File name:

Sorillus-Launcher v1.1.jar

Full analysis: https://app.any.run/tasks/4c3404ee-3e8a-461e-9e1f-f2c5b0ab0964
Verdict: Malicious activity
Analysis date: March 15, 2024, 22:14:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5:

85CECEA8CD99BAA57DECDEDDD6C7F800

SHA1:

43AF40AB8EB41CB02FED8D223C5098E2FB15C2D8

SHA256:

43D005CF6B3C5883E6A5BCA5AA4863AD46477B0B79F68DC0A907DD8CFAF280E2

SSDEEP:

49152:CBrBvZJjJqtpi8EX5kdAgeFAg3gUUfqIgEhVkrezMwwo23KJVuo68sWU41BH+MeF:iBxJ9Mx85kdAgelUiIphyKd2Ox6sT1BI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Sorillus-Launcher v1.1.jar.exe (PID: 2120)
      • JavaSetup8u401.exe (PID: 4020)
      • JavaSetup8u401.exe (PID: 3968)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • JavaSetup8u401.exe (PID: 4020)
      • JavaSetup8u401.exe (PID: 3968)
      • LZMA_EXE (PID: 3136)
      • dllhost.exe (PID: 2128)

    • Checks for Java to be installed

      • JavaSetup8u401.exe (PID: 3968)
      • ssvagent.exe (PID: 4036)
      • jp2launcher.exe (PID: 2948)
      • jp2launcher.exe (PID: 1548)
      • javaw.exe (PID: 1268)

    • Reads security settings of Internet Explorer

      • JavaSetup8u401.exe (PID: 3968)

    • Checks Windows Trust Settings

      • JavaSetup8u401.exe (PID: 3968)

    • Reads settings of System Certificates

      • JavaSetup8u401.exe (PID: 3968)

    • Reads Microsoft Outlook installation path

      • JavaSetup8u401.exe (PID: 3968)

    • Reads Internet Explorer settings

      • JavaSetup8u401.exe (PID: 3968)

    • Starts application with an unusual extension

      • JavaSetup8u401.exe (PID: 3968)

    • Reads the Internet Settings

      • JavaSetup8u401.exe (PID: 3968)
      • WMIC.exe (PID: 2316)
      • WMIC.exe (PID: 3564)
      • WMIC.exe (PID: 1168)
      • java.exe (PID: 3100)

    • Uses WMIC.EXE to obtain Windows Installer data

      • java.exe (PID: 3100)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 3564)
      • WMIC.exe (PID: 1168)
      • WMIC.exe (PID: 2316)

    • Creates/Modifies COM task schedule object

      • ssvagent.exe (PID: 4036)

  • INFO

    • Checks supported languages

      • Sorillus-Launcher v1.1.jar.exe (PID: 2120)
      • JavaSetup8u401.exe (PID: 4020)
      • JavaSetup8u401.exe (PID: 3968)
      • LZMA_EXE (PID: 3136)
      • LZMA_EXE (PID: 4024)
      • jaureg.exe (PID: 2268)
      • Sorillus-Launcher v1.1.exe (PID: 2128)
      • javaw.exe (PID: 2612)
      • jp2launcher.exe (PID: 2948)
      • ssvagent.exe (PID: 4036)
      • javaws.exe (PID: 3876)
      • javaws.exe (PID: 1768)
      • jp2launcher.exe (PID: 1548)
      • javaw.exe (PID: 3636)
      • Sorillus-Launcher v1.1.exe (PID: 3016)
      • Sorillus-Launcher v1.1.exe (PID: 3228)
      • java.exe (PID: 3100)
      • javaw.exe (PID: 1268)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2688)
      • chrome.exe (PID: 1692)

    • Drops the executable file immediately after the start

      • chrome.exe (PID: 2688)
      • chrome.exe (PID: 1692)
      • dllhost.exe (PID: 2128)

    • The process uses the downloaded file

      • chrome.exe (PID: 3472)
      • chrome.exe (PID: 1692)
      • chrome.exe (PID: 3024)

    • Manual execution by a user

      • chrome.exe (PID: 1692)
      • explorer.exe (PID: 3696)
      • Sorillus-Launcher v1.1.exe (PID: 3016)
      • Sorillus-Launcher v1.1.exe (PID: 3228)
      • explorer.exe (PID: 2136)
      • cmd.exe (PID: 4008)

    • Application launched itself

      • chrome.exe (PID: 1692)
      • msedge.exe (PID: 3456)

    • Create files in a temporary directory

      • JavaSetup8u401.exe (PID: 4020)
      • javaw.exe (PID: 2612)
      • jp2launcher.exe (PID: 2948)
      • jp2launcher.exe (PID: 1548)
      • java.exe (PID: 3100)

    • Reads the computer name

      • JavaSetup8u401.exe (PID: 4020)
      • JavaSetup8u401.exe (PID: 3968)
      • javaws.exe (PID: 1768)
      • javaws.exe (PID: 3876)
      • jp2launcher.exe (PID: 2948)
      • jp2launcher.exe (PID: 1548)
      • javaw.exe (PID: 3636)
      • javaw.exe (PID: 1268)
      • java.exe (PID: 3100)

    • Reads the machine GUID from the registry

      • JavaSetup8u401.exe (PID: 3968)
      • jp2launcher.exe (PID: 2948)
      • jp2launcher.exe (PID: 1548)
      • java.exe (PID: 3100)

    • Creates files or folders in the user directory

      • JavaSetup8u401.exe (PID: 3968)
      • LZMA_EXE (PID: 3136)
      • LZMA_EXE (PID: 4024)
      • DeviceDisplayObjectProvider.exe (PID: 3912)

    • Checks proxy server information

      • JavaSetup8u401.exe (PID: 3968)
      • jp2launcher.exe (PID: 2948)
      • jp2launcher.exe (PID: 1548)

    • Reads the software policy settings

      • JavaSetup8u401.exe (PID: 3968)

    • Creates files in the program directory

      • javaw.exe (PID: 2612)
      • java.exe (PID: 3100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:14 18:32:10+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.22
CodeSize: 44032
InitializedDataSize: 160768
UninitializedDataSize: 38912
EntryPoint: 0x1590
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.1.0.0
ProductVersionNumber: 1.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Windows NT
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Sorillus Company
FileDescription: Sorillus
FileVersion: Sorillus Launcher
InternalName: Sorillus Launcher
LegalCopyright: Sorillus Company
LegalTrademarks: -
OriginalFileName: Sorillus Launcher.exe
ProductName: Sorillus Launcher
ProductVersion: Sorillus Launcher
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
83
Malicious processes
5
Suspicious processes
4

Behavior graph

Click at the process to see the details
start sorillus-launcher v1.1.jar.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs javasetup8u401.exe no specs javasetup8u401.exe javasetup8u401.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs lzma_exe lzma_exe no specs chrome.exe no specs chrome.exe no specs sorillus-launcher v1.1.exe no specs jaureg.exe explorer.exe no specs javaw.exe ssvagent.exe no specs javaws.exe jp2launcher.exe no specs javaws.exe jp2launcher.exe no specs msiexec.exe no specs javaw.exe no specs javaw.exe no specs sorillus-launcher v1.1.exe no specs sorillus-launcher v1.1.exe devicedisplayobjectprovider.exe no specs explorer.exe no specs Copy/Move/Rename/Delete/Link Object cmd.exe no specs java.exe icacls.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=1920 --field-trial-handle=1228,i,4018349909984343804,8273663689340030960,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
548"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --mojo-platform-channel-handle=4064 --field-trial-handle=1228,i,4018349909984343804,8273663689340030960,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
584"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 --field-trial-handle=1308,i,8755748268676774488,7119549063907741802,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
712C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
840"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1332 --field-trial-handle=1228,i,4018349909984343804,8273663689340030960,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
848"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3968 --field-trial-handle=1308,i,8755748268676774488,7119549063907741802,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
924"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3880 --field-trial-handle=1228,i,4018349909984343804,8273663689340030960,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1072"C:\Users\admin\Downloads\JavaSetup8u401.exe" C:\Users\admin\Downloads\JavaSetup8u401.exe—chrome.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java Platform SE binary
Exit code:
3221226540
Version:
8.0.4010.10
Modules
Images
c:\users\admin\downloads\javasetup8u401.exe
c:\windows\system32\ntdll.dll
1168wmic csproduct get UUIDC:\Windows\System32\wbem\WMIC.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1216"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2316 --field-trial-handle=1308,i,8755748268676774488,7119549063907741802,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
36 280
Read events
32 107
Write events
4 113
Delete events
60

Modification events

(PID) Process:(1692) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1692) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1692) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(1692) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(1692) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1692) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(1692) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(1692) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(1692) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(1692) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
14
Suspicious files
142
Text files
147
Unknown types
110

Dropped files

PID
Process
Filename
Type
1692chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF186925.TMP —
MD5:—
SHA256:—
1692chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
1692chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:9F941EA08DBDCA2EB3CFA1DBBBA6F5DC
SHA256:127F71DF0D2AD895D4F293E62284D85971AE047CA15F90B87BF6335898B0B655
1692chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF186973.TMPtext
MD5:ADB669AB4CD1C63883C64FB0DBA2C7DA
SHA256:18BFF89047EC5B122573D089B3DC7A7DD14A5A7A515B2D8141584B41E723253F
1692chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
1692chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF186963.TMPtext
MD5:05CF4C3C5148DA6355D3561A9EAA5E8A
SHA256:8D720243F6876898E4F197C8867C4CEE69F1C7335C55B8A29C120B1028D93E41
1692chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old~RF186b67.TMPtext
MD5:C5B082BC8EA6A9BD1DC6782C00A79605
SHA256:6168A9E585264DE05DEE1B67427B1BC277F1B83B9297184EFACC5D3BB061ABDE
1692chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old~RF186cde.TMPtext
MD5:0272AD43ECEA4DC6C694BE6D918B5BA7
SHA256:530F5A3F46B293038FEBEF2035CFA622F05B202363ABFAF9E40E105BD1472432
1692chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.oldtext
MD5:E53573A93829681410D5E7DBB1B61C78
SHA256:A82D28F2C1E22A2AE0ABC5F5AF0CC8EE7AD913BAB3A0BF84CE6D8D23F67E06A3
1692chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF1872ca.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
96
DNS requests
123
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3968
JavaSetup8u401.exe
GET
304
92.122.225.234:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9af530c59235445d
IT
—
—
unknown
3968
JavaSetup8u401.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
binary
471 b
unknown
856
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx
US
—
—
unknown
1080
svchost.exe
GET
200
92.123.48.163:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c503292d7802e201
IT
compressed
67.5 Kb
unknown
856
svchost.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx
US
binary
3.07 Kb
unknown
856
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acf5iuk6pnjlc6lnxtqm5ki6eoqq_112.300.200/gkmgaooipdjhmangpemjhigmamcehddo_112.300.200_win_aclnpjhtsv44pze3qmxsxb7fq66q.crx3
US
binary
3.07 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acf5iuk6pnjlc6lnxtqm5ki6eoqq_112.300.200/gkmgaooipdjhmangpemjhigmamcehddo_112.300.200_win_aclnpjhtsv44pze3qmxsxb7fq66q.crx3
US
binary
6.53 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acf5iuk6pnjlc6lnxtqm5ki6eoqq_112.300.200/gkmgaooipdjhmangpemjhigmamcehddo_112.300.200_win_aclnpjhtsv44pze3qmxsxb7fq66q.crx3
US
binary
11.2 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acf5iuk6pnjlc6lnxtqm5ki6eoqq_112.300.200/gkmgaooipdjhmangpemjhigmamcehddo_112.300.200_win_aclnpjhtsv44pze3qmxsxb7fq66q.crx3
US
binary
9.93 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acf5iuk6pnjlc6lnxtqm5ki6eoqq_112.300.200/gkmgaooipdjhmangpemjhigmamcehddo_112.300.200_win_aclnpjhtsv44pze3qmxsxb7fq66q.crx3
US
binary
21.1 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
2688
chrome.exe
216.58.206.35:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
1692
chrome.exe
239.255.255.250:1900
—
—
—
unknown
2688
chrome.exe
74.125.133.84:443
accounts.google.com
GOOGLE
US
unknown
2688
chrome.exe
142.250.186.36:443
www.google.com
GOOGLE
US
whitelisted
2688
chrome.exe
142.250.184.195:443
www.gstatic.com
GOOGLE
US
whitelisted
2688
chrome.exe
142.250.181.238:443
apis.google.com
GOOGLE
US
whitelisted
2688
chrome.exe
142.250.186.142:443
encrypted-tbn0.gstatic.com
GOOGLE
US
whitelisted
1692
chrome.exe
224.0.0.251:5353
—
—
—
unknown

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 216.58.206.35
whitelisted
accounts.google.com
  • 74.125.133.84
shared
www.google.com
  • 142.250.186.36
whitelisted
www.gstatic.com
  • 142.250.184.195
whitelisted
apis.google.com
  • 142.250.181.238
whitelisted
encrypted-tbn0.gstatic.com
  • 142.250.186.142
whitelisted
update.googleapis.com
  • 142.250.184.227
whitelisted
fonts.gstatic.com
  • 142.250.185.163
whitelisted
consent.google.com
  • 172.217.23.110
shared
safebrowsing.googleapis.com
  • 216.58.206.74
whitelisted

Threats

PID
Process
Class
Message
2688
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Sorillus-Launcher v1.1.jar