| URL: | https://bazaar.abuse.ch/browse |
| Full analysis: | https://app.any.run/tasks/7b65aaa8-12da-49e8-9bdc-c0b79a146ad2 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | February 17, 2026, 17:34:43 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MD5: | F3293DE251311D8B2367CA61F83C25BE |
| SHA1: | 0C363EC29154D76C06320818CFFCD565B26A8268 |
| SHA256: | 2F17E8F970D2DBB799C95DA3DD24B98BA85922859FEBEE30D3D89FAE5CC51497 |
| SSDEEP: | 3:N8N0uDWHXKa:23Aaa |
MALICIOUS
Executing a file with an untrusted certificate
- D3D11Install.exe (PID: 7476)
Changes the autorun value in the registry
- D3D11Install.exe (PID: 7476)
VALLEYRAT has been detected (YARA)
- D3D11Install.exe (PID: 7476)
SUSPICIOUS
No suspicious indicators.INFO
Drops script file
- chrome.exe (PID: 7704)
Launching a file from the Downloads directory
- chrome.exe (PID: 7704)
Application launched itself
- chrome.exe (PID: 7704)
Manual execution by a user
- 49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e.exe (PID: 6632)
- 49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e.exe (PID: 1760)
- 49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e.exe (PID: 8264)
- 49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e.exe (PID: 4936)
Checks supported languages
- 49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e.exe (PID: 1760)
- D3D11Install.exe (PID: 7476)
- 49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e.exe (PID: 4936)
Reads the computer name
- 49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e.exe (PID: 1760)
- D3D11Install.exe (PID: 7476)
- 49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e.exe (PID: 4936)
Launching a file from a Registry key
- D3D11Install.exe (PID: 7476)
There is functionality for taking screenshot (YARA)
- D3D11Install.exe (PID: 7476)
Reads Environment values
- D3D11Install.exe (PID: 7476)
Checks proxy server information
- slui.exe (PID: 6200)
Reads product name
- D3D11Install.exe (PID: 7476)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
201
Monitored processes
50
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1136 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=4252,i,14804365768447444831,11851628203302378030,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=3288 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 133.0.6943.127 Modules
| |||||||||||||||
| 1176 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --disable-quic --string-annotations --field-trial-handle=4560,i,14804365768447444831,11851628203302378030,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=4556 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 133.0.6943.127 Modules
| |||||||||||||||
| 1760 | "C:\Users\admin\Desktop\49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e.exe" | C:\Users\admin\Desktop\49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 1872 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1432,i,14804365768447444831,11851628203302378030,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=1840 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 133.0.6943.127 Modules
| |||||||||||||||
| 2256 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=6804,i,14804365768447444831,11851628203302378030,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=6792 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 2256 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=6116,i,14804365768447444831,11851628203302378030,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=6576 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 2352 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=6368,i,14804365768447444831,11851628203302378030,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=4804 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 2684 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=6624,i,14804365768447444831,11851628203302378030,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=6164 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 2760 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3272,i,14804365768447444831,11851628203302378030,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=3440 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 3088 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=2420,i,14804365768447444831,11851628203302378030,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=2432 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 133.0.6943.127 Modules
| |||||||||||||||
Total events
6 005
Read events
5 984
Write events
21
Delete events
0
Modification events
| (PID) Process: | (7992) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (7992) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (7992) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Downloads\chromium_build 1.zip | |||
| (PID) Process: | (7992) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Downloads\49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e.zip | |||
| (PID) Process: | (7992) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (7992) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (7992) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (7992) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (7992) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (7992) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5C0000002B0000001C04000014020000 | |||
Executable files
0
Suspicious files
265
Text files
49
Unknown types
194
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7704 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF1e562c.TMP | — | |
MD5:— | SHA256:— | |||
| 7704 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old~RF1e562c.TMP | — | |
MD5:— | SHA256:— | |||
| 7704 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 7704 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old | — | |
MD5:— | SHA256:— | |||
| 7704 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF1e563c.TMP | — | |
MD5:— | SHA256:— | |||
| 7704 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF1e563c.TMP | — | |
MD5:— | SHA256:— | |||
| 7704 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 7704 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old | — | |
MD5:— | SHA256:— | |||
| 7704 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old~RF1e564b.TMP | — | |
MD5:— | SHA256:— | |||
| 7704 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
229
TCP/UDP connections
114
DNS requests
70
Threats
141
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
9176 | chrome.exe | GET | 307 | 151.101.2.49:443 | https://bazaar.abuse.ch/browse | unknown | — | — | unknown |
9176 | chrome.exe | GET | 200 | 142.250.200.110:80 | http://clients2.google.com/time/1/current?cup2key=8:VMQmhuVPfrEZdG7Mwsfr0VXcGKHUKJjOjKqvLECTPQU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | unknown | — | — | whitelisted |
9176 | chrome.exe | POST | 200 | 142.251.127.84:443 | https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard | unknown | binary | 17 b | whitelisted |
9176 | chrome.exe | GET | 200 | 74.125.206.94:443 | https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=133 | unknown | compressed | 85.6 Kb | whitelisted |
9176 | chrome.exe | GET | 200 | 216.58.215.136:443 | https://www.googletagmanager.com/gtag/js?id=G-5GQV3CJ17N | unknown | binary | 416 Kb | unknown |
9176 | chrome.exe | GET | 200 | 104.19.229.21:443 | https://newassets.hcaptcha.com/captcha/v1/cf4a5d4140f4bade58d5b003e5e849de31474a7b/static/hcaptcha.html | unknown | binary | 556 Kb | unknown |
9176 | chrome.exe | GET | 200 | 151.101.2.49:443 | https://bazaar.abuse.ch/css/bootstrap.min.css | unknown | binary | 152 Kb | unknown |
9176 | chrome.exe | GET | 200 | 104.19.230.21:443 | https://js.hcaptcha.com/1/api.js | unknown | binary | 295 Kb | unknown |
9176 | chrome.exe | GET | 200 | 151.101.2.49:443 | https://bazaar.abuse.ch/css/jumbotron.css | unknown | binary | 107 b | unknown |
9176 | chrome.exe | GET | 200 | 151.101.2.49:443 | https://bazaar.abuse.ch/css/custom.css | unknown | binary | 7.02 Kb | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | Not routed | — | whitelisted |
6696 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3348 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6768 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:138 | — | Not routed | — | whitelisted |
9176 | chrome.exe | 142.250.184.10:443 | safebrowsingohttpgateway.googleapis.com | GOOGLE | US | whitelisted |
9176 | chrome.exe | 142.250.200.110:80 | clients2.google.com | GOOGLE | US | whitelisted |
9176 | chrome.exe | 151.101.2.49:443 | bazaar.abuse.ch | FASTLY | US | whitelisted |
9176 | chrome.exe | 74.125.206.94:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
clients2.google.com |
| whitelisted |
safebrowsingohttpgateway.googleapis.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
bazaar.abuse.ch |
| whitelisted |
accounts.google.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
js.hcaptcha.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
9176 | chrome.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
9176 | chrome.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
9176 | chrome.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
9176 | chrome.exe | Not Suspicious Traffic | INFO [ANY.RUN] hCaptcha Enterprise Challenge |
9176 | chrome.exe | Not Suspicious Traffic | INFO [ANY.RUN] hCaptcha Enterprise Challenge |
6696 | svchost.exe | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |
1760 | 49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e.exe | Potentially Bad Traffic | ET HUNTING Request for EXE via WinHTTP M2 |
1760 | 49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e.exe | Unknown Traffic | ET HUNTING User-Agent Contains Custom String (Example/1.0) |
1760 | 49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e.exe | Potentially Bad Traffic | ET INFO PE EXE or DLL Windows file download HTTP |
1760 | 49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e.exe | Misc activity | ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) |