analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://t-trg.email.adobe.com/r/?id=h403c3bd8,8efb37c6,84df2e8e&e=cDE9Sk00Rlc5NUI&s=zcc5bLepHoFZyoZh3fnzQJIEN_omkbFK4DDyRbycHYc

Full analysis: https://app.any.run/tasks/5db6533f-4fd8-4ed0-83ce-93d502b28835
Verdict: Malicious activity
Analysis date: June 27, 2022, 13:28:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

6527048EB7E85C5CBC98F5A379493B88

SHA1:

B10DC347D499A74E30E6AE7B0E548A2B2D7C6660

SHA256:

484655252147B406045013CB717543B12BD655B1A053DDCB7C4F698141E0EAE9

SSDEEP:

3:N8Ax9S+xtXKHBWkdMD6NDIbhzVV5LwsKYeOH4b0uhjuHsH+Gn:2AxDQHBWkuD6NkFVLZKYeOH4b0ukH6n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Checks supported languages

      • chrome.exe (PID: 2980)
      • chrome.exe (PID: 3228)
      • chrome.exe (PID: 3608)
      • chrome.exe (PID: 3752)
      • chrome.exe (PID: 2360)
      • chrome.exe (PID: 336)
      • chrome.exe (PID: 2612)
      • chrome.exe (PID: 3248)
      • chrome.exe (PID: 360)
      • chrome.exe (PID: 2116)

    • Reads the computer name

      • chrome.exe (PID: 2980)
      • chrome.exe (PID: 3608)
      • chrome.exe (PID: 3752)
      • chrome.exe (PID: 336)
      • chrome.exe (PID: 2116)

    • Reads the hosts file

      • chrome.exe (PID: 2980)
      • chrome.exe (PID: 3752)

    • Application launched itself

      • chrome.exe (PID: 2980)

    • Reads settings of System Certificates

      • chrome.exe (PID: 3752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
10
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2980"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://t-trg.email.adobe.com/r/?id=h403c3bd8,8efb37c6,84df2e8e&e=cDE9Sk00Rlc5NUI&s=zcc5bLepHoFZyoZh3fnzQJIEN_omkbFK4DDyRbycHYc"C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
3228"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6e91d988,0x6e91d998,0x6e91d9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
3608"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,4729717162993508087,8781897563120685769,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1048 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
3752"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1040,4729717162993508087,8781897563120685769,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1304 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
2360"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,4729717162993508087,8781897563120685769,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
3248"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,4729717162993508087,8781897563120685769,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1864 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
2612"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,4729717162993508087,8781897563120685769,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2156 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
336"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,4729717162993508087,8781897563120685769,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1084 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
360"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,4729717162993508087,8781897563120685769,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
2116"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,4729717162993508087,8781897563120685769,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Total events
10 855
Read events
10 809
Write events
46
Delete events
0

Modification events

(PID) Process:(2980) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2980) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2980) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2980) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2980) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2980) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2980) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2980) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2980) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
(PID) Process:(2980) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid_installdate
Value:
0
Executable files
0
Suspicious files
10
Text files
55
Unknown types
0

Dropped files

PID
Process
Filename
Type
2980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62B9B09F-BA4.pma —
MD5:—
SHA256:—
2980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF1048d2.TMPtext
MD5:64AD8ED3E666540337BA541C549F72F7
SHA256:BECBDB08B5B37D203A85F2E974407334053BB1D2270F0B3C9A4DB963896F2206
2980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old~RF1050c2.TMPtext
MD5:D097F8EB2230B3F32C41C5D75790508C
SHA256:ADDF87D20CD455CFB4AACB6B76719629C0277A4CF70B496343047BB73ABBAEF5
2980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.oldtext
MD5:7721CDA9F5B73CE8A135471EB53B4E0E
SHA256:DD730C576766A46FFC84E682123248ECE1FF1887EC0ACAB22A5CE93A450F4500
2980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF1048d2.TMPtext
MD5:936EB7280DA791E6DD28EF3A9B46D39C
SHA256:CBAF2AFD831B32F6D1C12337EE5D2F090D6AE1F4DCB40B08BEF49BF52AD9721F
2980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG.old~RF104d08.TMPtext
MD5:D0BA19096D6C8F8DE58312E8D938E893
SHA256:AADE90A7B0984F3C719D528E4E6FAE3854E28B30363BDD4DF65037E69784A078
2980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
2980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF104b24.TMPtext
MD5:8304B8F42465198890090F52D3F80A4C
SHA256:80C32AC2585E7E81200104B1630F19560A156C4ABF51B5888B0FBF07323FAB34
2980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\66b7e1c5-2890-4a11-90ee-82e7f75515bf.tmptext
MD5:13C3E967008B0C1F56FFB52444355BAF
SHA256:7BA0FCB703AC0A6D2762AC266F63DD22C7216E6444B035A6A8CCF5FBB2AEC309
2980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferencestext
MD5:13C3E967008B0C1F56FFB52444355BAF
SHA256:7BA0FCB703AC0A6D2762AC266F63DD22C7216E6444B035A6A8CCF5FBB2AEC309
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
95
DNS requests
53
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3752
chrome.exe
143.204.89.71:443
t-trg.email.adobe.com
—
US
unknown
3752
chrome.exe
151.101.66.49:443
stock.adobe.com
Fastly
US
suspicious
3752
chrome.exe
142.250.185.174:443
clients2.google.com
Google Inc.
US
whitelisted
3752
chrome.exe
151.101.1.167:443
as.ftcdn.net
Fastly
US
suspicious
3752
chrome.exe
2.21.20.133:443
www.adobe.com
NTT America, Inc.
DE
suspicious
3752
chrome.exe
184.24.77.156:443
use.typekit.net
Time Warner Cable Internet LLC
US
suspicious
3752
chrome.exe
172.217.16.141:443
accounts.google.com
Google Inc.
US
suspicious
3752
chrome.exe
52.19.46.209:443
dpm.demdex.net
Amazon.com, Inc.
IE
unknown
3752
chrome.exe
104.20.185.68:443
geolocation.onetrust.com
Cloudflare Inc
US
shared
3752
chrome.exe
23.75.245.70:443
c.betrad.com
Akamai International B.V.
US
unknown

DNS requests

Domain
IP
Reputation
clients2.google.com
  • 142.250.185.174
whitelisted
accounts.google.com
  • 172.217.16.141
shared
t-trg.email.adobe.com
  • 143.204.89.71
  • 143.204.89.92
  • 143.204.89.93
  • 143.204.89.100
whitelisted
stock.adobe.com
  • 151.101.66.49
  • 151.101.2.49
  • 151.101.194.49
  • 151.101.130.49
whitelisted
as.ftcdn.net
  • 151.101.1.167
  • 151.101.65.167
  • 151.101.129.167
  • 151.101.193.167
suspicious
use.typekit.net
  • 184.24.77.156
  • 184.24.77.144
whitelisted
www.adobe.com
  • 2.21.20.133
  • 2.21.20.145
whitelisted
dpm.demdex.net
  • 52.19.46.209
  • 34.248.99.56
  • 3.248.150.209
  • 52.30.130.246
  • 34.241.232.111
  • 79.125.65.240
  • 34.241.126.16
  • 34.251.55.29
whitelisted
c.betrad.com
  • 23.75.245.70
whitelisted
api.demandbase.com
  • 143.204.89.33
  • 143.204.89.106
  • 143.204.89.32
  • 143.204.89.107
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://t-trg.email.adobe.com/r/?id=h403c3bd8,8efb37c6,84df2e8e&e=cDE9Sk00Rlc5NUI&s=zcc5bLepHoFZyoZh3fnzQJIEN_omkbFK4DDyRbycHYc