URL:

https://linkvertise.download/download/93270/OpBeeSwarmGUI/V2LqVwOGvM7xh5gh1CUsQWtyCjIsYKeU

Full analysis: https://app.any.run/tasks/2fb25b24-3261-4b4b-8a8f-19781f5b9e12
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: November 29, 2020, 18:12:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
Indicators:
MD5:

F6122BF15933D22CE10A5E22FEF87BDE

SHA1:

96E56B96E1EC2ACF1AF61EC1E39272A7FD064E14

SHA256:

387574FB4B4E52D0279638EC6ABB08A35E1EBABABB7BFBBCA9D7832E2672AB10

SSDEEP:

3:N8MLRBXA1zKXXJkcH1snYXpqSqwWuE0:2MNi1zorynYPqME0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 1268)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2884)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2824)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2940)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3204)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3808)

    • Loads dropped or rewritten executable

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2884)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3204)

    • Actions looks like stealing of personal data

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2884)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3204)

  • SUSPICIOUS

    • Application launched itself

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 1268)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3808)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2940)

    • Cleans NTFS data-stream (Zone Identifier)

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 1268)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2944)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2884)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3204)

    • Drops a file that was compiled in debug mode

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2884)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3204)

    • Reads Environment values

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2884)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3204)

    • Reads internet explorer settings

      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 2884)
      • Bee Swarm GUI - Linkvertise Downloader_3829900224.exe (PID: 3204)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 2944)
      • chrome.exe (PID: 1480)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2944)
      • chrome.exe (PID: 1480)

    • Application launched itself

      • chrome.exe (PID: 2944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
83
Monitored processes
40
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs bee swarm gui - linkvertise downloader_3829900224.exe no specs bee swarm gui - linkvertise downloader_3829900224.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs bee swarm gui - linkvertise downloader_3829900224.exe no specs bee swarm gui - linkvertise downloader_3829900224.exe no specs bee swarm gui - linkvertise downloader_3829900224.exe bee swarm gui - linkvertise downloader_3829900224.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
252"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,2641415989479859317,2836710760748956037,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10161138457602108171 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
272"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,2641415989479859317,2836710760748956037,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11138362907580588793 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
680"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,2641415989479859317,2836710760748956037,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=52845715683128836 --mojo-platform-channel-handle=1048 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
700"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2344 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
768"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,2641415989479859317,2836710760748956037,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=18419957772315842942 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1060"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,2641415989479859317,2836710760748956037,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3115380474609368927 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1132"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,2641415989479859317,2836710760748956037,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11661054817594945459 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1268"C:\Users\admin\Downloads\Bee Swarm GUI - Linkvertise Downloader_3829900224.exe" C:\Users\admin\Downloads\Bee Swarm GUI - Linkvertise Downloader_3829900224.exe—chrome.exe
User:
admin
Company:
Posi
Integrity Level:
MEDIUM
Description:
Dapocub Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\downloads\bee swarm gui - linkvertise downloader_3829900224.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1480"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1040,2641415989479859317,2836710760748956037,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=1692724429807722072 --mojo-platform-channel-handle=1456 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1652"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,2641415989479859317,2836710760748956037,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16302385636783139873 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=952 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
2 643
Read events
2 502
Write events
138
Delete events
3

Modification events

(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3252-13245750958665039
Value:
0
(PID) Process:(2944) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:2944-13251147165454875
Value:
259
Executable files
9
Suspicious files
109
Text files
202
Unknown types
2

Dropped files

PID
Process
Filename
Type
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FC3E49E-B80.pma —
MD5:—
SHA256:—
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\b824b757-0cfe-4af6-b5ef-bb84c99cf69a.tmp —
MD5:—
SHA256:—
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp —
MD5:—
SHA256:—
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:—
SHA256:—
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF18d28d.TMPtext
MD5:—
SHA256:—
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Last Tabsbinary
MD5:—
SHA256:—
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
2944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF18d481.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
209
DNS requests
138
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1480
chrome.exe
GET
301
104.23.99.190:80
http://pastebin.com/
US
—
—
malicious
2884
Bee Swarm GUI - Linkvertise Downloader_3829900224.exe
POST
200
143.204.214.227:80
http://d2xxggpsucitu8.cloudfront.net/
US
—
—
whitelisted
1480
chrome.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAP%2B7xu1tkg0miCVD4vGl1M%3D
US
der
471 b
whitelisted
2884
Bee Swarm GUI - Linkvertise Downloader_3829900224.exe
POST
200
143.204.214.227:80
http://d2xxggpsucitu8.cloudfront.net/
US
—
—
whitelisted
2884
Bee Swarm GUI - Linkvertise Downloader_3829900224.exe
POST
200
143.204.214.120:80
http://d3qhhf7ctrg6s8.cloudfront.net/
US
binary
778 Kb
whitelisted
1480
chrome.exe
GET
301
5.255.90.119:80
http://kaas.gg/
NL
html
224 b
suspicious
2884
Bee Swarm GUI - Linkvertise Downloader_3829900224.exe
POST
200
143.204.214.227:80
http://d2xxggpsucitu8.cloudfront.net/
US
—
—
whitelisted
3204
Bee Swarm GUI - Linkvertise Downloader_3829900224.exe
POST
200
143.204.214.227:80
http://d2xxggpsucitu8.cloudfront.net/
US
—
—
whitelisted
3204
Bee Swarm GUI - Linkvertise Downloader_3829900224.exe
POST
200
143.204.214.12:80
http://d282ck67otpvhq.cloudfront.net/
US
text
1.11 Kb
whitelisted
3204
Bee Swarm GUI - Linkvertise Downloader_3829900224.exe
POST
200
143.204.214.227:80
http://d2xxggpsucitu8.cloudfront.net/
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1480
chrome.exe
195.181.175.52:443
maxst.icons8.com
Datacamp Limited
DE
suspicious
1480
chrome.exe
104.108.144.24:443
contextual.media.net
TOT Public Company Limited
US
unknown
1480
chrome.exe
172.217.21.195:443
fonts.gstatic.com
Google Inc.
US
whitelisted
1480
chrome.exe
104.16.18.94:443
cdnjs.cloudflare.com
Cloudflare Inc
US
unknown
1480
chrome.exe
209.197.3.15:443
stackpath.bootstrapcdn.com
Highwinds Network Group, Inc.
US
whitelisted
1480
chrome.exe
172.217.12.170:443
fonts.googleapis.com
Google Inc.
US
whitelisted
1480
chrome.exe
172.217.23.110:443
www.google-analytics.com
Google Inc.
US
whitelisted
1480
chrome.exe
104.108.64.33:443
sb.scorecardresearch.com
Akamai Technologies, Inc.
NL
unknown
1480
chrome.exe
13.107.5.80:443
api.bing.com
Microsoft Corporation
US
whitelisted
1480
chrome.exe
35.190.80.1:443
a.nel.cloudflare.com
Google Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
linkvertise.download
  • 172.67.172.25
  • 104.24.110.202
  • 104.24.111.202
suspicious
accounts.google.com
  • 172.217.16.205
shared
cdnjs.cloudflare.com
  • 104.16.18.94
  • 104.16.19.94
whitelisted
fonts.googleapis.com
  • 172.217.12.170
whitelisted
maxst.icons8.com
  • 195.181.175.52
whitelisted
stackpath.bootstrapcdn.com
  • 209.197.3.15
whitelisted
js.chargebee.com
  • 174.137.133.49
shared
contextual.media.net
  • 104.108.144.24
shared
fonts.gstatic.com
  • 172.217.21.195
whitelisted
www.googletagmanager.com
  • 142.250.74.200
whitelisted

Threats

PID
Process
Class
Message
2884
Bee Swarm GUI - Linkvertise Downloader_3829900224.exe
A Network Trojan was detected
ADWARE [PTsecurity] InstallCore
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://linkvertise.download/download/93270/OpBeeSwarmGUI/V2LqVwOGvM7xh5gh1CUsQWtyCjIsYKeU