URL:

https://mega.nz/#!7NsBgKgR!waaErmFSQgSAWCXjDOMAEjy6BQXP3kNcHjtWmSPk_Xs

Full analysis: https://app.any.run/tasks/3d4a9a42-bc4a-444e-87c1-655f47387807
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: December 29, 2019, 02:35:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
adware
Indicators:
MD5:

04AEA24D4688799266B5D32DFCF20B43

SHA1:

E913A01BC4661BA35E397D9F13787A70101DDB2E

SHA256:

307AF0CB2D3D3FDD28987F6C0273D1E972CFC56CCBDB80F520280CD4C0E912CE

SSDEEP:

3:N8X/iGEYWnUgO68wd9cOXQ:29On5OE9Y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • passfab-rar-password-recovery.exe (PID: 1728)
      • passfab-rar-password-recovery.exe (PID: 3112)
      • PassFab for RAR.exe (PID: 3356)
      • TenorshareWinAdService.exe (PID: 3952)

    • Changes settings of System certificates

      • passfab-rar-password-recovery.tmp (PID: 1876)

    • Loads dropped or rewritten executable

      • PassFab for RAR.exe (PID: 3356)

  • SUSPICIOUS

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1752)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3896)
      • passfab-rar-password-recovery.exe (PID: 1728)
      • passfab-rar-password-recovery.tmp (PID: 1876)
      • PassFab for RAR.exe (PID: 3356)

    • Reads the Windows organization settings

      • passfab-rar-password-recovery.tmp (PID: 1876)

    • Reads Windows owner or organization settings

      • passfab-rar-password-recovery.tmp (PID: 1876)

    • Creates files in the user directory

      • passfab-rar-password-recovery.tmp (PID: 1876)
      • PassFab for RAR.exe (PID: 3356)
      • TenorshareWinAdService.exe (PID: 3952)

    • Adds / modifies Windows certificates

      • passfab-rar-password-recovery.tmp (PID: 1876)

    • Starts Internet Explorer

      • passfab-rar-password-recovery.tmp (PID: 1876)

    • Checks for external IP

      • passfab-rar-password-recovery.tmp (PID: 1876)
      • PassFab for RAR.exe (PID: 3356)

    • Starts SC.EXE for service management

      • PassFab for RAR.exe (PID: 3356)

    • Executed as Windows Service

      • TenorshareWinAdService.exe (PID: 3952)

    • Creates files in the Windows directory

      • TenorshareWinAdService.exe (PID: 3952)

    • Removes files from Windows directory

      • TenorshareWinAdService.exe (PID: 3952)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 1752)
      • iexplore.exe (PID: 2820)

    • Manual execution by user

      • passfab-rar-password-recovery.exe (PID: 3112)
      • passfab-rar-password-recovery.exe (PID: 1728)
      • NOTEPAD.EXE (PID: 2836)

    • Application was dropped or rewritten from another process

      • passfab-rar-password-recovery.tmp (PID: 1876)

    • Reads the hosts file

      • chrome.exe (PID: 1752)
      • chrome.exe (PID: 3736)

    • Loads dropped or rewritten executable

      • passfab-rar-password-recovery.tmp (PID: 1876)

    • Creates files in the program directory

      • passfab-rar-password-recovery.tmp (PID: 1876)

    • Creates a software uninstall entry

      • passfab-rar-password-recovery.tmp (PID: 1876)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2428)

    • Changes internet zones settings

      • iexplore.exe (PID: 2820)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2428)

    • Creates files in the user directory

      • iexplore.exe (PID: 2428)

    • Reads settings of System Certificates

      • PassFab for RAR.exe (PID: 3356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
78
Monitored processes
36
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe passfab-rar-password-recovery.exe no specs passfab-rar-password-recovery.exe passfab-rar-password-recovery.tmp iexplore.exe iexplore.exe passfab for rar.exe sc.exe no specs tenorsharewinadservice.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1008,3207724735020144132,8011526629135158438,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=11847992115648189016 --mojo-platform-channel-handle=3852 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
688"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1008,3207724735020144132,8011526629135158438,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=13058765034883831235 --mojo-platform-channel-handle=3864 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
788"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,3207724735020144132,8011526629135158438,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6511510894683057896 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
956"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1008,3207724735020144132,8011526629135158438,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=7409865473681963337 --mojo-platform-channel-handle=3528 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1268"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,3207724735020144132,8011526629135158438,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11232268864695379281 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2252 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1292"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1008,3207724735020144132,8011526629135158438,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=2478923155302415453 --mojo-platform-channel-handle=1228 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1316"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1008,3207724735020144132,8011526629135158438,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=4091398182169095633 --mojo-platform-channel-handle=3884 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1428"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2764 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1484"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1008,3207724735020144132,8011526629135158438,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=3219947599760237481 --mojo-platform-channel-handle=3656 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1728"C:\Users\admin\Desktop\PassFab for RAR 9.3.3.24hthuthuat\passfab-rar-password-recovery.exe" C:\Users\admin\Desktop\PassFab for RAR 9.3.3.24hthuthuat\passfab-rar-password-recovery.exe
explorer.exe
User:
admin
Company:
PassFab, Inc.
Integrity Level:
HIGH
Description:
PassFab for RAR Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\passfab for rar 9.3.3.24hthuthuat\passfab-rar-password-recovery.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
Total events
2 290
Read events
1 988
Write events
290
Delete events
12

Modification events

(PID) Process:(1752) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1752) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1752) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(1752) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(1752) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1428) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:1752-13222060530126750
Value:
259
(PID) Process:(1752) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(1752) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(1752) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:1512-13197841398593750
Value:
0
(PID) Process:(1752) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
45
Suspicious files
66
Text files
377
Unknown types
30

Dropped files

PID
Process
Filename
Type
1752chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\c649f38e-98ca-44a7-bc54-0a86bb98debc.tmp —
MD5:—
SHA256:—
1752chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000020.dbtmp —
MD5:—
SHA256:—
1752chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.oldtext
MD5:—
SHA256:—
1752chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
1752chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
1752chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
1752chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF39991e.TMPtext
MD5:—
SHA256:—
1752chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 —
MD5:—
SHA256:—
1752chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
1752chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.oldtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
65
DNS requests
34
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3952
TenorshareWinAdService.exe
GET
—
173.255.195.56:80
http://www.recover-iphone-contacts.com/ad/ad_stop_iPhoneBackupUnlocker_20160811.txt
US
—
—
malicious
3952
TenorshareWinAdService.exe
GET
—
173.255.195.56:80
http://www.recover-iphone-contacts.com/ad/ad_addr_iPhoneBackupUnlocker_20160811.txt
US
—
—
malicious
3736
chrome.exe
GET
302
172.217.16.142:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
510 b
whitelisted
3736
chrome.exe
GET
302
172.217.16.142:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
515 b
whitelisted
1876
passfab-rar-password-recovery.tmp
GET
200
208.95.112.1:80
http://ip-api.com/csv
unknown
text
146 b
malicious
1876
passfab-rar-password-recovery.tmp
GET
200
104.24.104.176:8080
http://recoverlostpassword.com:8080/AddUserInfo?guid=91BC77B0-E592-45CE-8253-41D43C03E4CD&IP=192.168.100.137&ComputerName=USER-PC&SystemVersion=Windows%207%20x32&Location=Denmark&City=Forlev&OutIP=82.103.130.125
US
text
8 b
shared
3356
PassFab for RAR.exe
GET
200
104.24.104.176:8080
http://recoverlostpassword.com:8080/QueryUser?guid=91BC77B0-E592-45CE-8253-41D43C03E4CD
US
text
8 b
shared
3952
TenorshareWinAdService.exe
GET
301
104.26.10.12:80
http://download.tenorshare.com/downloads/service/ReibootSvVersion.txt
US
html
278 b
suspicious
3356
PassFab for RAR.exe
GET
200
208.95.112.1:80
http://ip-api.com/csv
unknown
text
146 b
malicious
3736
chrome.exe
GET
200
173.194.163.91:80
http://r5---sn-5go7ynez.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx?cms_redirect=yes&mip=82.103.130.125&mm=28&mn=sn-5go7ynez&ms=nvh&mt=1577586453&mv=u&mvi=4&pl=26&shardbypass=yes
US
crx
293 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3736
chrome.exe
216.58.205.227:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3736
chrome.exe
89.44.169.133:443
mega.nz
Datacenter Luxembourg S.A.
LU
unknown
3736
chrome.exe
172.217.22.13:443
accounts.google.com
Google Inc.
US
whitelisted
3736
chrome.exe
172.217.18.10:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3736
chrome.exe
172.217.16.206:443
clients1.google.com
Google Inc.
US
whitelisted
3736
chrome.exe
89.44.169.132:443
eu.static.mega.co.nz
Datacenter Luxembourg S.A.
LU
suspicious
3736
chrome.exe
172.217.21.206:443
clients2.google.com
Google Inc.
US
whitelisted
3736
chrome.exe
172.217.16.142:80
redirector.gvt1.com
Google Inc.
US
whitelisted
3736
chrome.exe
173.194.163.91:80
r5---sn-5go7ynez.gvt1.com
Google Inc.
US
whitelisted
3736
chrome.exe
31.216.147.136:443
g.api.mega.co.nz
Datacenter Luxembourg S.A.
LU
shared

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 216.58.205.227
whitelisted
mega.nz
  • 89.44.169.133
  • 89.44.169.135
  • 31.216.148.10
whitelisted
accounts.google.com
  • 172.217.22.13
shared
safebrowsing.googleapis.com
  • 172.217.18.10
whitelisted
clients1.google.com
  • 172.217.16.206
whitelisted
eu.static.mega.co.nz
  • 89.44.169.132
  • 31.216.148.13
  • 89.44.169.134
  • 31.216.148.11
shared
clients2.google.com
  • 172.217.21.206
whitelisted
redirector.gvt1.com
  • 172.217.16.142
whitelisted
r5---sn-5go7ynez.gvt1.com
  • 173.194.163.91
whitelisted
g.api.mega.co.nz
  • 31.216.147.136
  • 31.216.147.133
  • 31.216.147.135
  • 31.216.147.134
shared

Threats

PID
Process
Class
Message
1876
passfab-rar-password-recovery.tmp
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
1876
passfab-rar-password-recovery.tmp
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
1876
passfab-rar-password-recovery.tmp
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
1876
passfab-rar-password-recovery.tmp
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
1876
passfab-rar-password-recovery.tmp
Misc activity
ADWARE [PTsecurity] Adware.AdAnti
3356
PassFab for RAR.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
3356
PassFab for RAR.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
12 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://mega.nz/#!7NsBgKgR!waaErmFSQgSAWCXjDOMAEjy6BQXP3kNcHjtWmSPk_Xs