  • 40.85.113.106
malicious
adv-sv-show.focus.cn
  • 116.162.88.83
  • 116.177.248.65
  • 58.144.136.236
  • 222.138.7.217
  • 123.6.33.48
  • 58.144.138.58
  • 42.56.79.87
  • 116.177.248.108
  • 61.161.9.245
  • 116.162.88.99
  • 222.138.7.210
  • 111.161.14.94
  • 61.161.9.195
  • 42.56.76.118
malicious
pl.hd.sohu.com
  • 52.169.16.184
  • 52.169.150.217
malicious
k.sohu.com
  • 40.85.113.106
  • 13.69.222.243
malicious
m1.auto.itc.cn
  • 79.133.177.230
  • 79.133.177.229
  • 79.133.177.227
  • 79.133.177.226
  • 79.133.177.225
  • 79.133.177.228
  • 79.133.177.232
  • 79.133.177.231
malicious
t.focus-res.cn
  • 101.33.11.88
  • 101.33.11.29
  • 101.33.11.48
  • 101.33.11.45
  • 101.33.10.52
  • 101.33.11.110
suspicious
go.sohu.com
  • 13.69.222.243
  • 40.85.113.106
malicious
v.lkqd.net
  • 146.20.132.96
  • 146.20.132.84
  • 146.20.132.82
  • 146.20.132.90
  • 146.20.132.88
  • 146.20.132.83
  • 146.20.132.91
  • 146.20.132.87
  • 146.20.132.92
  • 146.20.132.89
  • 146.20.132.95
  • 146.20.132.85
  • 146.20.132.97
  • 146.20.132.86
whitelisted
ydgf.sohu.com
  • 13.69.222.243
  • 40.85.113.106
malicious
ssl.gstatic.com
  • 142.250.184.227
whitelisted
cs.lkqd.net
  • 146.20.132.189
  • 146.20.132.179
  • 146.20.132.192
  • 146.20.132.184
  • 146.20.132.190
  • 146.20.132.186
  • 146.20.132.187
  • 146.20.132.181
  • 146.20.132.183
  • 146.20.132.193
  • 146.20.132.191
  • 146.20.132.178
  • 146.20.132.180
  • 146.20.132.182
  • 146.20.132.185
  • 146.20.132.188
whitelisted
ad.turn.com
  • 46.228.164.11
whitelisted
safebrowsing.googleapis.com
  • 142.250.74.202
whitelisted
beijing.auto.sohu.com
  • 52.169.150.217
  • 52.169.16.184
malicious
e8aeb8bbdbbd7.cdn.sohucs.com
  • 121.29.28.194
  • 220.194.224.234
  • 1.189.213.207
  • 163.177.118.127
  • 61.176.194.57
  • 116.162.13.49
malicious
p0.itc.cn
  • 101.33.11.110
  • 101.33.11.88
  • 101.33.10.52
  • 101.33.11.45
  • 101.33.11.48
  • 101.33.11.29
malicious
qpb.sohu.com
  • 220.195.22.129
unknown
bidswitch-eu.splicky.com
  • 168.119.168.187
shared
p5.itc.cn
  • 101.33.11.45
  • 101.33.11.88
  • 101.33.11.29
  • 101.33.11.110
  • 101.33.11.48
  • 101.33.10.52
malicious
wn.pos.baidu.com
  • 112.34.113.91
whitelisted
5b0988e595225.cdn.sohucs.com
  • 101.33.11.48
  • 101.33.11.29
  • 101.33.11.88
  • 101.33.11.45
  • 101.33.10.52
  • 101.33.11.110
malicious
p8.itc.cn
  • 101.33.10.52
  • 101.33.11.88
  • 101.33.11.45
  • 101.33.11.110
  • 101.33.11.48
  • 101.33.11.29
suspicious
t.lkqd.net
  • 146.20.128.80
  • 146.20.128.66
  • 146.20.128.72
  • 146.20.128.81
  • 146.20.128.74
  • 146.20.128.77
  • 146.20.128.67
  • 146.20.128.68
  • 146.20.128.71
  • 146.20.128.70
  • 146.20.128.75
  • 146.20.128.69
  • 146.20.128.73
  • 146.20.128.78
whitelisted
db.auto.sohu.com
  • 40.83.99.9
malicious
m4.auto.itc.cn
  • 163.181.56.175
  • 163.181.56.173
  • 163.181.56.169
  • 163.181.56.174
  • 163.181.56.170
  • 163.181.56.168
  • 163.181.56.171
  • 163.181.56.172
malicious
lupic.cdn.bcebos.com
  • 124.236.104.35
  • 117.34.37.35
  • 117.91.181.35
  • 121.32.228.35
  • 121.227.7.35
  • 123.52.189.35
  • 124.225.184.35
  • 116.253.62.35
  • 124.238.241.35
  • 125.74.1.35
malicious
m3.auto.itc.cn
  • 163.177.118.127
  • 220.194.224.234
  • 1.189.213.207
  • 61.176.194.57
  • 121.29.28.194
  • 116.162.13.49
malicious
hqm.stock.sohu.com
  • 110.43.83.35
unknown
d1.biz.itc.cn
  • 163.171.129.134
malicious
643108e7617ef.cdn.sohucs.com
  • 101.33.11.88
  • 101.33.11.48
  • 101.33.10.52
  • 101.33.11.29
  • 101.33.11.45
  • 101.33.11.110
malicious
t4.focus-img.cn
  • 101.33.10.52
  • 101.33.11.88
  • 101.33.11.29
  • 101.33.11.110
  • 101.33.11.48
  • 101.33.11.45
suspicious
fdf24fb6ce298.cdn.sohucs.com
  • 61.176.194.57
  • 220.194.224.234
  • 1.189.213.207
  • 163.177.118.127
  • 121.29.28.194
  • 116.162.13.49
suspicious
t3.focus-img.cn
  • 101.33.11.110
  • 101.33.11.29
  • 101.33.11.45
  • 101.33.11.88
  • 101.33.11.48
  • 101.33.10.52
suspicious
t1.focus-img.cn
  • 101.33.11.45
  • 101.33.11.48
  • 101.33.11.29
  • 101.33.10.52
  • 101.33.11.110
  • 101.33.11.88
suspicious
eclick.baidu.com
  • 110.242.68.137
  • 111.206.208.190
whitelisted
sports.sohu.com
  • 52.169.16.184
  • 52.169.150.217
malicious
i3.itc.cn
  • 163.171.129.134
malicious
i2.itc.cn
  • 163.171.129.134
malicious
i1.itc.cn
  • 101.33.11.29
  • 101.33.10.52
  • 101.33.11.48
  • 101.33.11.88
  • 101.33.11.110
  • 101.33.11.45
malicious
match.sports.sohu.com
  • 110.43.83.43
  • 110.43.83.44
unknown
i0.itc.cn
  • 101.33.11.88
  • 101.33.11.29
  • 101.33.10.52
  • 101.33.11.48
  • 101.33.11.110
  • 101.33.11.45
malicious
dup.baidustatic.com
  • 119.188.176.49
whitelisted
t.focus-img.cn
  • 101.33.11.88
  • 101.33.11.45
  • 101.33.10.52
  • 101.33.11.48
  • 101.33.11.110
  • 101.33.11.29
suspicious
t2.focus-img.cn
  • 101.33.11.45
  • 101.33.11.29
  • 101.33.11.110
  • 101.33.11.48
  • 101.33.10.52
  • 101.33.11.88
suspicious

Threats

No threats detected
No debug info