URL:

https://glary-utilities-portable.download.it/download

Full analysis: https://app.any.run/tasks/7446e416-3a0b-4692-9613-fa84c160e93b
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 03, 2025, 09:19:33
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
obfuscated-js
stealer
Indicators:
MD5:

B7519AC352CB3033F7CE623B8849F035

SHA1:

E735F8C86CE2DCF2BF505522A4C6F562DD77D76D

SHA256:

713AAB2ED43734010041ADF9781A931E1DB41EF33DBEC34E5573C122149E496C

SSDEEP:

3:N8o+cw/zHFJKWpFz:2o+LTzlvz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Integrator.exe (PID: 6428)
      • upgrade.exe (PID: 2496)

    • Actions looks like stealing of personal data

      • Integrator.exe (PID: 6428)
      • Initialize.exe (PID: 4132)

    • Steals credentials from Web Browsers

      • Integrator.exe (PID: 6428)
      • Initialize.exe (PID: 4132)

  • SUSPICIOUS

    • Drops 7-zip archiver for unpacking

      • chrome.exe (PID: 5308)

    • Executable content was dropped or overwritten

      • glary-utilities-portable.exe (PID: 1328)
      • glary-utilities-portable.exe (PID: 2456)

    • Process drops legitimate windows executable

      • glary-utilities-portable.exe (PID: 1328)
      • glary-utilities-portable.exe (PID: 2456)

    • Drops a system driver (possible attempt to evade defenses)

      • glary-utilities-portable.exe (PID: 1328)
      • glary-utilities-portable.exe (PID: 2456)

    • The process drops C-runtime libraries

      • glary-utilities-portable.exe (PID: 1328)
      • glary-utilities-portable.exe (PID: 2456)

    • Reads security settings of Internet Explorer

      • Integrator_Portable.exe (PID: 5452)
      • Integrator.exe (PID: 6428)
      • AutoUpdate.exe (PID: 2076)
      • upgrade.exe (PID: 2496)
      • SoftwareUpdate.exe (PID: 1480)

    • Reads Microsoft Outlook installation path

      • Integrator.exe (PID: 6428)
      • upgrade.exe (PID: 2496)

    • Reads Internet Explorer settings

      • upgrade.exe (PID: 2496)
      • Integrator.exe (PID: 6428)

    • Checks Windows Trust Settings

      • Integrator.exe (PID: 6428)
      • SoftwareUpdate.exe (PID: 1480)

    • Searches for installed software

      • SoftwareUpdate.exe (PID: 1480)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 5308)
      • firefox.exe (PID: 2168)
      • firefox.exe (PID: 2152)
      • chrome.exe (PID: 6304)
      • msedge.exe (PID: 3092)
      • msedge.exe (PID: 7404)
      • msedge.exe (PID: 5320)

    • The sample compiled with english language support

      • chrome.exe (PID: 5308)
      • glary-utilities-portable.exe (PID: 1328)
      • chrome.exe (PID: 4500)
      • glary-utilities-portable.exe (PID: 2456)
      • chrome.exe (PID: 5160)

    • Checks supported languages

      • glary-utilities-portable.exe (PID: 1328)
      • glary-utilities-portable.exe (PID: 2456)
      • Integrator.exe (PID: 6428)
      • Integrator_Portable.exe (PID: 5452)
      • Initialize.exe (PID: 4132)
      • AutoUpdate.exe (PID: 2076)
      • upgrade.exe (PID: 2496)
      • x64ProcessAssistSvc.exe (PID: 6096)
      • identity_helper.exe (PID: 6768)
      • SoftwareUpdate.exe (PID: 1480)
      • identity_helper.exe (PID: 7996)
      • StartupManager.exe (PID: 5496)

    • Reads the computer name

      • glary-utilities-portable.exe (PID: 1328)
      • Integrator.exe (PID: 6428)
      • glary-utilities-portable.exe (PID: 2456)
      • AutoUpdate.exe (PID: 2076)
      • Initialize.exe (PID: 4132)
      • upgrade.exe (PID: 2496)
      • identity_helper.exe (PID: 6768)
      • identity_helper.exe (PID: 7996)
      • SoftwareUpdate.exe (PID: 1480)
      • x64ProcessAssistSvc.exe (PID: 6096)
      • StartupManager.exe (PID: 5496)

    • The sample compiled with arabic language support

      • glary-utilities-portable.exe (PID: 1328)
      • glary-utilities-portable.exe (PID: 2456)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 5308)
      • chrome.exe (PID: 4500)
      • chrome.exe (PID: 5160)

    • The sample compiled with chinese language support

      • glary-utilities-portable.exe (PID: 1328)
      • glary-utilities-portable.exe (PID: 2456)

    • Manual execution by a user

      • firefox.exe (PID: 2168)
      • chrome.exe (PID: 6304)
      • glary-utilities-portable.exe (PID: 2456)
      • Integrator_Portable.exe (PID: 5452)
      • Integrator_Portable.exe (PID: 4540)
      • msedge.exe (PID: 5320)

    • Process checks computer location settings

      • Integrator_Portable.exe (PID: 5452)
      • Integrator.exe (PID: 6428)

    • Creates files or folders in the user directory

      • Integrator.exe (PID: 6428)
      • Initialize.exe (PID: 4132)
      • upgrade.exe (PID: 2496)
      • SoftwareUpdate.exe (PID: 1480)

    • Process checks whether UAC notifications are on

      • Integrator.exe (PID: 6428)

    • Create files in a temporary directory

      • Integrator.exe (PID: 6428)
      • upgrade.exe (PID: 2496)

    • Checks proxy server information

      • AutoUpdate.exe (PID: 2076)
      • upgrade.exe (PID: 2496)
      • Integrator.exe (PID: 6428)
      • SoftwareUpdate.exe (PID: 1480)

    • Reads the machine GUID from the registry

      • upgrade.exe (PID: 2496)
      • Integrator.exe (PID: 6428)
      • SoftwareUpdate.exe (PID: 1480)

    • Reads the software policy settings

      • Integrator.exe (PID: 6428)
      • SoftwareUpdate.exe (PID: 1480)

    • Reads Environment values

      • identity_helper.exe (PID: 7996)
      • identity_helper.exe (PID: 6768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
264
Monitored processes
127
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs glary-utilities-portable.exe chrome.exe chrome.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs rundll32.exe no specs glary-utilities-portable.exe integrator_portable.exe no specs integrator_portable.exe integrator.exe initialize.exe autoupdate.exe upgrade.exe x64processassistsvc.exe no specs chrome.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs softwareupdate.exe chrome.exe no specs startupmanager.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
540"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=860 --field-trial-handle=1904,i,12136503159482856181,5601469797107054190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
556"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5248 --field-trial-handle=1904,i,12136503159482856181,5601469797107054190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1328"C:\Users\admin\Downloads\glary-utilities-portable.exe" C:\Users\admin\Downloads\glary-utilities-portable.exe
chrome.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7z SFX
Exit code:
0
Version:
19.00
Modules
Images
c:\users\admin\downloads\glary-utilities-portable.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1344"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4492 --field-trial-handle=1904,i,12136503159482856181,5601469797107054190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1480"C:\Users\admin\Downloads\guportable\Portable\SoftwareUpdate.exe" -autorun showC:\Users\admin\Downloads\guportable\Portable\SoftwareUpdate.exe
Integrator.exe
User:
admin
Company:
Glarysoft Ltd
Integrity Level:
HIGH
Description:
Glary Utilities Software Update
Exit code:
2
Version:
5.0.0.45
1684"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4528 --field-trial-handle=1904,i,12136503159482856181,5601469797107054190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1684"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1940 --field-trial-handle=1944,i,3381637525184762946,10756449026545128560,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1752"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5232 --field-trial-handle=1904,i,12136503159482856181,5601469797107054190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2076"C:\Users\admin\Downloads\guportable\Portable\autoupdate.exe" C:\Users\admin\Downloads\guportable\Portable\AutoUpdate.exe
Integrator.exe
User:
admin
Company:
Glarysoft Ltd
Integrity Level:
HIGH
Description:
Glary Utilities AutoUpdate
Exit code:
0
Version:
5, 0, 0, 8
Modules
Images
c:\users\admin\downloads\guportable\portable\autoupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2144"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4680 -childID 3 -isForBrowser -prefsHandle 4804 -prefMapHandle 4808 -prefsLen 31144 -prefMapSize 244583 -jsInitHandle 1540 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1076218c-73d0-4215-8215-e38f8520c59a} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" 1d1b4496a10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
Total events
41 474
Read events
41 294
Write events
166
Delete events
14

Modification events

(PID) Process:(5308) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(5308) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(5308) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(5308) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(5308) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2928) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
01000000000000006FBDA5D01C76DB01
(PID) Process:(5308) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Common\Rlz\PTimes
Operation:writeName:C
Value:
A8A6BEF81C76DB01
(PID) Process:(5308) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Common\Rlz\Events\C
Operation:writeName:C1I
Value:
1
(PID) Process:(5308) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Common\Rlz\Events\C
Operation:writeName:C2I
Value:
1
(PID) Process:(5308) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Common\Rlz\Events\C
Operation:writeName:C7I
Value:
1
Executable files
286
Suspicious files
459
Text files
1 047
Unknown types
36

Dropped files

PID
Process
Filename
Type
5308chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF138fc0.TMP —
MD5:—
SHA256:—
5308chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
5308chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF138fd0.TMP —
MD5:—
SHA256:—
5308chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
5308chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF138fdf.TMP —
MD5:—
SHA256:—
5308chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF138fdf.TMP —
MD5:—
SHA256:—
5308chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
5308chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF138fef.TMP —
MD5:—
SHA256:—
5308chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
5308chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
79
TCP/UDP connections
238
DNS requests
335
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
716
svchost.exe
GET
200
95.101.78.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
716
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3876
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3876
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1344
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
6532
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1344
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
1344
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
716
svchost.exe
95.101.78.42:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
716
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5308
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
6384
chrome.exe
104.22.56.224:443
glary-utilities-portable.download.it
CLOUDFLARENET
—
suspicious
6384
chrome.exe
64.233.166.84:443
accounts.google.com
GOOGLE
US
whitelisted
5064
SearchApp.exe
104.126.37.128:443
www.bing.com
Akamai International B.V.
DE
whitelisted
6384
chrome.exe
172.67.26.92:443
glary-utilities-portable.download.it
CLOUDFLARENET
US
suspicious

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 95.101.78.42
  • 95.101.78.32
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.128
  • 104.126.37.130
  • 104.126.37.177
  • 104.126.37.179
  • 104.126.37.123
  • 104.126.37.178
  • 104.126.37.137
  • 104.126.37.186
  • 104.126.37.184
  • 2.21.65.153
  • 2.21.65.154
  • 2.21.65.132
whitelisted
glary-utilities-portable.download.it
  • 104.22.56.224
  • 104.22.57.224
  • 172.67.26.92
unknown
accounts.google.com
  • 64.233.166.84
  • 74.125.143.84
whitelisted
static.download.it
  • 172.67.26.92
  • 104.22.57.224
  • 104.22.56.224
unknown
fonts.googleapis.com
  • 142.250.184.202
  • 216.58.206.42
whitelisted
fonts.gstatic.com
  • 142.250.184.195
  • 142.250.186.131
whitelisted
www.googletagmanager.com
  • 172.217.18.8
  • 142.250.186.168
whitelisted
cdn.ditdlm.com
  • 172.67.141.193
  • 104.21.27.61
unknown

Threats

PID
Process
Class
Message
6384
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6384
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6428
Integrator.exe
Potentially Bad Traffic
ET USER_AGENTS Suspicious User-Agent (Microsoft-ATL-Native/9.00)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://glary-utilities-portable.download.it/download