URL:

https://github.com/nginerrer/bin-repo/blob/main/AggregatorHost.exe

Full analysis: https://app.any.run/tasks/daccc3d5-1b27-4f1a-be8a-bd1f97551f7f
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: September 04, 2024, 07:30:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
discord
stealer
python
pyinstaller
Indicators:
MD5:

456DD89E1C86714980F51DC79C1DC3FB

SHA1:

1A87EB2D0B9C25774BBCAC4A95BB312B42D5BA25

SHA256:

55964DC1D378415EC4DC51C59BA4B192CA9256B9748EEAB1E3ACEB9E0BB93388

SSDEEP:

3:N8tEd7zAgXKzQVKKpcKIERLUEsXtXACn:2uqgXmQVKTsLV2tXN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • AggregatorHost.exe (PID: 7020)

    • Loads dropped or rewritten executable

      • AggregatorHost.exe (PID: 7020)
      • MusNotificationUx.exe (PID: 6936)
      • MusNotifyIcon.exe (PID: 6216)
      • SIHClient.exe (PID: 4064)
      • svchost.exe (PID: 4576)
      • chrome.exe (PID: 4980)
      • svchost.exe (PID: 2080)
      • WmiPrvSE.exe (PID: 7012)
      • svchost.exe (PID: 7108)
      • WaaSMedicAgent.exe (PID: 4692)
      • conhost.exe (PID: 5556)
      • svchost.exe (PID: 6872)
      • svchost.exe (PID: 4092)
      • svchost.exe (PID: 1224)
      • svchost.exe (PID: 4316)
      • backgroundTaskHost.exe (PID: 6224)
      • RuntimeBroker.exe (PID: 5624)
      • WmiPrvSE.exe (PID: 2228)

    • Changes the autorun value in the registry

      • AggregatorHost.exe (PID: 7020)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • chrome.exe (PID: 6148)

    • Process drops python dynamic module

      • AggregatorHost.exe (PID: 568)

    • The process drops C-runtime libraries

      • AggregatorHost.exe (PID: 568)

    • Executable content was dropped or overwritten

      • AggregatorHost.exe (PID: 568)

    • Process drops legitimate windows executable

      • AggregatorHost.exe (PID: 568)

    • Application launched itself

      • AggregatorHost.exe (PID: 568)

    • Loads Python modules

      • AggregatorHost.exe (PID: 7020)

    • There is functionality for taking screenshot (YARA)

      • AggregatorHost.exe (PID: 7020)

  • INFO

    • Reads the software policy settings

      • WaaSMedicAgent.exe (PID: 4692)
      • SIHClient.exe (PID: 4064)
      • backgroundTaskHost.exe (PID: 6224)

    • Application launched itself

      • chrome.exe (PID: 4980)

    • Creates files in the program directory

      • MusNotificationUx.exe (PID: 6936)
      • svchost.exe (PID: 1224)
      • MusNotifyIcon.exe (PID: 6216)

    • Reads the time zone

      • MusNotificationUx.exe (PID: 6936)
      • MusNotifyIcon.exe (PID: 6216)
      • WmiPrvSE.exe (PID: 7012)
      • WmiPrvSE.exe (PID: 2228)

    • Reads Microsoft Office registry keys

      • chrome.exe (PID: 4980)

    • The process uses the downloaded file

      • chrome.exe (PID: 4980)
      • chrome.exe (PID: 6148)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 4980)

    • Checks supported languages

      • AggregatorHost.exe (PID: 568)
      • AggregatorHost.exe (PID: 7020)

    • Reads the computer name

      • AggregatorHost.exe (PID: 568)
      • AggregatorHost.exe (PID: 7020)

    • Create files in a temporary directory

      • AggregatorHost.exe (PID: 568)
      • svchost.exe (PID: 2080)

    • Reads Windows Product ID

      • WmiPrvSE.exe (PID: 7012)

    • Loads dropped or rewritten executable

      • AggregatorHost.exe (PID: 568)
      • chrome.exe (PID: 7024)
      • chrome.exe (PID: 6876)
      • chrome.exe (PID: 5524)
      • chrome.exe (PID: 5880)
      • chrome.exe (PID: 6148)
      • chrome.exe (PID: 3104)
      • chrome.exe (PID: 6016)
      • chrome.exe (PID: 6988)
      • chrome.exe (PID: 32)
      • chrome.exe (PID: 7068)
      • chrome.exe (PID: 1920)
      • chrome.exe (PID: 7064)
      • chrome.exe (PID: 6580)
      • chrome.exe (PID: 5900)
      • chrome.exe (PID: 6728)

    • PyInstaller has been detected (YARA)

      • AggregatorHost.exe (PID: 568)
      • AggregatorHost.exe (PID: 7020)

    • Attempting to use instant messaging service

      • AggregatorHost.exe (PID: 7020)

    • Reads security settings of Internet Explorer

      • RuntimeBroker.exe (PID: 5624)
      • backgroundTaskHost.exe (PID: 6224)

    • Checks proxy server information

      • backgroundTaskHost.exe (PID: 6224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
35
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs THREAT aggregatorhost.exe THREAT aggregatorhost.exe svchost.exe no specs svchost.exe sihclient.exe svchost.exe no specs svchost.exe no specs waasmedicagent.exe no specs conhost.exe no specs musnotifyicon.exe no specs svchost.exe no specs musnotificationux.exe no specs wmiprvse.exe no specs svchost.exe no specs chrome.exe no specs chrome.exe no specs svchost.exe no specs backgroundtaskhost.exe runtimebroker.exe no specs chrome.exe no specs wmiprvse.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
32"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1808,i,7798836932220602586,18092391702684100261,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
568"C:\Users\admin\Downloads\AggregatorHost.exe" C:\Users\admin\Downloads\AggregatorHost.exe
chrome.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\downloads\aggregatorhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1224C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVCC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
1436"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5336 --field-trial-handle=1808,i,7798836932220602586,18092391702684100261,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1920"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoABAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5148 --field-trial-handle=1808,i,7798836932220602586,18092391702684100261,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2080C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BITSC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2228C:\WINDOWS\system32\wbem\wmiprvse.exe -secured -EmbeddingC:\Windows\System32\wbem\WmiPrvSE.exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Provider Host
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmiprvse.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ncobjapi.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
3104"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2072 --field-trial-handle=1808,i,7798836932220602586,18092391702684100261,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:3C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4064C:\WINDOWS\System32\sihclient.exe /cv GLYDTyZIV021wx8g1mcxng.0.2C:\Windows\System32\SIHClient.exe
upfc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
SIH Client
Exit code:
2379777
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sihclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\combase.dll
4092C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauservC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
30 782
Read events
30 676
Write events
99
Delete events
7

Modification events

(PID) Process:(2080) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS
Operation:writeName:PerfMMFileName
Value:
Global\MMF_BITS7ac596c4-a0fc-4f9d-a6e6-436336c3cd56
(PID) Process:(4980) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4980) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(4980) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(4980) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(4980) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4980) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(4980) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(4980) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(4980) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
130
Suspicious files
137
Text files
158
Unknown types
226

Dropped files

PID
Process
Filename
Type
4980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
4980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF12b955.TMP —
MD5:—
SHA256:—
4980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
4980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF12b965.TMP —
MD5:—
SHA256:—
4980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
4980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
4980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
4980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
4980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:FC81892AC822DCBB09441D3B58B47125
SHA256:FB077C966296D02D50CCBF7F761D2A3311A206A784A7496F331C2B0D6AD205C8
4980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF12b955.TMPtext
MD5:139F545948FC1F10256A27E3C2CEF062
SHA256:9399CC6F9C335015E086DB37208B1816A7831221A005B04AC83C4F86CC04230D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
62
DNS requests
45
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2080
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acottdsr4k6pgibdknx33vj64oxa_20240823.667410168.14/obedbbhbpmojnkanicioggnmelmoomoc_20240823.667410168.14_all_ENUS500000_ad46kswvnnyj2osjjnryykc7cc7q.crx3
unknown
—
—
whitelisted
4064
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4064
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2080
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acottdsr4k6pgibdknx33vj64oxa_20240823.667410168.14/obedbbhbpmojnkanicioggnmelmoomoc_20240823.667410168.14_all_ENUS500000_ad46kswvnnyj2osjjnryykc7cc7q.crx3
unknown
—
—
whitelisted
2080
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acottdsr4k6pgibdknx33vj64oxa_20240823.667410168.14/obedbbhbpmojnkanicioggnmelmoomoc_20240823.667410168.14_all_ENUS500000_ad46kswvnnyj2osjjnryykc7cc7q.crx3
unknown
—
—
whitelisted
2080
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acottdsr4k6pgibdknx33vj64oxa_20240823.667410168.14/obedbbhbpmojnkanicioggnmelmoomoc_20240823.667410168.14_all_ENUS500000_ad46kswvnnyj2osjjnryykc7cc7q.crx3
unknown
—
—
whitelisted
2080
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acottdsr4k6pgibdknx33vj64oxa_20240823.667410168.14/obedbbhbpmojnkanicioggnmelmoomoc_20240823.667410168.14_all_ENUS500000_ad46kswvnnyj2osjjnryykc7cc7q.crx3
unknown
—
—
whitelisted
2080
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acottdsr4k6pgibdknx33vj64oxa_20240823.667410168.14/obedbbhbpmojnkanicioggnmelmoomoc_20240823.667410168.14_all_ENUS500000_ad46kswvnnyj2osjjnryykc7cc7q.crx3
unknown
—
—
whitelisted
2080
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acottdsr4k6pgibdknx33vj64oxa_20240823.667410168.14/obedbbhbpmojnkanicioggnmelmoomoc_20240823.667410168.14_all_ENUS500000_ad46kswvnnyj2osjjnryykc7cc7q.crx3
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4980
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
3104
chrome.exe
140.82.121.4:443
github.com
GITHUB
US
shared
3104
chrome.exe
74.125.206.84:443
accounts.google.com
GOOGLE
US
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3104
chrome.exe
185.199.109.154:443
github.githubassets.com
FASTLY
US
whitelisted
3104
chrome.exe
185.199.109.133:443
avatars.githubusercontent.com
FASTLY
US
shared
3104
chrome.exe
140.82.114.21:443
collector.github.com
GITHUB
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.78
whitelisted
github.com
  • 140.82.121.4
shared
accounts.google.com
  • 74.125.206.84
whitelisted
client.wns.windows.com
  • 40.113.110.67
  • 40.113.103.199
whitelisted
github.githubassets.com
  • 185.199.109.154
  • 185.199.110.154
  • 185.199.111.154
  • 185.199.108.154
whitelisted
avatars.githubusercontent.com
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.108.133
whitelisted
github-cloud.s3.amazonaws.com
  • 52.217.108.148
  • 3.5.11.119
  • 54.231.136.97
  • 3.5.6.196
  • 3.5.25.126
  • 54.231.137.1
  • 52.217.9.156
  • 3.5.27.121
shared
user-images.githubusercontent.com
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.108.133
  • 185.199.109.133
whitelisted
collector.github.com
  • 140.82.114.21
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://github.com/nginerrer/bin-repo/blob/main/AggregatorHost.exe