URL:

http://www.harlemrenaissancecentennial.org/En_us/Details/122018/file-0860656557577421.doc

Full analysis: https://app.any.run/tasks/6701a875-a7d6-40a1-a59e-a8c9eab6184c
Verdict: Malicious activity
Analysis date: December 14, 2018, 20:32:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

B19A5409A9520743C134AB48197CA0CE

SHA1:

687FC3F62173077B2162B8A73E5EDE78F1E101EF

SHA256:

823234A732A137A083DFD263E98C9BD1A36E577DE0ACD30DA6C0284271644970

SSDEEP:

3:N1KJS4x8XWELFAtt7siMnOXVEKQJAIVdKjHXyd:Cc4iL6DI/OXpQJAoITid

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads CPU info

      • firefox.exe (PID: 2284)
      • firefox.exe (PID: 2912)
      • firefox.exe (PID: 2584)
      • firefox.exe (PID: 3016)

    • Application launched itself

      • chrome.exe (PID: 3572)
      • firefox.exe (PID: 2912)

    • Creates files in the user directory

      • firefox.exe (PID: 2912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
11
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs firefox.exe firefox.exe firefox.exe firefox.exe

Process information

PID
CMD
Path
Indicators
Parent process
2260"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=68.0.3440.106 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x6f6000b0,0x6f6000c0,0x6f6000ccC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2284"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.12.1962785568\1042140982" -childID 3 -isForBrowser -prefsHandle 2916 -prefsLen 11808 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 2976 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
61.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
2584"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.0.758054741\2065846186" -childID 1 -isForBrowser -prefsHandle 768 -prefsLen 8309 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 1476 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
61.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
2676"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=932,6446415706175171745,7615301987602728214,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=8A06F70D374E981BF1B0C8A1342079BF --mojo-platform-channel-handle=960 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2912"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
61.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
3016"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.6.1897324450\537832721" -childID 2 -isForBrowser -prefsHandle 2372 -prefsLen 11442 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 2432 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
61.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
3108"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=932,6446415706175171745,7615301987602728214,131072 --enable-features=PasswordImport --disable-gpu-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=4E47CD014234C36982808F12701B3200 --mojo-platform-channel-handle=2476 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3452"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=932,6446415706175171745,7615301987602728214,131072 --enable-features=PasswordImport --service-pipe-token=5F3B1709CC7F58898C7A486CFCE08268 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5F3B1709CC7F58898C7A486CFCE08268 --renderer-client-id=4 --mojo-platform-channel-handle=1760 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3520"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3576 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
3572"C:\Program Files\Google\Chrome\Application\chrome.exe" http://www.harlemrenaissancecentennial.org/En_us/Details/122018/file-0860656557577421.docC:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
506
Read events
465
Write events
38
Delete events
3

Modification events

(PID) Process:(3520) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:3572-13189293158178875
Value:
259
(PID) Process:(3572) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3572) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3572) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3572) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3572) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3572) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3516-13180984670829101
Value:
0
(PID) Process:(3572) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(3572) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3572-13189293158178875
Value:
259
(PID) Process:(3572) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
0
Suspicious files
41
Text files
68
Unknown types
31

Dropped files

PID
Process
Filename
Type
3572chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\f886a3cf-311d-463d-8feb-c936aa0163c7.tmp —
MD5:—
SHA256:—
3572chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp —
MD5:—
SHA256:—
3572chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\CURRENT —
MD5:—
SHA256:—
3572chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp —
MD5:—
SHA256:—
3572chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\CURRENT~RF198bdb.TMP —
MD5:—
SHA256:—
3572chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF198b7d.TMPtext
MD5:—
SHA256:—
3572chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
3572chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
3572chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ce740cb4-9f16-457b-adf3-e896b273a3b4.tmp —
MD5:—
SHA256:—
3572chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.old~RF198b8d.TMPtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
49
TCP/UDP connections
29
DNS requests
54
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2912
firefox.exe
GET
404
2.18.212.129:80
http://detectportal.firefox.com/success.txt
unknown
xml
345 b
whitelisted
3572
chrome.exe
GET
404
149.47.131.249:80
http://www.harlemrenaissancecentennial.org/En_us/Details/122018/file-0860656557577421.doc
US
xml
345 b
malicious
3572
chrome.exe
GET
404
149.47.131.249:80
http://www.harlemrenaissancecentennial.org/favicon.ico
US
xml
345 b
malicious
3572
chrome.exe
GET
404
173.194.76.94:80
http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=68
US
xml
345 b
whitelisted
2912
firefox.exe
GET
404
2.18.212.129:80
http://detectportal.firefox.com/success.txt
unknown
xml
345 b
whitelisted
2912
firefox.exe
GET
404
2.18.212.129:80
http://detectportal.firefox.com/success.txt
unknown
xml
345 b
whitelisted
2912
firefox.exe
GET
404
2.18.212.129:80
http://detectportal.firefox.com/success.txt
unknown
xml
345 b
whitelisted
2912
firefox.exe
GET
404
2.18.212.129:80
http://detectportal.firefox.com/success.txt
unknown
xml
345 b
whitelisted
2912
firefox.exe
GET
404
2.18.212.129:80
http://detectportal.firefox.com/success.txt
unknown
xml
345 b
whitelisted
2912
firefox.exe
GET
404
2.18.212.129:80
http://detectportal.firefox.com/success.txt
unknown
xml
345 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3572
chrome.exe
172.217.168.35:443
www.gstatic.com
Google Inc.
US
whitelisted
3572
chrome.exe
149.47.131.249:80
www.harlemrenaissancecentennial.org
NEXCESS.NET L.L.C.
US
suspicious
3572
chrome.exe
172.217.168.45:443
accounts.google.com
Google Inc.
US
whitelisted
3572
chrome.exe
173.194.76.94:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3572
chrome.exe
173.194.76.94:80
clientservices.googleapis.com
Google Inc.
US
whitelisted
3572
chrome.exe
216.58.215.227:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2912
firefox.exe
52.89.32.107:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
2912
firefox.exe
52.37.207.140:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
2912
firefox.exe
2.18.212.129:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
2912
firefox.exe
13.32.159.108:443
snippets.cdn.mozilla.net
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 173.194.76.94
whitelisted
www.gstatic.com
  • 172.217.168.35
whitelisted
www.harlemrenaissancecentennial.org
  • 149.47.131.249
malicious
accounts.google.com
  • 172.217.168.45
shared
ssl.gstatic.com
  • 216.58.215.227
whitelisted
detectportal.firefox.com
  • 2.18.212.129
  • 2.18.212.136
  • 2.16.186.50
  • 2.16.186.112
whitelisted
search.services.mozilla.com
  • 52.89.32.107
  • 52.27.184.151
  • 34.216.89.123
whitelisted
a1089.dscd.akamai.net
  • 2.18.212.136
  • 2.18.212.129
  • 2.16.186.112
  • 2.16.186.50
whitelisted
search.r53-2.services.mozilla.com
  • 34.216.89.123
  • 52.27.184.151
  • 52.89.32.107
whitelisted
tiles.services.mozilla.com
  • 52.37.207.140
  • 34.215.13.51
  • 52.10.130.148
  • 52.34.107.172
  • 52.41.60.30
  • 52.40.109.206
  • 34.216.156.21
  • 52.39.131.77
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.harlemrenaissancecentennial.org/En_us/Details/122018/file-0860656557577421.doc