| File name: | temp.txt |
| Full analysis: | https://app.any.run/tasks/44805cba-b350-4d6b-be62-74564d6f8856 |
| Verdict: | Malicious activity |
| Analysis date: | May 20, 2019, 21:07:18 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text |
| MD5: | 7F8E6E26FC2363632CC04991548128BD |
| SHA1: | ADC7023D09E011EE808FAC94A8245C8100D9FF32 |
| SHA256: | 61742001AEAC832142612C848C83A1079699F4596B61ECFD644F659D79882ADB |
| SSDEEP: | 3:N8Ck3CTwKbldmQcw3QLb6Qcw0XUcQaApjZIjvn:2CkST/ZYQcw3Q6QcwbRpFo |
PID | CMD | Path | Indicators | Parent process | |||
|---|---|---|---|---|---|---|---|
| 324 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | — | EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | |||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||
| 704 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | — | EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | |||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||
| 756 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | — | EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | |||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||
| 860 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | — | EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | |||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||
| 880 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | — | EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | |||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||
| 1032 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | — | EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | |||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||
| 1152 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | — | EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | |||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||
| 1236 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | — | EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | |||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||
| 1364 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | — | EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | |||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||
| 2080 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3824.48163\EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | — | EP-RFQ-20-012 EP-19-20-009 - EP-19-20010.exe | |||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||
| (PID) Process: | (3992)Â chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (3992)Â chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (3992)Â chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (3992)Â chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (3992)Â chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (3844)Â chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | write | Name: | 3992-13202860061057875 |
Value: 259 | |||
| (PID) Process: | (3992)Â chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (3992)Â chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (3992)Â chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 3488-13197474229333984 |
Value: 0 | |||
| (PID) Process: | (3992)Â chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3992 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index | — | |
MD5:— | SHA256:— | |||
| 3992 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0 | — | |
MD5:— | SHA256:— | |||
| 3992 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 | — | |
MD5:— | SHA256:— | |||
| 3992 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2 | — | |
MD5:— | SHA256:— | |||
| 3992 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3 | — | |
MD5:— | SHA256:— | |||
| 3992 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\74f66a01-7eb2-4a6a-a22d-633f8a336e56.tmp | — | |
MD5:— | SHA256:— | |||
| 3992 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000018.dbtmp | — | |
MD5:— | SHA256:— | |||
| 3992 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index | — | |
MD5:— | SHA256:— | |||
| 3992 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0 | — | |
MD5:— | SHA256:— | |||
| 3992 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1 | — | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3992 | chrome.exe | GET | 200 | 74.125.8.40:80 | http://r2---sn-5hne6n7s.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjJlQUFXRC12Ny1ldUFnMXF3SDlXZDlFZw/7319.128.0.1_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=185.212.170.83&mm=28&mn=sn-5hne6n7s&ms=nvh&mt=1558385964&mv=u&pl=24&shardbypass=yes | US | crx | 842 Kb | whitelisted |
3992 | chrome.exe | GET | 302 | 172.217.18.14:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjJlQUFXRC12Ny1ldUFnMXF3SDlXZDlFZw/7319.128.0.1_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx | US | html | 505 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3992 | chrome.exe | 172.217.16.163:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
3992 | chrome.exe | 216.58.206.14:443 | apis.google.com | Google Inc. | US | whitelisted |
3992 | chrome.exe | 13.107.42.12:443 | qaziww.bn.files.1drv.com | Microsoft Corporation | US | suspicious |
— | — | 172.217.22.10:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
3992 | chrome.exe | 172.217.22.13:443 | accounts.google.com | Google Inc. | US | whitelisted |
3992 | chrome.exe | 172.217.23.131:443 | www.gstatic.com | Google Inc. | US | whitelisted |
3992 | chrome.exe | 13.107.42.13:443 | onedrive.live.com | Microsoft Corporation | US | malicious |
3992 | chrome.exe | 172.217.16.142:443 | sb-ssl.google.com | Google Inc. | US | whitelisted |
3992 | chrome.exe | 216.58.205.227:443 | www.google.ch | Google Inc. | US | whitelisted |
3992 | chrome.exe | 216.58.208.33:443 | clients2.googleusercontent.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
clientservices.googleapis.com |
| whitelisted |
www.google.com.ua |
| whitelisted |
accounts.google.com |
| shared |
clients1.google.com |
| whitelisted |
ssl.gstatic.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
apis.google.com |
| whitelisted |
onedrive.live.com |
| shared |
qaziww.bn.files.1drv.com |
| whitelisted |
sb-ssl.google.com |
| whitelisted |