URL:

https://www.chip.de/downloads/GPL-Ghostscript-64-Bit_48369029.html

Full analysis: https://app.any.run/tasks/3934c7d7-52b6-4b44-9516-a6dce4429fba
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 27, 2020, 15:11:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

4A4BA5F5102D08526C8E52A906669D7F

SHA1:

9CFB56E71ECC35EDFE086FB84EA6645212C4E45C

SHA256:

5F29A5DC2328276C3EC0A7D0670AC06EF3535D585BCF8CA5B4E438403DB4290C

SSDEEP:

3:N8DSLBBiKWmiYWBc7eaMR2Pc5R0:2OL5WmiXc7ea45R0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • GPL Ghostscript 64 Bit - CHIP-Installer.exe (PID: 576)
      • dmr_72.exe (PID: 1800)
      • GPL Ghostscript 64 Bit - CHIP-Installer.exe (PID: 2300)
      • GPL Ghostscript 64 Bit - CHIP-Installer.exe (PID: 2492)
      • dmr_72.exe (PID: 608)
      • gs952w64.exe (PID: 2144)
      • GPL Ghostscript 64 Bit - CHIP-Installer.exe (PID: 3836)
      • gpcl6win32.exe (PID: 2836)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 3868)

    • Loads dropped or rewritten executable

      • gs952w64.exe (PID: 2144)
      • SearchProtocolHost.exe (PID: 3092)
      • gpcl6win32.exe (PID: 2836)
      • explorer.exe (PID: 372)

    • Downloads executable files from the Internet

      • dmr_72.exe (PID: 608)

    • Changes settings of System certificates

      • dmr_72.exe (PID: 608)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3148)
      • GPL Ghostscript 64 Bit - CHIP-Installer.exe (PID: 2492)
      • dmr_72.exe (PID: 608)
      • gs952w64.exe (PID: 2144)
      • WinRAR.exe (PID: 3476)
      • GPL Ghostscript 64 Bit - CHIP-Installer.exe (PID: 3836)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3148)

    • Reads Environment values

      • dmr_72.exe (PID: 608)

    • Reads internet explorer settings

      • dmr_72.exe (PID: 608)

    • Reads Internet Cache Settings

      • dmr_72.exe (PID: 608)

    • Creates files in the user directory

      • explorer.exe (PID: 372)
      • dmr_72.exe (PID: 608)

    • Starts CMD.EXE for self-deleting

      • dmr_72.exe (PID: 608)

    • Starts CMD.EXE for commands execution

      • dmr_72.exe (PID: 608)

    • Uses RUNDLL32.EXE to load library

      • explorer.exe (PID: 372)

    • Adds / modifies Windows certificates

      • dmr_72.exe (PID: 608)

    • Searches for installed software

      • dmr_72.exe (PID: 608)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 3148)
      • chrome.exe (PID: 3800)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 3148)

    • Reads settings of System Certificates

      • chrome.exe (PID: 3148)
      • chrome.exe (PID: 3800)
      • dmr_72.exe (PID: 608)

    • Dropped object may contain Bitcoin addresses

      • GPL Ghostscript 64 Bit - CHIP-Installer.exe (PID: 3836)
      • GPL Ghostscript 64 Bit - CHIP-Installer.exe (PID: 2492)

    • Application launched itself

      • chrome.exe (PID: 3148)

    • Manual execution by user

      • explorer.exe (PID: 3500)
      • gpcl6win32.exe (PID: 2836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
102
Monitored processes
55
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs gpl ghostscript 64 bit - chip-installer.exe no specs gpl ghostscript 64 bit - chip-installer.exe dmr_72.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs gpl ghostscript 64 bit - chip-installer.exe no specs gpl ghostscript 64 bit - chip-installer.exe dmr_72.exe gs952w64.exe cmd.exe no specs ping.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe explorer.exe no specs searchprotocolhost.exe no specs gpcl6win32.exe no specs explorer.exe no specs rundll32.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
308"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,17691854743056980599,8816707086914465452,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5501455766479994842 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=944 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
372C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
576"C:\Users\admin\Downloads\GPL Ghostscript 64 Bit - CHIP-Installer.exe" C:\Users\admin\Downloads\GPL Ghostscript 64 Bit - CHIP-Installer.exe—chrome.exe
User:
admin
Company:
CHIP Digital GmbH
Integrity Level:
MEDIUM
Description:
CHIP Secured Installer
Exit code:
3221226540
Version:
2.11.0.9
Modules
Images
c:\users\admin\downloads\gpl ghostscript 64 bit - chip-installer.exe
c:\systemroot\system32\ntdll.dll
608"C:\Users\admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54486517 -chipderedesign -e8bed99578e5400d838afb2ae5622362 - -BLUB2 -xxnsrxxfuflwyjwj -2492C:\Users\admin\AppData\Local\Temp\DMR\dmr_72.exe
GPL Ghostscript 64 Bit - CHIP-Installer.exe
User:
admin
Company:
Chip Digital GmbH
Integrity Level:
HIGH
Description:
CHIP Secured Installer
Exit code:
0
Version:
2.11.0.9
Modules
Images
c:\users\admin\appdata\local\temp\dmr\dmr_72.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
620"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,17691854743056980599,8816707086914465452,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17255914553031037339 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
944"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3748 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1800"C:\Users\admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54486517 -chipderedesign -e8bed99578e5400d838afb2ae5622362 - -BLUB2 -wyjthqdidqxipgpj -3836C:\Users\admin\AppData\Local\Temp\DMR\dmr_72.exe
GPL Ghostscript 64 Bit - CHIP-Installer.exe
User:
admin
Company:
Chip Digital GmbH
Integrity Level:
HIGH
Description:
CHIP Secured Installer
Exit code:
0
Version:
2.11.0.9
Modules
Images
c:\users\admin\appdata\local\temp\dmr\dmr_72.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1876"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1036,17691854743056980599,8816707086914465452,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=16443499096583313178 --mojo-platform-channel-handle=3048 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2144"C:\Users\admin\AppData\Local\Temp\DMR\Downloads\152e221a8bef8d2d13c58f995563a1a1\bc5b6bc2c9e27dd7d9fefff093c28982\gs952w64.exe" C:\Users\admin\AppData\Local\Temp\DMR\Downloads\152e221a8bef8d2d13c58f995563a1a1\bc5b6bc2c9e27dd7d9fefff093c28982\gs952w64.exe
dmr_72.exe
User:
admin
Integrity Level:
HIGH
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\dmr\downloads\152e221a8bef8d2d13c58f995563a1a1\bc5b6bc2c9e27dd7d9fefff093c28982\gs952w64.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2300"C:\Users\admin\Downloads\GPL Ghostscript 64 Bit - CHIP-Installer.exe" C:\Users\admin\Downloads\GPL Ghostscript 64 Bit - CHIP-Installer.exe—chrome.exe
User:
admin
Company:
CHIP Digital GmbH
Integrity Level:
MEDIUM
Description:
CHIP Secured Installer
Exit code:
3221226540
Version:
2.11.0.9
Modules
Images
c:\users\admin\downloads\gpl ghostscript 64 bit - chip-installer.exe
c:\systemroot\system32\ntdll.dll
Total events
22 936
Read events
20 984
Write events
1 945
Delete events
7

Modification events

(PID) Process:(3148) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3148) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3148) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3148) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(372) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(944) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:3148-13229795505839500
Value:
259
(PID) Process:(3148) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3148) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3148) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3148) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3120-13213713943555664
Value:
0
Executable files
9
Suspicious files
188
Text files
289
Unknown types
24

Dropped files

PID
Process
Filename
Type
3148chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5E7E17B2-C4C.pma —
MD5:—
SHA256:—
3148chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
3148chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\c71472b1-5148-48ac-8476-a7b22042babd.tmp —
MD5:—
SHA256:—
3148chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
3148chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
3148chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RFa66653.TMPtext
MD5:—
SHA256:—
3148chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RFa666b1.TMPtext
MD5:—
SHA256:—
3148chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old~RFa6672e.TMPtext
MD5:—
SHA256:—
3148chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
3148chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RFa66903.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
257
DNS requests
147
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3800
chrome.exe
GET
302
216.58.208.46:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
519 b
whitelisted
608
dmr_72.exe
GET
200
148.251.213.132:80
http://api2.chip-secured-download.de/geoip/geoip.php?ip=38312e31372e3234322e323338&givezip=true
DE
text
2 b
malicious
608
dmr_72.exe
GET
200
148.251.213.132:80
http://api2.chip-secured-download.de/downloaderContent/jquery.corner.js
DE
text
94 b
malicious
608
dmr_72.exe
GET
200
176.9.97.245:80
http://static.chip-secured-download.de/gfx/pagead/Amazon/Amazon-Feb-Test.png
DE
image
31.3 Kb
suspicious
608
dmr_72.exe
GET
200
148.251.213.132:80
http://api2.chip-secured-download.de/downloaderContent/img/bg-icon-speedometer.png
DE
image
5.35 Kb
malicious
608
dmr_72.exe
GET
200
148.251.213.132:80
http://api2.chip-secured-download.de/downloaderContent/progress.php?pid=chipderedesign&cid=54486517&sid=e8bed99578e5400d838afb2ae5622362&appname=47504C2047686F7374736372697074202836342042697429&uid=b5ece2fb-ab65-413e-8d20-ce235b373f67&scid=&source=BLUB2&language=en-ie&piddata=&uaexe=6368726F6D652E657865&Camplist=64386635313338383638323336356261393562616434326463323933303838663B6131636330333036363234353434623530616166613163393038376634336464
DE
htm
2.05 Kb
malicious
608
dmr_72.exe
GET
200
148.251.213.132:80
http://api2.chip-secured-download.de/downloaderContent/main.css?v=1461939270
DE
text
6.02 Kb
malicious
608
dmr_72.exe
GET
200
148.251.213.132:80
http://api2.chip-secured-download.de/track/uac.php?clientid=b5ece2fb-ab65-413e-8d20-ce235b373f67&cid=54486517&pid=chipderedesign&source=BLUB2&setupid=e8bed99578e5400d838afb2ae5622362&langcountry=en-US&state=WithoutUAC
DE
binary
60.8 Kb
malicious
608
dmr_72.exe
GET
200
148.251.213.132:80
http://api2.chip-secured-download.de/progresspagead?source=BLUB2&pid=chipderedesign&Camplist=64386635313338383638323336356261393562616434326463323933303838663B6131636330333036363234353434623530616166613163393038376634336464&cid=54486517
DE
html
760 b
malicious
608
dmr_72.exe
GET
200
148.251.213.132:80
http://api2.chip-secured-download.de/downloaderContent/img/kasper-progresspg-ongrey-en.gif
DE
image
2.30 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3800
chrome.exe
95.101.27.71:443
www.chip.de
Akamai Technologies, Inc.
—
suspicious
3800
chrome.exe
172.217.16.141:443
accounts.google.com
Google Inc.
US
suspicious
3800
chrome.exe
216.58.208.36:443
www.google.com
Google Inc.
US
whitelisted
3800
chrome.exe
18.184.227.125:443
t.myvisualiq.net
—
US
unknown
3800
chrome.exe
95.101.185.159:443
widgets.outbrain.com
CW Vodafone Group PLC
—
unknown
3800
chrome.exe
95.101.27.73:443
www.chip.de
Akamai Technologies, Inc.
—
unknown
3800
chrome.exe
151.101.113.108:443
acdn.adnxs.com
Fastly
US
unknown
3800
chrome.exe
172.217.23.166:443
ad.doubleclick.net
Google Inc.
US
whitelisted
3800
chrome.exe
95.101.186.38:443
tcheck.outbrainimg.com
CW Vodafone Group PLC
—
unknown
3800
chrome.exe
172.217.22.66:443
securepubads.g.doubleclick.net
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 35.181.91.36
  • 15.188.105.205
  • 15.188.31.119
whitelisted
www.chip.de
  • 95.101.27.71
  • 95.101.27.73
whitelisted
accounts.google.com
  • 172.217.16.141
shared
www.google.com
  • 216.58.208.36
malicious
a.bf-ad.net
  • 95.101.27.74
  • 95.101.27.122
whitelisted
adtm.chip.de
  • 95.101.27.71
  • 95.101.27.73
whitelisted
content.chip.de
  • 95.101.27.73
  • 95.101.27.71
suspicious
widgets.outbrain.com
  • 95.101.185.159
whitelisted
t.myvisualiq.net
  • 18.184.227.125
  • 18.184.247.200
  • 18.194.162.83
  • 18.185.207.20
  • 18.195.207.227
  • 18.184.94.45
  • 18.195.174.202
  • 3.120.100.246
whitelisted
a.bf-tools.net
  • 95.101.27.122
  • 95.101.27.74
whitelisted

Threats

PID
Process
Class
Message
608
dmr_72.exe
A Network Trojan was detected
MALWARE [PTsecurity] DownloadSponsor inbound artifact m1
608
dmr_72.exe
A Network Trojan was detected
MALWARE [PTsecurity] DownloadSponsor inbound artifact m1
608
dmr_72.exe
A Network Trojan was detected
MALWARE [PTsecurity] DownloadSponsor img_welcome PNG artifact
608
dmr_72.exe
A Network Trojan was detected
MALWARE [PTsecurity] DownloadSponsor inbound artifact m1
608
dmr_72.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
608
dmr_72.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.chip.de/downloads/GPL-Ghostscript-64-Bit_48369029.html