analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://download.cnet.com

Full analysis: https://app.any.run/tasks/9b759011-c00f-4474-868b-a4ee1db5e838
Verdict: Malicious activity
Analysis date: November 30, 2020, 04:41:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

C723A854F6DC861558ED1F1113640514

SHA1:

EF6B096B4FD229FFA0D2DCDF11363856CD9C21CE

SHA256:

4E48F50212796E0E285D4A35AAF822C2DAE1D1325360CE9FB956BE82F03593E7

SSDEEP:

3:N8SElbKn:2SKmn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ccsetup570.exe (PID: 3808)
      • ccsetup570.exe (PID: 3392)
      • avira_en_sptl1_329929279-1606711496__adwg.exe (PID: 3188)
      • avira_en_sptl1_329929279-1606711496__adwg.exe (PID: 4004)
      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 3724)
      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 1768)
      • Avira.OE.Setup.Bundle.exe (PID: 2588)
      • Avira.OE.Setup.Prerequisites.exe (PID: 2692)
      • Avira.OE.Setup.Prerequisites.exe (PID: 2712)
      • Avira.ServiceHost.exe (PID: 2080)
      • ccsetup570.exe (PID: 904)
      • Avira.Systray.exe (PID: 2172)
      • Avira.Systray.exe (PID: 2952)
      • ccsetup570.exe (PID: 620)
      • avira_system_speedup.exe (PID: 2548)
      • Avira.SystemSpeedup.Core.Common.Starter.exe (PID: 4056)

    • Loads dropped or rewritten executable

      • ccsetup570.exe (PID: 3808)
      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 1768)
      • rundll32.exe (PID: 2424)
      • rundll32.exe (PID: 3480)
      • rundll32.exe (PID: 3308)
      • rundll32.exe (PID: 3592)
      • rundll32.exe (PID: 3876)
      • rundll32.exe (PID: 2052)
      • rundll32.exe (PID: 3304)
      • rundll32.exe (PID: 1716)
      • rundll32.exe (PID: 2828)
      • rundll32.exe (PID: 1068)
      • rundll32.exe (PID: 2552)
      • rundll32.exe (PID: 3324)
      • rundll32.exe (PID: 1704)
      • rundll32.exe (PID: 3044)
      • Avira.ServiceHost.exe (PID: 2080)
      • rundll32.exe (PID: 2924)
      • rundll32.exe (PID: 4020)
      • rundll32.exe (PID: 1996)
      • Avira.Systray.exe (PID: 2952)
      • rundll32.exe (PID: 328)
      • Avira.Systray.exe (PID: 2172)
      • ccsetup570.exe (PID: 620)
      • Avira.SystemSpeedup.Core.Common.Starter.exe (PID: 4056)

    • Changes settings of System certificates

      • ccsetup570.exe (PID: 3808)
      • Avira.Spotlight.Bootstrapper.exe (PID: 2216)
      • Avira.ServiceHost.exe (PID: 2080)

    • Actions looks like stealing of personal data

      • ccsetup570.exe (PID: 3808)
      • Avira.ServiceHost.exe (PID: 2080)

    • Drops executable file immediately after starts

      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 1768)
      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 3724)
      • Avira.OE.Setup.Bundle.exe (PID: 2588)
      • rundll32.exe (PID: 3308)
      • rundll32.exe (PID: 2424)
      • rundll32.exe (PID: 3480)
      • rundll32.exe (PID: 2052)
      • rundll32.exe (PID: 1716)
      • rundll32.exe (PID: 2828)
      • rundll32.exe (PID: 1068)
      • rundll32.exe (PID: 2552)
      • rundll32.exe (PID: 3044)
      • rundll32.exe (PID: 4020)
      • rundll32.exe (PID: 2924)
      • rundll32.exe (PID: 328)
      • rundll32.exe (PID: 1996)
      • avira_system_speedup.exe (PID: 2548)
      • avira_system_speedup.tmp (PID: 2340)
      • cmd.exe (PID: 1140)

    • Changes the autorun value in the registry

      • Avira.OE.Setup.Bundle.exe (PID: 2588)

    • Uses Task Scheduler to run other applications

      • MsiExec.exe (PID: 2488)
      • avira_system_speedup.tmp (PID: 2340)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2424)
      • schtasks.exe (PID: 1792)
      • schtasks.exe (PID: 2524)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2236)
      • ccsetup570.exe (PID: 3808)
      • Avira.Spotlight.Bootstrapper.exe (PID: 2216)
      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 3724)
      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 1768)
      • Avira.OE.Setup.Bundle.exe (PID: 2588)
      • rundll32.exe (PID: 2424)
      • rundll32.exe (PID: 3308)
      • msiexec.exe (PID: 2984)
      • rundll32.exe (PID: 3480)
      • rundll32.exe (PID: 2052)
      • rundll32.exe (PID: 1716)
      • rundll32.exe (PID: 1068)
      • rundll32.exe (PID: 2828)
      • rundll32.exe (PID: 2552)
      • rundll32.exe (PID: 3044)
      • rundll32.exe (PID: 4020)
      • rundll32.exe (PID: 2924)
      • rundll32.exe (PID: 1996)
      • rundll32.exe (PID: 328)
      • avira_system_speedup.exe (PID: 2548)
      • avira_system_speedup.tmp (PID: 2340)
      • ccsetup570.exe (PID: 620)
      • cmd.exe (PID: 1140)

    • Drops a file that was compiled in debug mode

      • chrome.exe (PID: 2236)
      • ccsetup570.exe (PID: 3808)
      • Avira.Spotlight.Bootstrapper.exe (PID: 2216)
      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 3724)
      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 1768)
      • Avira.OE.Setup.Bundle.exe (PID: 2588)
      • rundll32.exe (PID: 3308)
      • rundll32.exe (PID: 2424)
      • rundll32.exe (PID: 3480)
      • rundll32.exe (PID: 2052)
      • msiexec.exe (PID: 2984)
      • rundll32.exe (PID: 1716)
      • rundll32.exe (PID: 2828)
      • rundll32.exe (PID: 1068)
      • rundll32.exe (PID: 2552)
      • rundll32.exe (PID: 4020)
      • rundll32.exe (PID: 3044)
      • rundll32.exe (PID: 2924)
      • rundll32.exe (PID: 328)
      • rundll32.exe (PID: 1996)
      • avira_system_speedup.tmp (PID: 2340)
      • ccsetup570.exe (PID: 620)

    • Drops a file with a compile date too recent

      • chrome.exe (PID: 2236)
      • Avira.Spotlight.Bootstrapper.exe (PID: 2216)
      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 3724)
      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 1768)
      • Avira.OE.Setup.Bundle.exe (PID: 2588)
      • rundll32.exe (PID: 2424)
      • rundll32.exe (PID: 3308)
      • rundll32.exe (PID: 2052)
      • rundll32.exe (PID: 3480)
      • rundll32.exe (PID: 1716)
      • msiexec.exe (PID: 2984)
      • rundll32.exe (PID: 1068)
      • rundll32.exe (PID: 2828)
      • rundll32.exe (PID: 2552)
      • rundll32.exe (PID: 2924)
      • rundll32.exe (PID: 3044)
      • rundll32.exe (PID: 4020)
      • rundll32.exe (PID: 1996)
      • rundll32.exe (PID: 328)
      • avira_system_speedup.tmp (PID: 2340)

    • Uses RUNDLL32.EXE to load library

      • chrome.exe (PID: 2236)
      • MsiExec.exe (PID: 2488)

    • Low-level read access rights to disk partition

      • ccsetup570.exe (PID: 3808)
      • ccsetup570.exe (PID: 620)

    • Starts application with an unusual extension

      • ccsetup570.exe (PID: 3808)
      • ccsetup570.exe (PID: 620)

    • Adds / modifies Windows certificates

      • ccsetup570.exe (PID: 3808)
      • Avira.Spotlight.Bootstrapper.exe (PID: 2216)
      • Avira.ServiceHost.exe (PID: 2080)

    • Reads the cookies of Mozilla Firefox

      • ccsetup570.exe (PID: 3808)
      • Avira.ServiceHost.exe (PID: 2080)

    • Reads internet explorer settings

      • ccsetup570.exe (PID: 3808)
      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 1768)

    • Reads Environment values

      • ccsetup570.exe (PID: 3808)
      • Avira.Spotlight.Bootstrapper.exe (PID: 2216)
      • Avira.ServiceHost.exe (PID: 2080)
      • avira_system_speedup.tmp (PID: 2340)
      • ccsetup570.exe (PID: 620)

    • Reads CPU info

      • ccsetup570.exe (PID: 3808)
      • ccsetup570.exe (PID: 620)

    • Reads the cookies of Google Chrome

      • ccsetup570.exe (PID: 3808)
      • Avira.ServiceHost.exe (PID: 2080)

    • Creates files in the user directory

      • ccsetup570.exe (PID: 3808)
      • Avira.ServiceHost.exe (PID: 2080)

    • Searches for installed software

      • Avira.Spotlight.Bootstrapper.exe (PID: 2216)
      • Avira.ServiceHost.exe (PID: 2080)

    • Creates files in the Windows directory

      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 3724)
      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 1768)
      • Avira.ServiceHost.exe (PID: 2080)
      • avira_system_speedup.tmp (PID: 2340)

    • Creates files in the program directory

      • Avira.OE.Setup.Bundle.exe (PID: 2588)
      • rundll32.exe (PID: 3592)
      • rundll32.exe (PID: 1704)
      • Avira.ServiceHost.exe (PID: 2080)
      • rundll32.exe (PID: 4020)
      • Avira.Systray.exe (PID: 2952)
      • cmd.exe (PID: 1140)

    • Changes IE settings (feature browser emulation)

      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 1768)
      • Avira.Systray.exe (PID: 2952)
      • Avira.Systray.exe (PID: 2172)

    • Starts itself from another location

      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 1768)

    • Creates a software uninstall entry

      • Avira.OE.Setup.Bundle.exe (PID: 2588)
      • rundll32.exe (PID: 1716)
      • rundll32.exe (PID: 3044)

    • Removes files from Windows directory

      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 1768)
      • Avira.ServiceHost.exe (PID: 2080)
      • avira_en__329929279-1606711496__adwg-spotlight-default.exe (PID: 3724)

    • Creates a directory in Program Files

      • msiexec.exe (PID: 2984)
      • avira_system_speedup.tmp (PID: 2340)

    • Drops a file with too old compile date

      • msiexec.exe (PID: 2984)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 2984)

    • Executed as Windows Service

      • Avira.ServiceHost.exe (PID: 2080)

    • Reads the Windows organization settings

      • avira_system_speedup.tmp (PID: 2340)

    • Reads Windows owner or organization settings

      • avira_system_speedup.tmp (PID: 2340)

    • Creates COM task schedule object

      • RegAsm.exe (PID: 2788)

    • Starts CMD.EXE for commands execution

      • avira_system_speedup.tmp (PID: 2340)

  • INFO

    • Reads settings of System Certificates

      • chrome.exe (PID: 2664)
      • chrome.exe (PID: 2236)
      • ccsetup570.exe (PID: 3808)
      • Avira.Spotlight.Bootstrapper.exe (PID: 2216)
      • rundll32.exe (PID: 3876)
      • Avira.ServiceHost.exe (PID: 2080)

    • Reads the hosts file

      • chrome.exe (PID: 2236)
      • chrome.exe (PID: 2664)

    • Application launched itself

      • chrome.exe (PID: 2236)
      • msiexec.exe (PID: 2984)

    • Manual execution by user

      • explorer.exe (PID: 3896)
      • ccsetup570.exe (PID: 904)
      • ccsetup570.exe (PID: 620)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2488)
      • msiexec.exe (PID: 2984)
      • avira_system_speedup.tmp (PID: 2340)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 2984)

    • Creates files in the program directory

      • msiexec.exe (PID: 2984)
      • avira_system_speedup.tmp (PID: 2340)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2984)

    • Application was dropped or rewritten from another process

      • avira_system_speedup.tmp (PID: 2340)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
86
Malicious processes
35
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs rundll32.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs ccsetup570.exe no specs ccsetup570.exe nsc604.tmp no specs ping.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs avira_en_sptl1_329929279-1606711496__adwg.exe no specs avira_en_sptl1_329929279-1606711496__adwg.exe avira.spotlight.bootstrapper.exe avira_en__329929279-1606711496__adwg-spotlight-default.exe avira_en__329929279-1606711496__adwg-spotlight-default.exe avira.oe.setup.bundle.exe avira.oe.setup.prerequisites.exe no specs avira.oe.setup.prerequisites.exe no specs explorer.exe no specs msiexec.exe msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe no specs rundll32.exe schtasks.exe no specs rundll32.exe no specs rundll32.exe rundll32.exe no specs rundll32.exe rundll32.exe rundll32.exe no specs rundll32.exe rundll32.exe no specs msiexec.exe no specs rundll32.exe avira.servicehost.exe rundll32.exe ccsetup570.exe no specs rundll32.exe rundll32.exe avira.systray.exe no specs avira.systray.exe rundll32.exe rundll32.exe ccsetup570.exe avira_system_speedup.exe avira_system_speedup.tmp schtasks.exe no specs ns3d5d.tmp no specs ping.exe no specs regasm.exe no specs avira.systemspeedup.core.common.starter.exe cmd.exe schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2236"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://download.cnet.com"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3604"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6bf5a9d0,0x6bf5a9e0,0x6bf5a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
2804"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2848 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
2296"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1020,15907635839552640485,10760742883903349,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=5682249370805397248 --mojo-platform-channel-handle=1032 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
2664"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1020,15907635839552640485,10760742883903349,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=4049780568317247958 --mojo-platform-channel-handle=1568 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
2596"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1020,15907635839552640485,10760742883903349,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=2766612260969172351 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2180 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3256"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1020,15907635839552640485,10760742883903349,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1763413663917689817 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
2504"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1020,15907635839552640485,10760742883903349,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4203169662679501549 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2388 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3644"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1020,15907635839552640485,10760742883903349,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=15609424411405773659 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
2784"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1020,15907635839552640485,10760742883903349,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6701275346169462490 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
Total events
8 304
Read events
7 535
Write events
0
Delete events
0

Modification events

No data
Executable files
315
Suspicious files
304
Text files
785
Unknown types
35

Dropped files

PID
Process
Filename
Type
2236chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FC477F8-8BC.pma —
MD5:—
SHA256:—
2236chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old —
MD5:—
SHA256:—
2236chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\58125e93-3b8d-46d4-a7d4-f380e891494a.tmp —
MD5:—
SHA256:—
2236chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp —
MD5:—
SHA256:—
2236chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF18d339.TMPtext
MD5:C2DDBA63E4A2BD2E39A8B6C2C6384AAE
SHA256:6D5C1C78341C6F84911055D970ADDB0EC3499F8BF7FADE062122A22209CE67D9
2236chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF18d368.TMPtext
MD5:FB5B20517A0D1F7DAD485989565BEE5E
SHA256:99405F66EDBEB2306F4D0B4469DCADFF5293B5E1549C588CCFACEA439BB3B101
2236chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old~RF18d3c6.TMPtext
MD5:1C97B70A4BAD7C026F79467C7D496AFA
SHA256:C5A02E4984DE3F30DADFC0A89A93F45418C06653C3962EAA94C93909E51D272D
2236chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:C2DDBA63E4A2BD2E39A8B6C2C6384AAE
SHA256:6D5C1C78341C6F84911055D970ADDB0EC3499F8BF7FADE062122A22209CE67D9
2236chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.oldtext
MD5:1C97B70A4BAD7C026F79467C7D496AFA
SHA256:C5A02E4984DE3F30DADFC0A89A93F45418C06653C3962EAA94C93909E51D272D
2236chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RF18d378.TMPtext
MD5:67F45CAA18C889645F50CD6216C81E65
SHA256:33ED82CDDDFFD55A5059C147C6CD20F66C6712314F890A39576D3C10914D0029
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
222
DNS requests
143
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3808
ccsetup570.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
3808
ccsetup570.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
3808
ccsetup570.exe
GET
200
172.217.21.195:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEFcLuT0XSrlKAgAAAACAVZE%3D
US
der
471 b
whitelisted
3808
ccsetup570.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
3808
ccsetup570.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
3808
ccsetup570.exe
GET
200
151.101.0.64:80
http://service.piriform.com/installcheck.aspx?p=1&v=5.70.7909&vx=5.35.6210&l=1033&b=1&o=6.1W3&g=0&i=1&a=0&c=770&d=2&e=31&n=ccsetup570.exe&id=003&mk=IJR6-W5SV-5KYR-QBZD-6BY4-RN5Z-WAV9-RVK2-HZ8S&mx=97B7721C4994E2556FF6A439510F665DB45337A341A47E15F4997584423BF714&gd=26becbe5-c9a9-47b6-b550-917d4a6baf85
US
text
4 b
whitelisted
1044
svchost.exe
GET
200
2.18.233.62:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
der
813 b
whitelisted
1044
svchost.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTzEBwbi4EtIEVqKGq%2FDeuw3LZDrAQU%2BCXZpjnHw4GHJT4wVJEYIUCbF50CEAGlbicmfJ%2B9cwizLdCwXcY%3D
US
binary
5 b
whitelisted
1768
avira_en__329929279-1606711496__adwg-spotlight-default.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D
US
der
471 b
whitelisted
2664
chrome.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAKXB1YM1Knrv%2BJy8eCW2II%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2664
chrome.exe
104.16.148.64:443
cdn.cookielaw.org
Cloudflare Inc
US
unknown
2664
chrome.exe
172.217.21.202:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
2664
chrome.exe
151.101.13.188:443
download.cnet.com
Fastly
US
malicious
2664
chrome.exe
216.58.212.162:443
securepubads.g.doubleclick.net
Google Inc.
US
whitelisted
2664
chrome.exe
151.101.129.188:443
—
Fastly
US
unknown
2664
chrome.exe
104.75.88.141:443
c.go-mpulse.net
Akamai Technologies, Inc.
NL
unknown
2664
chrome.exe
13.224.190.125:443
static.chartbeat.com
—
US
unknown
2664
chrome.exe
104.20.184.68:443
geolocation.onetrust.com
Cloudflare Inc
US
shared
2664
chrome.exe
151.101.194.202:443
mab.chartbeat.com
Fastly
US
suspicious
2664
chrome.exe
172.217.16.205:443
accounts.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
download.cnet.com
  • 151.101.13.188
whitelisted
accounts.google.com
  • 172.217.16.205
shared
dl1.cbsistatic.com
  • 151.101.13.188
whitelisted
safebrowsing.googleapis.com
  • 172.217.21.202
whitelisted
cdn.cookielaw.org
  • 104.16.148.64
  • 104.16.149.64
whitelisted
cmg1.cbsistatic.com
  • 151.101.13.188
unknown
c.go-mpulse.net
  • 104.75.88.141
whitelisted
at.cbsi.com
  • 143.204.215.12
  • 143.204.215.61
  • 143.204.215.67
  • 143.204.215.72
suspicious
securepubads.g.doubleclick.net
  • 216.58.212.162
whitelisted
static.chartbeat.com
  • 13.224.190.125
whitelisted

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
Process
Message
avira_en__329929279-1606711496__adwg-spotlight-default.exe
Launcher Install Start
avira_en__329929279-1606711496__adwg-spotlight-default.exe
Launcher Install Start
Avira.ServiceHost.exe
SQLite error (2570): os_win.c:42430: (32) winDelete(C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal) - The process cannot access the file because it is being used by another process.
Avira.ServiceHost.exe
SQLite error (2570): os_win.c:42430: (32) winDelete(C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal) - The process cannot access the file because it is being used by another process.
Avira.ServiceHost.exe
SQLite notice (539): recovered 3 pages from C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal
Avira.ServiceHost.exe
SQLite error (2570): disk I/O error
avira_en__329929279-1606711496__adwg-spotlight-default.exe
Launcher Install End
avira_en__329929279-1606711496__adwg-spotlight-default.exe
~WebBrowser: Finished
avira_en__329929279-1606711496__adwg-spotlight-default.exe
~WebBrowser: Finished
avira_system_speedup.tmp
*** Initialize
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://download.cnet.com