File name:

T6UV Series EN CPS setup.exe

Full analysis: https://app.any.run/tasks/c86dfc1d-8841-4699-a829-b8103c98a4d4
Verdict: Malicious activity
Analysis date: March 12, 2024, 10:10:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

6877468AE3FD6F737A19753104D1801B

SHA1:

E558129916FE775E81F6ADBF2DAA6EFD0B877049

SHA256:

5EC618E8685CDC96BE90FBF3551EE402D7A89796C37F16819405B7F835B65905

SSDEEP:

98304:9zqGPqjIJfmXHH5fXpAz2ovQ1Bw9gfIGBvziDCED0mJVKJPjMrFPQ0TkZ96Clomk:hjO7Jry

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • T6UV Series EN CPS setup.exe (PID: 4052)
      • T6UV Series EN CPS setup.exe (PID: 2840)
      • T6UV Series EN CPS setup.tmp (PID: 3944)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • T6UV Series EN CPS setup.exe (PID: 4052)
      • T6UV Series EN CPS setup.exe (PID: 2840)
      • T6UV Series EN CPS setup.tmp (PID: 3944)

    • Non-standard symbols in registry

      • T6UV Series EN CPS setup.tmp (PID: 3944)

    • Reads the Internet Settings

      • T6UV Series EN CPS.exe (PID: 1040)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2156)
      • T6UV Series EN CPS.exe (PID: 1040)

    • Creates file in the systems drive root

      • chrome.exe (PID: 3636)

    • Application launched itself

      • WinRAR.exe (PID: 2156)

    • Reads the Windows owner or organization settings

      • T6UV Series EN CPS setup.tmp (PID: 3944)

  • INFO

    • Create files in a temporary directory

      • T6UV Series EN CPS setup.exe (PID: 4052)
      • T6UV Series EN CPS setup.exe (PID: 2840)

    • Reads the computer name

      • T6UV Series EN CPS.exe (PID: 1040)
      • T6UV Series EN CPS setup.tmp (PID: 3656)
      • T6UV Series EN CPS setup.tmp (PID: 3944)

    • Checks supported languages

      • T6UV Series EN CPS setup.exe (PID: 4052)
      • T6UV Series EN CPS setup.tmp (PID: 3656)
      • T6UV Series EN CPS setup.exe (PID: 2840)
      • T6UV Series EN CPS setup.tmp (PID: 3944)
      • T6UV Series EN CPS.exe (PID: 1040)

    • Reads the machine GUID from the registry

      • T6UV Series EN CPS.exe (PID: 1040)

    • Manual execution by a user

      • explorer.exe (PID: 1696)
      • WinRAR.exe (PID: 2156)
      • chrome.exe (PID: 980)

    • Creates files in the program directory

      • WinRAR.exe (PID: 2724)
      • T6UV Series EN CPS setup.tmp (PID: 3944)

    • Application launched itself

      • chrome.exe (PID: 980)

    • Creates a software uninstall entry

      • T6UV Series EN CPS setup.tmp (PID: 3944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 41984
InitializedDataSize: 17920
UninitializedDataSize: -
EntryPoint: 0xaad0
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: My Company, Inc.
FileDescription: T6UV Series EN CPS Setup
FileVersion:
LegalCopyright:
ProductName: T6UV Series EN CPS
ProductVersion: 1.1.8
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
75
Monitored processes
31
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start t6uv series en cps setup.exe t6uv series en cps setup.tmp no specs t6uv series en cps setup.exe t6uv series en cps setup.tmp t6uv series en cps.exe no specs explorer.exe no specs winrar.exe no specs winrar.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2116 --field-trial-handle=1140,i,1294812720332089212,12817117599506912276,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
752"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3408 --field-trial-handle=1140,i,1294812720332089212,12817117599506912276,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
908"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3908 --field-trial-handle=1140,i,1294812720332089212,12817117599506912276,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
968"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1140,i,1294812720332089212,12817117599506912276,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
980"C:\Program Files\Google\Chrome\Application\chrome.exe" "--disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction,OptimizationHints"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1040"C:\Program Files\T6UV Series EN CPS\T6UV Series EN CPS.exe"C:\Program Files\T6UV Series EN CPS\T6UV Series EN CPS.exe—T6UV Series EN CPS setup.tmp
User:
admin
Integrity Level:
MEDIUM
Description:
BF-H802 CPS
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\t6uv series en cps\t6uv series en cps.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1696"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1892"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=1396 --field-trial-handle=1140,i,1294812720332089212,12817117599506912276,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2156"C:\Program Files\WinRAR\WinRAR.exe" a -ep1 -scul -r0 -iext -- "T6UV Series EN CPS.rar" "C:\Program Files\T6UV Series EN CPS"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2408"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=2444 --field-trial-handle=1140,i,1294812720332089212,12817117599506912276,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
19 804
Read events
19 529
Write events
263
Delete events
12

Modification events

(PID) Process:(3944) T6UV Series EN CPS setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
680F0000FE45F29A6574DA01
(PID) Process:(3944) T6UV Series EN CPS setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
550B76E7FF9B880C4BC8991B22F237094BF6E5DE1C075BC2EE58BE157F88C080
(PID) Process:(3944) T6UV Series EN CPS setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(3944) T6UV Series EN CPS setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files\T6UV Series EN CPS\T6UV Series EN CPS.exe
(PID) Process:(3944) T6UV Series EN CPS setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
86474F77C6CCD7AC4457B9CBFD49A231AC9DCC7953970735ED4CFDC95FECF911
(PID) Process:(3944) T6UV Series EN CPS setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB50FC8A-3387-49BE-B7C9-7993E7284C66}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.6.1 (a)
(PID) Process:(3944) T6UV Series EN CPS setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB50FC8A-3387-49BE-B7C9-7993E7284C66}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\T6UV Series EN CPS
(PID) Process:(3944) T6UV Series EN CPS setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB50FC8A-3387-49BE-B7C9-7993E7284C66}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\T6UV Series EN CPS\
(PID) Process:(3944) T6UV Series EN CPS setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB50FC8A-3387-49BE-B7C9-7993E7284C66}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
T6UV Series EN CPS
(PID) Process:(3944) T6UV Series EN CPS setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB50FC8A-3387-49BE-B7C9-7993E7284C66}_is1
Operation:writeName:Inno Setup: User
Value:
admin
Executable files
11
Suspicious files
72
Text files
63
Unknown types
245

Dropped files

PID
Process
Filename
Type
980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF185e38.TMP —
MD5:—
SHA256:—
980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
2840T6UV Series EN CPS setup.exeC:\Users\admin\AppData\Local\Temp\is-B2R70.tmp\T6UV Series EN CPS setup.tmpexecutable
MD5:1AFBD25DB5C9A90FE05309F7C4FBCF09
SHA256:3BB0EE5569FE5453C6B3FA25AA517B925D4F8D1F7BA3475E58FA09C46290658C
3944T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\is-BUHBK.tmpexecutable
MD5:58D4CA6492C206804922F894BF44B0B1
SHA256:5FB0880F45602A56A55DFBA6E9A20A7972AC9F75E4286FD8F406372E0343AE1D
980chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
3944T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\Import Picture tools.exeexecutable
MD5:802791FDBABD58D3B59FBE4A24C91C42
SHA256:88236DB4452230C512526AB1B7D5C2DE438295CD0A6B6BAAA2AE0AFB0C72ED59
3944T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\is-32371.tmpexecutable
MD5:CD983F0B33227D008BE4124DE8B92FD2
SHA256:7904632680724542DF22D6901986DDBE2BA7D3C999E67F3ED7B496CE8575BFDC
3944T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\T6UV Series EN CPS.exeexecutable
MD5:58D4CA6492C206804922F894BF44B0B1
SHA256:5FB0880F45602A56A55DFBA6E9A20A7972AC9F75E4286FD8F406372E0343AE1D
3944T6UV Series EN CPS setup.tmpC:\Program Files\T6UV Series EN CPS\is-O6O68.tmpexecutable
MD5:802791FDBABD58D3B59FBE4A24C91C42
SHA256:88236DB4452230C512526AB1B7D5C2DE438295CD0A6B6BAAA2AE0AFB0C72ED59
3944T6UV Series EN CPS setup.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\T6UV Series EN CPS\Uninstall T6UV Series EN CPS.lnklnk
MD5:51351314447AE3F87E06B266D7EA508C
SHA256:C8A2852534784C25810BB14B3D43C4B6B9C79B7EABAE6654B123F4CF76408FA8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
62
DNS requests
43
Threats
257

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1892
chrome.exe
GET
301
52.95.146.240:80
http://filepastebin.com/
unknown
—
—
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3
unknown
binary
5.45 Kb
unknown
1892
chrome.exe
GET
301
52.60.130.215:80
http://www.filepastebin.com/
unknown
html
134 b
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3
unknown
binary
9.76 Kb
unknown
856
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3
unknown
—
—
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3
unknown
binary
7.70 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3
unknown
binary
1009 b
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3
unknown
binary
10.3 Kb
unknown
856
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567854667.14/obedbbhbpmojnkanicioggnmelmoomoc_20230916.567854667.14_all_ENUS500000_lr7434qyx46lykosg2elaepqdi.crx3
unknown
binary
1009 b
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567854667.14/obedbbhbpmojnkanicioggnmelmoomoc_20230916.567854667.14_all_ENUS500000_lr7434qyx46lykosg2elaepqdi.crx3
unknown
binary
360 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1892
chrome.exe
142.250.185.227:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
980
chrome.exe
239.255.255.250:1900
—
—
—
unknown
1892
chrome.exe
64.233.184.84:443
accounts.google.com
GOOGLE
US
unknown
1892
chrome.exe
142.250.184.196:443
www.google.com
GOOGLE
US
whitelisted
1892
chrome.exe
172.217.18.3:443
update.googleapis.com
GOOGLE
US
whitelisted
980
chrome.exe
224.0.0.251:5353
—
—
—
unknown
1892
chrome.exe
142.250.186.46:443
encrypted-tbn0.gstatic.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 142.250.185.227
whitelisted
accounts.google.com
  • 64.233.184.84
shared
www.google.com
  • 142.250.184.196
whitelisted
update.googleapis.com
  • 172.217.18.3
whitelisted
encrypted-tbn0.gstatic.com
  • 142.250.186.46
whitelisted
filepastebin.com
  • 52.95.190.104
  • 16.12.5.112
  • 16.12.5.120
  • 52.95.145.232
  • 52.95.145.185
  • 52.95.146.169
  • 52.95.146.240
  • 52.95.190.80
unknown
www.filepastebin.com
  • 52.60.130.215
  • 35.182.107.78
  • 15.157.164.25
unknown
fonts.gstatic.com
  • 142.250.181.227
whitelisted
fonts.googleapis.com
  • 172.217.18.106
whitelisted
www.googletagmanager.com
  • 142.250.185.104
whitelisted

Threats

PID
Process
Class
Message
1892
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)
1892
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)
1892
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)
1892
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)
1892
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)
1892
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)
1892
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)
1892
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)
1892
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)
1892
chrome.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
T6UV Series EN CPS setup.exe