analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.baidu.com/link?url=FdfhOMRE9o24b1M43Z8qXx_4ecy5-sh43pL6v3HQS0J4C3Fnm4OLlm47eAcqmHSDIcsUobxHs07fFQN82BGA8q&wd=&eqid=afbdba5e004460a20000000260ab00f7

Full analysis: https://app.any.run/tasks/6f2f7d4b-5255-422a-bcc0-b8f48bcb591d
Verdict: Malicious activity
Analysis date: May 25, 2021, 07:08:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

885635315AC446272BC4FF04C446AA29

SHA1:

613D3B4BF6CC52119792AE04520528F8800B130A

SHA256:

7CE4CA52EE4F6A47F20EA51AA2745467735C2D47855C6E5826A878665FCA457B

SSDEEP:

3:N8DSLkqWXJjCoKHcQZw4otRtYOj0VWDSulMBOpeVREfOn:2OLkqQJjrODwVlEgKOswfO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads settings of System Certificates

      • chrome.exe (PID: 4024)

    • Reads the hosts file

      • chrome.exe (PID: 824)
      • chrome.exe (PID: 4024)

    • Application launched itself

      • chrome.exe (PID: 824)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
11
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
824"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://www.baidu.com/link?url=FdfhOMRE9o24b1M43Z8qXx_4ecy5-sh43pL6v3HQS0J4C3Fnm4OLlm47eAcqmHSDIcsUobxHs07fFQN82BGA8q&wd=&eqid=afbdba5e004460a20000000260ab00f7"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
2092"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6bf0a9d0,0x6bf0a9e0,0x6bf0a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
576"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=940 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3596"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1052,3914410717742824096,13023906449280985945,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=2649841281133784588 --mojo-platform-channel-handle=1112 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
4024"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1052,3914410717742824096,13023906449280985945,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=6045804971330239160 --mojo-platform-channel-handle=1560 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
1436"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,3914410717742824096,13023906449280985945,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5830660507514028394 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2160 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
3480"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,3914410717742824096,13023906449280985945,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12123330148912044858 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2172 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3916"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,3914410717742824096,13023906449280985945,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=389414659276503048 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2364 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
1140"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,3914410717742824096,13023906449280985945,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11505706542463811777 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
3636"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1052,3914410717742824096,13023906449280985945,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=15402639204013436201 --mojo-platform-channel-handle=3416 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Total events
586
Read events
527
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
23
Text files
65
Unknown types
0

Dropped files

PID
Process
Filename
Type
824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-60ACA28A-338.pma —
MD5:—
SHA256:—
824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old —
MD5:—
SHA256:—
824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old —
MD5:—
SHA256:—
824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old —
MD5:—
SHA256:—
824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RFf0323.TMP —
MD5:—
SHA256:—
824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RFf0343.TMP —
MD5:—
SHA256:—
824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\b68a2f83-5860-4dbc-9554-d5e288609c4d.tmp —
MD5:—
SHA256:—
824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp —
MD5:—
SHA256:—
824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old —
MD5:—
SHA256:—
824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
45
DNS requests
18
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4024
chrome.exe
185.232.59.132:443
static.oschina.net
—
—
unknown
4024
chrome.exe
151.101.2.109:443
cdn.jsdelivr.net
Fastly
US
suspicious
4024
chrome.exe
104.193.88.77:443
www.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
US
malicious
4024
chrome.exe
212.64.62.183:443
my.oschina.net
—
NL
unknown
4024
chrome.exe
142.250.186.174:443
clients1.google.com
Google Inc.
US
whitelisted
4024
chrome.exe
142.250.184.227:443
ssl.gstatic.com
Google Inc.
US
whitelisted
4024
chrome.exe
72.247.185.66:443
tjs.sjs.sinajs.cn
Akamai International B.V.
NL
whitelisted
4024
chrome.exe
171.107.86.48:443
hmcdn.baidu.com
No.31,Jin-rong Street
CN
unknown
4024
chrome.exe
58.222.16.53:443
oscimg.oschina.net
No.31,Jin-rong Street
CN
suspicious
—
—
72.247.185.66:443
tjs.sjs.sinajs.cn
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
www.baidu.com
  • 104.193.88.77
  • 104.193.88.123
whitelisted
accounts.google.com
  • 216.58.212.141
shared
my.oschina.net
  • 212.64.62.183
unknown
static.oschina.net
  • 185.232.59.132
suspicious
cdn.jsdelivr.net
  • 151.101.2.109
  • 151.101.66.109
  • 151.101.130.109
  • 151.101.194.109
whitelisted
oscimg.oschina.net
  • 58.222.16.53
  • 58.222.16.55
  • 58.51.170.151
  • 183.131.178.89
malicious
www.oschina.net
  • 212.64.62.183
unknown
tjs.sjs.sinajs.cn
  • 72.247.185.66
  • 72.247.185.58
whitelisted
zz.bdstatic.com
  • 119.188.176.48
whitelisted
hm.baidu.com
  • 103.235.46.191
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.baidu.com/link?url=FdfhOMRE9o24b1M43Z8qXx_4ecy5-sh43pL6v3HQS0J4C3Fnm4OLlm47eAcqmHSDIcsUobxHs07fFQN82BGA8q&wd=&eqid=afbdba5e004460a20000000260ab00f7