analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://wetransfer.com/downloads/876b976cdfd2bcfa38d8d5317d9db7a820200526160921/7f559d

Full analysis: https://app.any.run/tasks/4ddf32ff-ea61-4683-b325-15e1415f4b6d
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: May 30, 2020, 02:24:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
autoit
evasion
Indicators:
MD5:

AC63D31D6C9955296592519C1EE4B876

SHA1:

C77400110BF149DE09337400B9550087D5FB1668

SHA256:

2D11FFD32E5C8137FC4D960C890BF2A7A5B542F7B35570E64C91B4792A6E9722

SSDEEP:

3:N8RCYKMXKdgDaODdBEdXlehJB:2EYNaaBBu0LB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 2844)
      • reg.exe (PID: 2520)
      • reg.exe (PID: 2864)
      • reg.exe (PID: 2844)
      • reg.exe (PID: 2372)
      • reg.exe (PID: 2752)
      • reg.exe (PID: 2076)
      • reg.exe (PID: 3488)
      • reg.exe (PID: 2604)
      • reg.exe (PID: 2184)
      • reg.exe (PID: 3712)
      • reg.exe (PID: 2424)
      • reg.exe (PID: 2628)
      • reg.exe (PID: 1916)
      • reg.exe (PID: 852)
      • reg.exe (PID: 1836)

    • Application was dropped or rewritten from another process

      • node.exe (PID: 2568)
      • cmd_shell.exe (PID: 2172)
      • cmd.exe (PID: 3256)
      • explorer.exe (PID: 2788)
      • cmd.exe (PID: 1228)
      • cmd_shell.exe (PID: 2680)
      • node.exe (PID: 3656)
      • cmd.exe (PID: 2456)
      • cmd.exe (PID: 3008)
      • node.exe (PID: 2656)
      • cmd_shell.exe (PID: 3812)
      • cmd.exe (PID: 1896)
      • explorer.exe (PID: 2976)
      • cmd.exe (PID: 628)
      • explorer.exe (PID: 3852)
      • cmd.exe (PID: 2564)
      • node.exe (PID: 2872)
      • explorer.exe (PID: 2624)
      • cmd.exe (PID: 308)
      • cmd.exe (PID: 2732)
      • cmd.exe (PID: 2736)
      • cmd.exe (PID: 2596)
      • cmd.exe (PID: 2516)
      • cmd.exe (PID: 3188)
      • cmd.exe (PID: 2468)
      • cmd.exe (PID: 2336)
      • zoom.exe (PID: 728)
      • cmd.exe (PID: 3416)
      • cmd.exe (PID: 3388)
      • Installer.exe (PID: 2204)
      • Installer.exe (PID: 1992)
      • Zoom.exe (PID: 324)
      • cmd.exe (PID: 4080)
      • node.exe (PID: 2900)
      • explorer.exe (PID: 3036)
      • cmd.exe (PID: 2376)
      • cmd.exe (PID: 1552)
      • cmd.exe (PID: 1868)
      • node.exe (PID: 2412)
      • node.exe (PID: 2156)
      • cmd.exe (PID: 2592)
      • explorer.exe (PID: 3436)
      • cmd.exe (PID: 3300)
      • zoom.exe (PID: 3240)
      • explorer.exe (PID: 2452)
      • Installer.exe (PID: 2856)
      • Zoom.exe (PID: 2200)
      • unzip.exe (PID: 1924)
      • cmd.exe (PID: 1108)
      • cmd_shell.exe (PID: 3936)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 3456)
      • node.exe (PID: 3188)
      • cmd.exe (PID: 3596)
      • explorer.exe (PID: 3796)
      • Zoom.exe (PID: 3108)
      • Zoom.exe (PID: 564)
      • cmd.exe (PID: 1356)
      • node.exe (PID: 3860)
      • cmd.exe (PID: 2508)
      • cmd.exe (PID: 2860)
      • explorer.exe (PID: 2388)
      • cmd.exe (PID: 3064)
      • node.exe (PID: 2284)
      • cmd.exe (PID: 588)
      • node.exe (PID: 2896)
      • explorer.exe (PID: 2260)
      • explorer.exe (PID: 3332)
      • cmd.exe (PID: 2616)
      • cmd.exe (PID: 3964)
      • cmd.exe (PID: 3776)
      • cmd.exe (PID: 884)
      • python.exe (PID: 3728)
      • python.exe (PID: 3320)
      • cmd.exe (PID: 1336)
      • python.exe (PID: 908)
      • python.exe (PID: 2488)
      • cmd.exe (PID: 3356)
      • Zoom.exe (PID: 2880)
      • python.exe (PID: 1400)
      • Zoom.exe (PID: 292)
      • python.exe (PID: 2080)
      • cmd.exe (PID: 3376)
      • python.exe (PID: 2520)
      • cmd.exe (PID: 4032)
      • cmd.exe (PID: 1256)
      • node.exe (PID: 2748)
      • cmd.exe (PID: 1708)
      • explorer.exe (PID: 3184)
      • cmd.exe (PID: 3384)
      • python.exe (PID: 3580)
      • node.exe (PID: 2164)
      • explorer.exe (PID: 1340)
      • cmd.exe (PID: 2668)
      • cmd.exe (PID: 2676)
      • cmd.exe (PID: 2604)
      • Zoom.exe (PID: 3000)
      • python.exe (PID: 3164)
      • python.exe (PID: 2288)
      • python.exe (PID: 3964)
      • cmd.exe (PID: 3960)
      • cmd.exe (PID: 4068)
      • node.exe (PID: 3532)
      • cmd.exe (PID: 2764)
      • explorer.exe (PID: 1144)
      • node.exe (PID: 3864)
      • cmd.exe (PID: 3328)
      • cmd.exe (PID: 2648)
      • cmd.exe (PID: 664)
      • python.exe (PID: 3816)
      • python.exe (PID: 3248)
      • explorer.exe (PID: 2812)
      • cmd.exe (PID: 2500)
      • Installer.exe (PID: 3952)
      • python.exe (PID: 3272)
      • cmd.exe (PID: 2356)
      • python.exe (PID: 2864)
      • cmd.exe (PID: 4016)
      • python.exe (PID: 2316)
      • python.exe (PID: 2264)
      • python.exe (PID: 636)
      • cmd.exe (PID: 1020)
      • python.exe (PID: 488)
      • Zoom.exe (PID: 3040)
      • cmd.exe (PID: 2884)
      • cmd.exe (PID: 884)
      • python.exe (PID: 2240)
      • python.exe (PID: 2396)
      • python.exe (PID: 3536)
      • python.exe (PID: 1408)
      • cmd.exe (PID: 2212)
      • python.exe (PID: 3536)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 308)
      • cmd.exe (PID: 2468)
      • cmd.exe (PID: 3456)

    • Actions looks like stealing of personal data

      • Installer.exe (PID: 1992)
      • Installer.exe (PID: 2856)
      • unzip.exe (PID: 1924)
      • Installer.exe (PID: 3952)

    • Loads dropped or rewritten executable

      • Zoom.exe (PID: 324)
      • Installer.exe (PID: 1992)
      • Installer.exe (PID: 2856)
      • Zoom.exe (PID: 2200)
      • Zoom.exe (PID: 3108)
      • Zoom.exe (PID: 564)
      • python.exe (PID: 3728)
      • python.exe (PID: 3320)
      • python.exe (PID: 2488)
      • python.exe (PID: 908)
      • Zoom.exe (PID: 292)
      • python.exe (PID: 1400)
      • Zoom.exe (PID: 2880)
      • python.exe (PID: 2520)
      • python.exe (PID: 3580)
      • python.exe (PID: 2080)
      • python.exe (PID: 3164)
      • Zoom.exe (PID: 3000)
      • python.exe (PID: 2288)
      • python.exe (PID: 3964)
      • python.exe (PID: 3816)
      • python.exe (PID: 3248)
      • python.exe (PID: 2316)
      • python.exe (PID: 488)
      • python.exe (PID: 2864)
      • python.exe (PID: 3272)
      • python.exe (PID: 636)
      • python.exe (PID: 2264)
      • Installer.exe (PID: 3952)
      • Zoom.exe (PID: 3040)
      • python.exe (PID: 2396)
      • python.exe (PID: 2240)
      • python.exe (PID: 3536)
      • python.exe (PID: 3536)

    • Changes settings of System certificates

      • cscript.exe (PID: 3316)
      • cscript.exe (PID: 2428)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1548)
      • cmd_shell.exe (PID: 2172)
      • WinRAR.exe (PID: 936)
      • cmd.exe (PID: 2456)
      • cmd.exe (PID: 1228)
      • zoom.exe (PID: 728)
      • cmd.exe (PID: 4080)
      • cscript.exe (PID: 3316)
      • Installer.exe (PID: 1992)
      • zoom.exe (PID: 3240)
      • cmd.exe (PID: 2268)
      • unzip.exe (PID: 1924)
      • Installer.exe (PID: 2856)
      • Zoom.exe (PID: 2200)
      • cmd.exe (PID: 1256)
      • Installer.exe (PID: 3952)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1196)

    • Executes scripts

      • cmd_shell.exe (PID: 2172)
      • cmd_shell.exe (PID: 2680)
      • cmd_shell.exe (PID: 3812)
      • cmd.exe (PID: 308)
      • cmd.exe (PID: 2468)
      • cmd_shell.exe (PID: 3936)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 1228)
      • cmd.exe (PID: 2456)
      • cmd.exe (PID: 628)
      • cmd.exe (PID: 1896)
      • cmd.exe (PID: 308)
      • cmd.exe (PID: 1552)
      • cmd.exe (PID: 4080)
      • cmd.exe (PID: 2376)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 1356)
      • cmd.exe (PID: 2508)
      • cmd.exe (PID: 3064)
      • cmd.exe (PID: 1256)
      • cmd.exe (PID: 3384)
      • cmd.exe (PID: 3960)
      • cmd.exe (PID: 3328)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 2908)
      • node.exe (PID: 2568)
      • WScript.exe (PID: 2168)
      • node.exe (PID: 2656)
      • node.exe (PID: 3656)
      • WScript.exe (PID: 3664)
      • node.exe (PID: 2872)
      • WinRAR.exe (PID: 936)
      • cmd.exe (PID: 308)
      • WScript.exe (PID: 2184)
      • cmd.exe (PID: 2468)
      • node.exe (PID: 2900)
      • node.exe (PID: 2412)
      • node.exe (PID: 2156)
      • cmd.exe (PID: 3456)
      • WScript.exe (PID: 3112)
      • node.exe (PID: 3188)
      • node.exe (PID: 3860)
      • node.exe (PID: 2284)
      • node.exe (PID: 2896)
      • cmd.exe (PID: 884)
      • node.exe (PID: 2748)
      • node.exe (PID: 2164)
      • node.exe (PID: 3864)
      • node.exe (PID: 3532)

    • Writes files like Keylogger logs

      • WinRAR.exe (PID: 936)
      • cmd.exe (PID: 308)

    • Application launched itself

      • WinRAR.exe (PID: 1548)
      • cmd.exe (PID: 308)
      • Installer.exe (PID: 1992)
      • cmd.exe (PID: 2468)
      • cmd.exe (PID: 3456)
      • Zoom.exe (PID: 2200)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 1228)
      • cmd.exe (PID: 2456)
      • cmd.exe (PID: 628)
      • cmd.exe (PID: 1896)
      • cmd.exe (PID: 308)
      • cmd.exe (PID: 1552)
      • cmd.exe (PID: 4080)
      • cmd.exe (PID: 2376)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 1356)
      • cmd.exe (PID: 2508)
      • cmd.exe (PID: 3064)
      • cmd.exe (PID: 3384)
      • cmd.exe (PID: 1256)
      • cmd.exe (PID: 3960)
      • cmd.exe (PID: 3328)

    • Creates executable files which already exist in Windows

      • cmd.exe (PID: 1228)

    • Uses TASKLIST.EXE to query information about running processes

      • cmd.exe (PID: 2596)
      • cmd.exe (PID: 2736)
      • cmd.exe (PID: 3188)
      • cmd.exe (PID: 2336)
      • cmd.exe (PID: 1108)

    • Changes IE settings (feature browser emulation)

      • Installer.exe (PID: 1992)
      • Installer.exe (PID: 2856)
      • Installer.exe (PID: 3952)

    • Modifies the open verb of a shell class

      • Installer.exe (PID: 1992)
      • Installer.exe (PID: 2856)
      • Installer.exe (PID: 3952)

    • Creates a software uninstall entry

      • Installer.exe (PID: 1992)
      • Installer.exe (PID: 2856)
      • Installer.exe (PID: 3952)

    • Creates files in the user directory

      • Zoom.exe (PID: 324)
      • Installer.exe (PID: 1992)
      • Zoom.exe (PID: 2200)
      • Zoom.exe (PID: 3108)
      • Zoom.exe (PID: 564)
      • Installer.exe (PID: 2856)
      • Zoom.exe (PID: 292)
      • Zoom.exe (PID: 2880)
      • Zoom.exe (PID: 3000)
      • Installer.exe (PID: 3952)
      • Zoom.exe (PID: 3040)

    • Drop AutoIt3 executable file

      • unzip.exe (PID: 1924)

    • Uses WMIC.EXE to obtain a list of AntiViruses

      • cmd.exe (PID: 2468)

    • Uses WMIC.EXE to obtain a system information

      • cmd.exe (PID: 2468)

    • Checks for external IP

      • python.exe (PID: 3728)
      • python.exe (PID: 2488)
      • python.exe (PID: 2520)
      • python.exe (PID: 2288)
      • python.exe (PID: 3248)
      • python.exe (PID: 3272)
      • python.exe (PID: 2264)
      • python.exe (PID: 3536)

    • Loads Python modules

      • python.exe (PID: 3728)
      • python.exe (PID: 3320)
      • python.exe (PID: 908)
      • python.exe (PID: 2488)
      • python.exe (PID: 1400)
      • python.exe (PID: 2520)
      • python.exe (PID: 2080)
      • python.exe (PID: 3580)
      • python.exe (PID: 3164)
      • python.exe (PID: 2288)
      • python.exe (PID: 3816)
      • python.exe (PID: 3964)
      • python.exe (PID: 3248)
      • python.exe (PID: 488)
      • python.exe (PID: 2316)
      • python.exe (PID: 3272)
      • python.exe (PID: 2864)
      • python.exe (PID: 2264)
      • python.exe (PID: 636)
      • python.exe (PID: 2240)
      • python.exe (PID: 2396)
      • python.exe (PID: 3536)
      • python.exe (PID: 3536)

    • Adds / modifies Windows certificates

      • cscript.exe (PID: 3316)
      • cscript.exe (PID: 2428)

  • INFO

    • Reads Internet Cache Settings

      • chrome.exe (PID: 1196)

    • Reads the hosts file

      • chrome.exe (PID: 2436)
      • chrome.exe (PID: 1196)

    • Application launched itself

      • chrome.exe (PID: 1196)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2436)
      • Installer.exe (PID: 1992)
      • cscript.exe (PID: 2428)
      • Installer.exe (PID: 3952)

    • Dropped object may contain Bitcoin addresses

      • Installer.exe (PID: 1992)
      • Installer.exe (PID: 2856)
      • unzip.exe (PID: 1924)
      • Installer.exe (PID: 3952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
299
Monitored processes
237
Malicious processes
61
Suspicious processes
48

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe winrar.exe chrome.exe no specs cmd_shell.exe wscript.exe no specs cmd.exe attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs chrome.exe no specs cmd_shell.exe no specs wscript.exe no specs cmd.exe attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs cmd_shell.exe no specs wscript.exe no specs cmd.exe no specs attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs cmd.exe no specs explorer.exe no specs attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs cmd.exe no specs ping.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs attrib.exe no specs reg.exe cmd.exe no specs hostname.exe no specs wscript.exe no specs cmd.exe no specs ping.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs hostname.exe no specs cmd.exe no specs ping.exe no specs ping.exe no specs zoom.exe installer.exe cscript.exe installer.exe zoom.exe no specs cmd.exe attrib.exe no specs attrib.exe no specs reg.exe node.exe cscript.exe cmd.exe no specs explorer.exe no specs cmd.exe no specs attrib.exe no specs attrib.exe no specs reg.exe cmd.exe no specs node.exe attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs cmd.exe no specs explorer.exe no specs zoom.exe installer.exe zoom.exe unzip.exe cmd.exe no specs ping.exe no specs cmd.exe no specs tasklist.exe no specs cmd_shell.exe no specs wscript.exe no specs cmd.exe attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs zoom.exe no specs zoom.exe cmd.exe no specs attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs cmd.exe no specs attrib.exe no specs attrib.exe no specs reg.exe cmd.exe no specs node.exe attrib.exe no specs attrib.exe no specs reg.exe cmd.exe no specs node.exe explorer.exe no specs cmd.exe no specs explorer.exe no specs wmic.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs python.exe ping.exe no specs python.exe cmd.exe no specs python.exe cmd.exe no specs python.exe ping.exe no specs python.exe zoom.exe no specs zoom.exe cmd.exe no specs python.exe cmd.exe no specs python.exe ping.exe no specs cmd.exe attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs python.exe cmd.exe no specs attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs cmd.exe no specs python.exe zoom.exe no specs cmd.exe no specs python.exe ping.exe no specs python.exe cmd.exe no specs attrib.exe no specs attrib.exe no specs reg.exe cmd.exe no specs node.exe cmd.exe no specs attrib.exe no specs python.exe attrib.exe no specs reg.exe cmd.exe no specs node.exe explorer.exe no specs cmd.exe no specs explorer.exe no specs cmd.exe no specs python.exe ping.exe no specs python.exe cmd.exe no specs python.exe installer.exe cmd.exe no specs python.exe ping.exe no specs python.exe cmd.exe no specs python.exe cmd.exe no specs python.exe ping.exe no specs zoom.exe no specs python.exe cmd.exe no specs python.exe cmd.exe no specs python.exe ping.exe no specs python.exe cmd.exe no specs python.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1196"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://wetransfer.com/downloads/876b976cdfd2bcfa38d8d5317d9db7a820200526160921/7f559d"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3496"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6e2ea9d0,0x6e2ea9e0,0x6e2ea9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
2272"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2136 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
1572"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1020,578327721972979185,12355453846456473591,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=9371596152157243353 --mojo-platform-channel-handle=972 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
2436"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1020,578327721972979185,12355453846456473591,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=1858391770274772516 --mojo-platform-channel-handle=1556 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3192"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1020,578327721972979185,12355453846456473591,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13649216067057718523 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
2404"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1020,578327721972979185,12355453846456473591,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8042857871749317235 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
2524"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1020,578327721972979185,12355453846456473591,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=612366000377259250 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
2688"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1020,578327721972979185,12355453846456473591,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=613884117640731797 --mojo-platform-channel-handle=3644 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
2828"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1020,578327721972979185,12355453846456473591,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13638907659054337040 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
Total events
14 066
Read events
6 634
Write events
0
Delete events
0

Modification events

No data
Executable files
333
Suspicious files
154
Text files
2 143
Unknown types
1 187

Dropped files

PID
Process
Filename
Type
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5ED1C3D4-4AC.pma —
MD5:—
SHA256:—
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\abca5d17-892e-40b8-84af-66dec475fe07.tmp —
MD5:—
SHA256:—
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Last Tabsbinary
MD5:702AEC53DCDCFEA33C4BE3D2F888473E
SHA256:D16286D6EE0EB33E7907EE4FCB8FDB6B5A54E5A56BFAF99A9C2451D239BC9765
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:DA692BE42E4EF2668AE7499A7D5DA720
SHA256:EB865CAF59002C092F5FDBE22D01935866BC1277108B29E897052CB2439630ED
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF1298ae.TMPtext
MD5:F69C20D5B552B8D973FB1CBA5FDD7D87
SHA256:48799968D50E2D74E625A0AB18E93C6792AF20010334C6BB4E935C8D26F7026A
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:AC43135B8C9FED46A92448C4E711F45C
SHA256:D840BA7CEBACF86DDBAD75BFB61A53449AA7AE3DE6B8ADC97FE45624626A6F09
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RF1298ec.TMPtext
MD5:AC43135B8C9FED46A92448C4E711F45C
SHA256:D840BA7CEBACF86DDBAD75BFB61A53449AA7AE3DE6B8ADC97FE45624626A6F09
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:33B05E8AC9C178C58ED3321F496588C0
SHA256:2CDF6A09638A0B563EA2672D6926210771902E0A9203FE15D2857FC4EB954CDE
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF1298cd.TMPtext
MD5:33B05E8AC9C178C58ED3321F496588C0
SHA256:2CDF6A09638A0B563EA2672D6926210771902E0A9203FE15D2857FC4EB954CDE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
112
DNS requests
51
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2436
chrome.exe
GET
200
173.194.5.203:80
http://r5---sn-aigl6n76.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjY5QUFXTEQwc2RPVXhRY3picjhxblh1dw/7619.603.0.2_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mh=Qx&mip=185.217.117.39&mm=28&mn=sn-aigl6n76&ms=nvh&mt=1590805451&mv=m&mvi=4&pl=25&shardbypass=yes
US
crx
816 Kb
whitelisted
1992
Installer.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAUQxrL%2FercceG71ciObEkM%3D
US
der
471 b
whitelisted
3728
python.exe
GET
200
216.239.32.21:80
http://myexternalip.com/raw
US
text
14 b
shared
1992
Installer.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAb9%2BQOWA63qAArrPye7uhs%3D
US
der
471 b
whitelisted
2520
python.exe
GET
200
216.239.32.21:80
http://myexternalip.com/raw
US
text
14 b
shared
2288
python.exe
GET
200
216.239.32.21:80
http://myexternalip.com/raw
US
text
14 b
shared
1992
Installer.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFDxAmS5JEAmWxO0Ue9OdQ9z7zPAQUFQASKxOYspkH7R7for5XDStnAs0CEAMBmgI6%2F1ixa9bV6uYX8GY%3D
US
der
471 b
whitelisted
2436
chrome.exe
GET
302
172.217.23.174:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
520 b
whitelisted
3248
python.exe
GET
200
216.239.32.21:80
http://myexternalip.com/raw
US
text
14 b
shared
3536
python.exe
GET
200
216.239.32.21:80
http://myexternalip.com/raw
US
text
14 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2436
chrome.exe
172.217.18.163:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2436
chrome.exe
143.204.201.32:443
prod-cdn.wetransfer.net
—
US
suspicious
2436
chrome.exe
18.203.189.72:443
wtplus.wetransfer.com
—
US
unknown
2436
chrome.exe
54.76.5.44:443
wetransfer.com
Amazon.com, Inc.
IE
unknown
2436
chrome.exe
13.35.254.95:443
backgrounds.wetransfer.net
—
US
suspicious
2436
chrome.exe
216.58.212.141:443
accounts.google.com
Google Inc.
US
whitelisted
2436
chrome.exe
13.35.254.86:443
assets.wetransfer.net
—
US
malicious
2436
chrome.exe
107.22.209.192:443
e-10220.adzerk.net
Amazon.com, Inc.
US
unknown
2436
chrome.exe
52.218.84.145:443
wetransferbackgrounds-eu.s3.amazonaws.com
Amazon.com, Inc.
IE
unknown
2436
chrome.exe
172.217.18.14:443
clients2.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
wetransfer.com
  • 54.76.5.44
  • 34.240.21.9
  • 52.17.149.98
shared
clientservices.googleapis.com
  • 172.217.18.163
whitelisted
accounts.google.com
  • 216.58.212.141
shared
prod-cdn.wetransfer.net
  • 143.204.201.32
  • 143.204.201.29
  • 143.204.201.67
  • 143.204.201.39
whitelisted
wtplus.wetransfer.com
  • 18.203.189.72
  • 34.249.238.110
shared
backgrounds.wetransfer.net
  • 13.35.254.95
  • 13.35.254.93
  • 13.35.254.101
  • 13.35.254.10
whitelisted
e-10220.adzerk.net
  • 107.22.209.192
  • 23.21.191.38
  • 107.22.194.221
  • 54.204.18.46
  • 54.225.139.53
  • 23.21.55.35
  • 54.225.183.184
  • 54.225.222.84
whitelisted
assets.wetransfer.net
  • 13.35.254.86
  • 13.35.254.44
  • 13.35.254.105
  • 13.35.254.82
whitelisted
wetransferbackgrounds-eu.s3.amazonaws.com
  • 52.218.84.145
shared
d19ptbnuzhibkh.cloudfront.net
  • 13.35.253.106
  • 13.35.253.90
  • 13.35.253.201
  • 13.35.253.48
whitelisted

Threats

PID
Process
Class
Message
1060
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1060
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1060
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
3728
python.exe
Potential Corporate Privacy Violation
ET POLICY External IP Check myexternalip.com
3728
python.exe
Attempted Information Leak
ET POLICY Python-urllib/ Suspicious User Agent
1060
svchost.exe
Not Suspicious Traffic
ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)
3320
python.exe
Not Suspicious Traffic
ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com)
908
python.exe
Not Suspicious Traffic
ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com)
2488
python.exe
Potential Corporate Privacy Violation
ET POLICY External IP Check myexternalip.com
2488
python.exe
Attempted Information Leak
ET POLICY Python-urllib/ Suspicious User Agent
Process
Message
Installer.exe
C:\Users\admin\AppData\Roaming\Zoom\zoom_install_sr~
Installer.exe
C:\Users\admin\AppData\Roaming\Zoom\zoom_install_src
Installer.exe
Installer.exe
[ProductPathHelper::RecursiveRemoveDirA] Path is:
Installer.exe
C:\Users\admin\AppData\Roaming\Zoom\uninstall
Installer.exe
Installer.exe
[ProductPathHelper::RecursiveRemoveDirA] Path is:
Installer.exe
C:\Users\admin\AppData\Roaming\Zoom\bin
Installer.exe
Installer.exe
[CZoomProductPathHelper::RecursiveRemoveDirA] Path is:
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://wetransfer.com/downloads/876b976cdfd2bcfa38d8d5317d9db7a820200526160921/7f559d