File name:

main.exe

Full analysis: https://app.any.run/tasks/25c2c0ec-fb94-4b7f-8710-ab25ffd01f13
Verdict: Malicious activity
Analysis date: August 18, 2024, 08:36:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pyinstaller
python
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (console) x86-64, for MS Windows
MD5:

A1612B95444468414077C306FB0ED2F1

SHA1:

A82357A720C94C0F894AA6EBE26E108D27A95F01

SHA256:

56C0479CB67D8FF058FA19CD4D8083DD1A77D3A3B646AF6D55162B45A5AE6FBF

SSDEEP:

98304:jl7oqjpGXw9p5j8YjjHz5z3OlJxPgoPLJhckB/C5u5ZTdGkB5r3dgIbjQryrVhW4:ysW0+rAtBlUxuCsFGD4IGBs72OWc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • main.exe (PID: 6452)
      • selenium-manager.exe (PID: 6720)

    • Executable content was dropped or overwritten

      • main.exe (PID: 6452)
      • selenium-manager.exe (PID: 6720)

    • Process drops legitimate windows executable

      • main.exe (PID: 6452)

    • The process drops C-runtime libraries

      • main.exe (PID: 6452)

    • Application launched itself

      • main.exe (PID: 6452)

    • Process drops python dynamic module

      • main.exe (PID: 6452)

    • Loads Python modules

      • main.exe (PID: 6580)

    • Starts CMD.EXE for commands execution

      • selenium-manager.exe (PID: 6720)

    • Uses WMIC.EXE to obtain operating system information

      • cmd.exe (PID: 6816)

    • Uses WMIC.EXE

      • cmd.exe (PID: 7084)

  • INFO

    • Create files in a temporary directory

      • main.exe (PID: 6452)
      • selenium-manager.exe (PID: 6720)
      • chromedriver.exe (PID: 6188)

    • Checks supported languages

      • main.exe (PID: 6452)
      • main.exe (PID: 6580)
      • selenium-manager.exe (PID: 6720)
      • chromedriver.exe (PID: 6188)
      • TextInputHost.exe (PID: 2424)

    • Reads the computer name

      • main.exe (PID: 6452)
      • selenium-manager.exe (PID: 6720)
      • main.exe (PID: 6580)
      • TextInputHost.exe (PID: 2424)
      • chromedriver.exe (PID: 6188)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6852)
      • WMIC.exe (PID: 7104)

    • Checks proxy server information

      • selenium-manager.exe (PID: 6720)

    • PyInstaller has been detected (YARA)

      • main.exe (PID: 6452)
      • main.exe (PID: 6580)

    • Application launched itself

      • chrome.exe (PID: 5504)

    • Reads Microsoft Office registry keys

      • chrome.exe (PID: 5504)

    • The process uses the downloaded file

      • chrome.exe (PID: 7160)
      • chrome.exe (PID: 2336)
      • chrome.exe (PID: 3324)
      • chrome.exe (PID: 6508)
      • chrome.exe (PID: 188)
      • chrome.exe (PID: 208)
      • chrome.exe (PID: 7128)
      • chrome.exe (PID: 6172)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:06:22 08:36:07+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 172032
InitializedDataSize: 151040
UninitializedDataSize: -
EntryPoint: 0xb220
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
162
Monitored processes
41
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start THREAT main.exe conhost.exe no specs THREAT main.exe no specs selenium-manager.exe conhost.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs cmd.exe no specs wmic.exe no specs chromedriver.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs textinputhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir6188_753308468" --no-appcompat-clear --enable-logging --log-level=0 --mojo-platform-channel-handle=5028 --field-trial-handle=2020,i,14893965850219824691,12526779381871952773,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
208"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir6188_753308468" --no-appcompat-clear --enable-logging --log-level=0 --mojo-platform-channel-handle=508 --field-trial-handle=2020,i,14893965850219824691,12526779381871952773,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1120"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-logging --log-level=0 --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir6188_753308468" --no-appcompat-clear --enable-logging --log-level=0 --mojo-platform-channel-handle=4804 --field-trial-handle=2020,i,14893965850219824691,12526779381871952773,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1748"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-logging --log-level=0 --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir6188_753308468" --no-appcompat-clear --enable-logging --log-level=0 --mojo-platform-channel-handle=5012 --field-trial-handle=2020,i,14893965850219824691,12526779381871952773,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1948"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-logging --log-level=0 --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir6188_753308468" --no-appcompat-clear --enable-logging --log-level=0 --mojo-platform-channel-handle=5828 --field-trial-handle=2020,i,14893965850219824691,12526779381871952773,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2128"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-logging --log-level=0 --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir6188_753308468" --no-appcompat-clear --enable-logging --log-level=0 --mojo-platform-channel-handle=5640 --field-trial-handle=2020,i,14893965850219824691,12526779381871952773,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2204"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --enable-logging --log-level=0 --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir6188_753308468" --no-appcompat-clear --enable-logging --log-level=0 --mojo-platform-channel-handle=4940 --field-trial-handle=2020,i,14893965850219824691,12526779381871952773,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2336"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir6188_753308468" --no-appcompat-clear --enable-logging --log-level=0 --mojo-platform-channel-handle=4808 --field-trial-handle=2020,i,14893965850219824691,12526779381871952773,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2392"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\admin\AppData\Local\Temp\scoped_dir6188_753308468" --no-appcompat-clear --enable-logging --log-level=0 --mojo-platform-channel-handle=5440 --field-trial-handle=2020,i,14893965850219824691,12526779381871952773,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2424"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
Total events
18 478
Read events
18 368
Write events
101
Delete events
9

Modification events

(PID) Process:(5504) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(5504) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(5504) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(5504) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(5504) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(5504) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(5504) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(5504) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(5504) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(5504) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
30
Suspicious files
183
Text files
48
Unknown types
9

Dropped files

PID
Process
Filename
Type
6452main.exeC:\Users\admin\AppData\Local\Temp\_MEI64522\_asyncio.pydexecutable
MD5:477DBA4D6E059EA3D61FAD7B6A7DA10E
SHA256:5BEBEB765AB9EF045BC5515166360D6F53890D3AD6FC360C20222D61841410B6
6452main.exeC:\Users\admin\AppData\Local\Temp\_MEI64522\VCRUNTIME140_1.dllexecutable
MD5:F8DFA78045620CF8A732E67D1B1EB53D
SHA256:A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5
6452main.exeC:\Users\admin\AppData\Local\Temp\_MEI64522\VCRUNTIME140.dllexecutable
MD5:BE8DBE2DC77EBE7F88F910C61AEC691A
SHA256:4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
6452main.exeC:\Users\admin\AppData\Local\Temp\_MEI64522\_ctypes.pydexecutable
MD5:FB454C5E74582A805BC5E9F3DA8EDC7B
SHA256:74E0E8384F6C2503215F4CF64C92EFE7257F1AEC44F72D67AD37DC8BA2530BC1
6452main.exeC:\Users\admin\AppData\Local\Temp\_MEI64522\_bz2.pydexecutable
MD5:5BEBC32957922FE20E927D5C4637F100
SHA256:3ED0E5058D370FB14AA5469D81F96C5685559C054917C7280DD4125F21D25F62
6452main.exeC:\Users\admin\AppData\Local\Temp\_MEI64522\selenium\webdriver\common\linux\selenium-manager —
MD5:—
SHA256:—
6452main.exeC:\Users\admin\AppData\Local\Temp\_MEI64522\selenium\webdriver\common\macos\selenium-manager —
MD5:—
SHA256:—
6452main.exeC:\Users\admin\AppData\Local\Temp\_MEI64522\_overlapped.pydexecutable
MD5:7E4553CA5C269E102EB205585CC3F6B4
SHA256:D5F89859609371393D379B5FFD98E5B552078050E8B02A8E2900FA9B4EE8FF91
6452main.exeC:\Users\admin\AppData\Local\Temp\_MEI64522\_decimal.pydexecutable
MD5:492C0C36D8ED1B6CA2117869A09214DA
SHA256:B8221D1C9E2C892DD6227A6042D1E49200CD5CB82ADBD998E4A77F4EE0E9ABF1
6452main.exeC:\Users\admin\AppData\Local\Temp\_MEI64522\_queue.pydexecutable
MD5:B7E5FBD7EF3EEFFF8F502290C0E2B259
SHA256:DBDABB5FE0CCBC8B951A2C6EC033551836B072CAB756AAA56B6F22730080D173
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
40
DNS requests
29
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
142.250.186.78:443
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.MGCxJbnW_Xw.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo9xa4htLEVH9xe6c4ToUehtTaLWvA/cb=gapi.loaded_0
unknown
—
—
—
—
—
OPTIONS
200
142.250.184.234:443
https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData
unknown
—
—
—
6612
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/advisaov4e5ygwpflotgccocvtpq_2024.8.18.1/kiabhabjdbkjdpjbpigfodbdjmbglcoo_2024.08.18.01_all_acwufrt74pi46kzorf2ppo2jx55q.crx3
unknown
—
—
whitelisted
6612
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/advisaov4e5ygwpflotgccocvtpq_2024.8.18.1/kiabhabjdbkjdpjbpigfodbdjmbglcoo_2024.08.18.01_all_acwufrt74pi46kzorf2ppo2jx55q.crx3
unknown
—
—
whitelisted
6612
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/advisaov4e5ygwpflotgccocvtpq_2024.8.18.1/kiabhabjdbkjdpjbpigfodbdjmbglcoo_2024.08.18.01_all_acwufrt74pi46kzorf2ppo2jx55q.crx3
unknown
—
—
whitelisted
6612
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/advisaov4e5ygwpflotgccocvtpq_2024.8.18.1/kiabhabjdbkjdpjbpigfodbdjmbglcoo_2024.08.18.01_all_acwufrt74pi46kzorf2ppo2jx55q.crx3
unknown
—
—
whitelisted
6612
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/advisaov4e5ygwpflotgccocvtpq_2024.8.18.1/kiabhabjdbkjdpjbpigfodbdjmbglcoo_2024.08.18.01_all_acwufrt74pi46kzorf2ppo2jx55q.crx3
unknown
—
—
whitelisted
6612
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acjorihahlyu72rloqnbu7332qhq_461/lmelglejhemejginpboagddgdfbepgmp_461_all_ZZ_mav3a7b644cj7o7ytbibd6ujoq.crx3
unknown
—
—
whitelisted
6612
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acjorihahlyu72rloqnbu7332qhq_461/lmelglejhemejginpboagddgdfbepgmp_461_all_ZZ_mav3a7b644cj7o7ytbibd6ujoq.crx3
unknown
—
—
whitelisted
—
—
POST
200
142.250.185.227:443
https://update.googleapis.com/service/update2/json?cup2key=13:D5WUBZOUonYAuVoOWlyNwd5sZy_ZDG7nNAfIXpp06jc&cup2hreq=21a5080ca97a88980e902822b06cf9f0d500935a7ee1c61042366a25d22cc369
unknown
text
22.9 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5040
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4084
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6720
selenium-manager.exe
169.150.247.38:443
plausible.io
—
GB
unknown
6720
selenium-manager.exe
185.199.108.153:443
googlechromelabs.github.io
FASTLY
US
shared
5040
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4324
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.78
whitelisted
plausible.io
  • 169.150.247.38
whitelisted
googlechromelabs.github.io
  • 185.199.108.153
  • 185.199.110.153
  • 185.199.111.153
  • 185.199.109.153
unknown
storage.googleapis.com
  • 142.250.186.91
  • 216.58.206.91
  • 216.58.212.155
  • 142.250.185.91
  • 142.250.186.155
  • 216.58.206.59
  • 172.217.18.123
  • 142.250.186.59
  • 142.250.185.123
  • 172.217.16.219
  • 172.217.16.155
  • 142.250.185.155
  • 172.217.18.27
  • 172.217.23.123
  • 142.250.186.123
  • 142.250.184.219
whitelisted
accounts.google.com
  • 108.177.15.84
whitelisted
www.google.com
  • 142.250.186.132
whitelisted
www.gstatic.com
  • 172.217.16.195
whitelisted
ogads-pa.googleapis.com
  • 142.250.185.170
  • 142.250.185.106
  • 172.217.18.10
  • 142.250.186.106
  • 172.217.23.106
  • 142.250.185.138
  • 142.250.185.234
  • 142.250.184.234
  • 142.250.186.138
  • 216.58.206.74
  • 142.250.185.202
  • 142.250.186.170
  • 216.58.206.42
  • 172.217.18.106
  • 142.250.185.74
  • 172.217.16.202
whitelisted
apis.google.com
  • 172.217.23.110
whitelisted

Threats

No threats detected
Process
Message
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\scoped_dir6188_753308468 directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
main.exe