URL:

http://safetx.ahnlab.com/master/win/default/all/astx_setup.exe

Full analysis: https://app.any.run/tasks/c7fdee34-e04d-4f78-9eed-c88dc680cd57
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: May 08, 2020, 04:39:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
keylogger
Indicators:
MD5:

6213B395BB041D75C3498F115B55A9D7

SHA1:

FD9A8D4F797A1A9DAE21B417265792EFB42A7E0F

SHA256:

7077084861479FE86CDB5310D34DCE064C6DD2CFCB1D7F7B06C370C5106BCCBD

SSDEEP:

3:N1KNEDCCJOICn8ffqEWdyAL4A:CWLOI2g/aJL4A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • astx_setup.exe (PID: 4088)
      • astx_setup.exe (PID: 848)
      • V3Medic.exe (PID: 3180)
      • certutil.exe (PID: 3392)
      • ASDCli.exe (PID: 3812)
      • ASDCli.exe (PID: 2460)
      • ASDSvc.exe (PID: 3432)
      • AKDVE.exe (PID: 1792)
      • AKDVE.exe (PID: 2704)
      • AKDVE.exe (PID: 4072)
      • AKDVE.exe (PID: 3496)
      • ASDWsc.exe (PID: 1464)
      • stsess.exe (PID: 1880)
      • ASDWsc.exe (PID: 984)
      • stsess.exe (PID: 3228)
      • certutil.exe (PID: 1844)
      • StSess.exe (PID: 3708)
      • StCli.exe (PID: 2524)
      • StCli.exe (PID: 2348)
      • StCli.exe (PID: 2844)

    • Downloads executable files from the Internet

      • chrome.exe (PID: 3996)

    • Loads dropped or rewritten executable

      • astx_setup.exe (PID: 4088)
      • certutil.exe (PID: 3392)
      • ASDCli.exe (PID: 3812)
      • V3Medic.exe (PID: 3180)
      • ASDCli.exe (PID: 2460)
      • ASDSvc.exe (PID: 3432)
      • AKDVE.exe (PID: 1792)
      • AKDVE.exe (PID: 4072)
      • AKDVE.exe (PID: 2704)
      • AKDVE.exe (PID: 3496)
      • stsess.exe (PID: 1880)
      • ASDWsc.exe (PID: 1464)
      • ASDWsc.exe (PID: 984)
      • certutil.exe (PID: 1844)
      • chrome.exe (PID: 2344)
      • StSess.exe (PID: 3708)
      • StCli.exe (PID: 2844)
      • stsess.exe (PID: 3228)

    • Actions looks like stealing of personal data

      • certutil.exe (PID: 3392)
      • certutil.exe (PID: 1844)
      • ASDSvc.exe (PID: 3432)

    • Changes settings of System certificates

      • certutil.exe (PID: 2644)
      • certutil.exe (PID: 2596)
      • certutil.exe (PID: 2060)

    • Changes the autorun value in the registry

      • ASDCli.exe (PID: 3812)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2344)
      • astx_setup.exe (PID: 4088)
      • V3Medic.exe (PID: 3180)
      • ASDSvc.exe (PID: 3432)
      • stsess.exe (PID: 3228)
      • StCli.exe (PID: 2348)

    • Creates files in the Windows directory

      • V3Medic.exe (PID: 3180)
      • certutil.exe (PID: 2596)
      • certutil.exe (PID: 2644)
      • certutil.exe (PID: 2888)
      • certutil.exe (PID: 2060)
      • ASDSvc.exe (PID: 3432)

    • Creates or modifies windows services

      • V3Medic.exe (PID: 3180)
      • ASDSvc.exe (PID: 3432)
      • ASDCli.exe (PID: 3812)

    • Writes files like Keylogger logs

      • V3Medic.exe (PID: 3180)

    • Creates files in the driver directory

      • V3Medic.exe (PID: 3180)
      • ASDSvc.exe (PID: 3432)

    • Removes files from Windows directory

      • certutil.exe (PID: 2596)
      • certutil.exe (PID: 2644)
      • certutil.exe (PID: 2888)
      • certutil.exe (PID: 2060)

    • Uses NETSH.EXE for network configuration

      • V3Medic.exe (PID: 3180)
      • stsess.exe (PID: 3228)

    • Creates files in the user directory

      • certutil.exe (PID: 3392)
      • certutil.exe (PID: 1844)

    • Creates files in the program directory

      • V3Medic.exe (PID: 3180)
      • ASDCli.exe (PID: 3812)
      • ASDSvc.exe (PID: 3432)
      • stsess.exe (PID: 1880)
      • ASDWsc.exe (PID: 1464)
      • stsess.exe (PID: 3228)
      • StSess.exe (PID: 3708)
      • StCli.exe (PID: 2844)
      • StCli.exe (PID: 2348)

    • Creates a software uninstall entry

      • V3Medic.exe (PID: 3180)

    • Executed as Windows Service

      • ASDSvc.exe (PID: 3432)

    • Reads Internet Cache Settings

      • stsess.exe (PID: 3228)

    • Low-level read access rights to disk partition

      • stsess.exe (PID: 3228)

    • Searches for installed software

      • ASDSvc.exe (PID: 3432)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 2344)

    • Reads the hosts file

      • chrome.exe (PID: 2344)
      • chrome.exe (PID: 3996)
      • ASDSvc.exe (PID: 3432)
      • stsess.exe (PID: 3228)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 2344)

    • Reads settings of System Certificates

      • chrome.exe (PID: 3996)
      • ASDCli.exe (PID: 3812)
      • ASDCli.exe (PID: 2460)
      • ASDWsc.exe (PID: 1464)
      • stsess.exe (PID: 1880)
      • StSess.exe (PID: 3708)
      • StCli.exe (PID: 2844)
      • stsess.exe (PID: 3228)
      • ASDWsc.exe (PID: 984)

    • Manual execution by user

      • StCli.exe (PID: 2348)
      • StCli.exe (PID: 2524)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
100
Monitored processes
39
Malicious processes
15
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs astx_setup.exe no specs astx_setup.exe chrome.exe no specs v3medic.exe chrome.exe no specs certutil.exe no specs certutil.exe no specs certutil.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs asdcli.exe asdcli.exe no specs asdsvc.exe akdve.exe no specs akdve.exe no specs akdve.exe no specs akdve.exe no specs stsess.exe no specs asdwsc.exe no specs asdwsc.exe no specs stsess.exe certutil.exe no specs certutil.exe no specs certutil.exe netsh.exe no specs stsess.exe no specs stcli.exe no specs stcli.exe stcli.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
848"C:\Users\admin\Downloads\astx_setup.exe" C:\Users\admin\Downloads\astx_setup.exe—chrome.exe
User:
admin
Company:
AhnLab, Inc.
Integrity Level:
MEDIUM
Description:
AhnLab Safe Transaction Setup Program.
Exit code:
3221226540
Version:
1.3.64.1419
Modules
Images
c:\users\admin\downloads\astx_setup.exe
c:\systemroot\system32\ntdll.dll
984"C:\Program Files\AhnLab\Safe Transaction\ASDWsc.exe" /as /register /accessflag:1 /uptodate:0C:\Program Files\AhnLab\Safe Transaction\ASDWsc.exe—ASDSvc.exe
User:
SYSTEM
Company:
AhnLab, Inc.
Integrity Level:
SYSTEM
Description:
ASDF WSC Control Application
Exit code:
126
Version:
2, 5, 0, 75
Modules
Images
c:\program files\ahnlab\safe transaction\asdwsc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1440netsh advfirewall firewall set rule name="AhnLab Safe Transaction" dir=in new action=allow program="C:\Program Files\AhnLab\Safe Transaction\StSess.exe" enable=yesC:\Windows\system32\netsh.exe—stsess.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1456"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,11281495096146319585,17719010613494468361,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6259700909286238874 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1464"C:\Program Files\AhnLab\Safe Transaction\ASDWsc.exe" /av /register /accessflag:1 /uptodate:0C:\Program Files\AhnLab\Safe Transaction\ASDWsc.exe—ASDSvc.exe
User:
SYSTEM
Company:
AhnLab, Inc.
Integrity Level:
SYSTEM
Description:
ASDF WSC Control Application
Exit code:
126
Version:
2, 5, 0, 75
Modules
Images
c:\program files\ahnlab\safe transaction\asdwsc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1772"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,11281495096146319585,17719010613494468361,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=15688181619548024854 --mojo-platform-channel-handle=1056 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1792"C:\Program Files\AhnLab\Safe Transaction\AKDVE.exe" 1100010001001000000000000000000_AntiStealth_SafeTransactionFC:\Program Files\AhnLab\Safe Transaction\AKDVE.exe—ASDSvc.exe
User:
SYSTEM
Company:
AhnLab, Inc.
Integrity Level:
SYSTEM
Description:
AKDVE
Exit code:
0
Version:
2, 11, 0, 1
Modules
Images
c:\program files\ahnlab\safe transaction\akdve.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\ahnlab\safe transaction\ahawke.dll
c:\windows\system32\psapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1844"C:\Program Files\AhnLab\Safe Transaction\Cert\nss\certutil" -A -n "ASTxRoot2" -d sql:"C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default" -t "C,," -i "C:\Program Files\AhnLab\Safe Transaction\Cert\ca2.der"C:\Program Files\AhnLab\Safe Transaction\Cert\nss\certutil.exe
stsess.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\ahnlab\safe transaction\cert\nss\certutil.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\ahnlab\safe transaction\cert\nss\nssutil3.dll
c:\program files\ahnlab\safe transaction\cert\nss\libplc4.dll
c:\program files\ahnlab\safe transaction\cert\nss\libnspr4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1852netsh advfirewall firewall delete rule name="AhnLab Safe Transaction" dir=inC:\Windows\system32\netsh.exe—V3Medic.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\credui.dll
1880"C:\Program Files\AhnLab\Safe Transaction\stsess.exe" /trayC:\Program Files\AhnLab\Safe Transaction\stsess.exe—ASDSvc.exe
User:
admin
Company:
AhnLab, Inc.
Integrity Level:
MEDIUM
Description:
AhnLab Safe Transaction Application
Exit code:
0
Version:
1, 4, 0, 76
Modules
Images
c:\program files\ahnlab\safe transaction\stsess.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
3 755
Read events
2 869
Write events
882
Delete events
4

Modification events

(PID) Process:(2344) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2344) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2344) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2344) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2344) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2344) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2344) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2344) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3120-13213713943555664
Value:
0
(PID) Process:(2344) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:2344-13233386360686250
Value:
259
(PID) Process:(2344) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
173
Suspicious files
2 617
Text files
465
Unknown types
51

Dropped files

PID
Process
Filename
Type
2344chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5EB4E279-928.pma —
MD5:—
SHA256:—
2344chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\b7834849-9543-4a8d-b2e1-f2036c804fe2.tmp —
MD5:—
SHA256:—
2344chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
2344chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old —
MD5:—
SHA256:—
2344chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old —
MD5:—
SHA256:—
2344chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
2344chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
2344chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:—
SHA256:—
2344chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
2344chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RFa88607.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1 039
TCP/UDP connections
23
DNS requests
13
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3432
ASDSvc.exe
GET
200
34.246.64.247:80
http://gms.ahnlab.com/jk?c=2&p=Ho50vAvX+MM6e7hWk9nBPxLNPvcO8yEaFMG0+r0MqjI=&k=1
IE
—
—
unknown
3432
ASDSvc.exe
GET
200
34.246.64.247:80
http://gms.ahnlab.com/jk?c=65&p=ysb1tHFox99KneFEGDugxBBwGsNPlTEh3sFfTG1AKHQ=&k=1
IE
text
56 b
unknown
3228
stsess.exe
HEAD
200
163.171.75.66:80
http://webclinic.ahnlab.com/astx/policy/starter_ply.html
US
compressed
329 Kb
suspicious
3228
stsess.exe
HEAD
200
163.171.75.66:80
http://webclinic.ahnlab.com/astx/policy/extraopn_ply.html
US
compressed
62.4 Kb
suspicious
3432
ASDSvc.exe
GET
200
34.246.64.247:80
http://gms.ahnlab.com/jk?d=28&p=Ho50vAvX+MM6e7hWk9nBPxLNPvcO8yEaFMG0+r0MqjI=&k=1
IE
text
1.05 Kb
unknown
3228
stsess.exe
HEAD
200
163.171.75.66:80
http://webclinic.ahnlab.com/astx/policy/ply_ver.html
US
compressed
7.34 Kb
suspicious
3432
ASDSvc.exe
GET
200
34.246.64.247:80
http://gms.ahnlab.com/jk?c=2&p=Ho50vAvX+MM6e7hWk9nBPxLNPvcO8yEaFMG0+r0MqjI=&k=1
IE
text
396 b
unknown
3432
ASDSvc.exe
GET
200
34.246.64.247:80
http://gms.ahnlab.com/jk?d=28&p=Ho50vAvX+MM6e7hWk9nBPxLNPvcO8yEaFMG0+r0MqjI=&k=1
IE
text
1.05 Kb
unknown
3996
chrome.exe
GET
200
101.79.211.36:80
http://safetx.ahnlab.com/master/win/default/all/astx_setup.exe
KR
executable
47.7 Mb
suspicious
3432
ASDSvc.exe
GET
200
34.246.64.247:80
http://gms.ahnlab.com/jk?c=2&p=Ho50vAvX+MM6e7hWk9nBPxLNPvcO8yEaFMG0+r0MqjI=&k=1
IE
text
160 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3996
chrome.exe
216.58.210.3:443
www.gstatic.com
Google Inc.
US
whitelisted
3996
chrome.exe
172.217.22.14:443
sb-ssl.google.com
Google Inc.
US
whitelisted
3996
chrome.exe
101.79.211.36:80
safetx.ahnlab.com
CDNetworks
KR
suspicious
3996
chrome.exe
172.217.18.3:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3432
ASDSvc.exe
34.249.110.217:80
gms.ahnlab.com
Amazon.com, Inc.
IE
unknown
3432
ASDSvc.exe
34.246.64.247:80
gms.ahnlab.com
Amazon.com, Inc.
IE
unknown
3996
chrome.exe
216.58.205.238:443
clients1.google.com
Google Inc.
US
whitelisted
3996
chrome.exe
172.217.18.4:443
www.google.com
Google Inc.
US
whitelisted
3996
chrome.exe
172.217.16.141:443
accounts.google.com
Google Inc.
US
suspicious
3228
stsess.exe
163.171.75.66:80
webclinic.ahnlab.com
CDNetworks
US
suspicious

DNS requests

Domain
IP
Reputation
safetx.ahnlab.com
  • 101.79.211.36
  • 101.79.212.67
  • 163.171.75.68
suspicious
clientservices.googleapis.com
  • 172.217.18.3
whitelisted
accounts.google.com
  • 172.217.16.141
shared
www.google.com
  • 172.217.18.4
malicious
ssl.gstatic.com
  • 172.217.21.227
whitelisted
sb-ssl.google.com
  • 172.217.22.14
whitelisted
www.gstatic.com
  • 216.58.210.3
whitelisted
gms.ahnlab.com
  • 34.246.64.247
  • 34.249.110.217
unknown
webclinic.ahnlab.com
  • 163.171.75.66
  • 101.79.211.35
  • 101.79.212.66
suspicious
clients1.google.com
  • 216.58.205.238
whitelisted

Threats

PID
Process
Class
Message
3996
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://safetx.ahnlab.com/master/win/default/all/astx_setup.exe