analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://Astalavista.com

Full analysis: https://app.any.run/tasks/1b7c35e5-2fa9-4ec9-b477-9275acec7cc8
Verdict: Malicious activity
Analysis date: May 21, 2022, 00:17:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

A8428D1438102C369CFFDA851473A8E1

SHA1:

B0BC2B6AFAEEE478F5D6CD1F170380A826DCCBFE

SHA256:

842F73094224EBF05872E8F1EAD069CBB1E9916D8A394B0EBA41DD34CF000CB8

SSDEEP:

3:N8KV6yZIn:2k6y2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • chrome.exe (PID: 3452)
      • chrome.exe (PID: 2728)
      • chrome.exe (PID: 276)
      • .exe (PID: 3920)
      • steamservice.exe (PID: 4016)

    • Application was dropped or rewritten from another process

      • Baixaki_Poppy Playtime_v2.981.22.448.7.exe (PID: 4028)
      • Baixaki_Poppy Playtime_v2.981.22.448.7.exe (PID: 2980)
      • .exe (PID: 3920)
      • steam.exe (PID: 932)
      • steamservice.exe (PID: 4016)

    • Changes settings of System certificates

      • Baixaki_Poppy Playtime_v2.981.22.448.7.exe (PID: 2980)

    • Changes the autorun value in the registry

      • .exe (PID: 3920)

    • Loads dropped or rewritten executable

      • .exe (PID: 3920)

  • SUSPICIOUS

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 276)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3452)
      • chrome.exe (PID: 276)
      • chrome.exe (PID: 2728)
      • .exe (PID: 3920)
      • steamservice.exe (PID: 4016)

    • Drops a file with a compile date too recent

      • chrome.exe (PID: 3452)
      • chrome.exe (PID: 276)
      • chrome.exe (PID: 2728)
      • .exe (PID: 3920)
      • steamservice.exe (PID: 4016)

    • Reads Environment values

      • Baixaki_Poppy Playtime_v2.981.22.448.7.exe (PID: 2980)

    • Checks supported languages

      • Baixaki_Poppy Playtime_v2.981.22.448.7.exe (PID: 2980)
      • .exe (PID: 3920)
      • steamservice.exe (PID: 4016)
      • steam.exe (PID: 932)
      • ns9DBD.tmp (PID: 4028)

    • Reads the computer name

      • Baixaki_Poppy Playtime_v2.981.22.448.7.exe (PID: 2980)
      • .exe (PID: 3920)
      • steamservice.exe (PID: 4016)
      • steam.exe (PID: 932)

    • Starts Internet Explorer

      • Baixaki_Poppy Playtime_v2.981.22.448.7.exe (PID: 2980)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3612)

    • Adds / modifies Windows certificates

      • Baixaki_Poppy Playtime_v2.981.22.448.7.exe (PID: 2980)

    • Creates a directory in Program Files

      • steamservice.exe (PID: 4016)
      • steam.exe (PID: 932)
      • .exe (PID: 3920)

    • Changes default file association

      • steamservice.exe (PID: 4016)

    • Starts application with an unusual extension

      • .exe (PID: 3920)

    • Creates files in the program directory

      • steam.exe (PID: 932)
      • .exe (PID: 3920)
      • steamservice.exe (PID: 4016)

    • Creates a software uninstall entry

      • .exe (PID: 3920)

    • Reads CPU info

      • steam.exe (PID: 932)

  • INFO

    • Check for Java to be installed

      • opera.exe (PID: 1364)

    • Reads the computer name

      • opera.exe (PID: 1364)
      • chrome.exe (PID: 276)
      • chrome.exe (PID: 2728)
      • chrome.exe (PID: 2696)
      • chrome.exe (PID: 2852)
      • chrome.exe (PID: 1012)
      • chrome.exe (PID: 2104)
      • chrome.exe (PID: 3676)
      • chrome.exe (PID: 2576)
      • chrome.exe (PID: 280)
      • chrome.exe (PID: 3088)
      • chrome.exe (PID: 1892)
      • chrome.exe (PID: 2752)
      • chrome.exe (PID: 3472)
      • chrome.exe (PID: 2900)
      • chrome.exe (PID: 448)
      • iexplore.exe (PID: 3612)
      • iexplore.exe (PID: 2152)
      • chrome.exe (PID: 1068)

    • Checks supported languages

      • opera.exe (PID: 1364)
      • chrome.exe (PID: 276)
      • chrome.exe (PID: 3912)
      • chrome.exe (PID: 960)
      • chrome.exe (PID: 2696)
      • chrome.exe (PID: 2728)
      • chrome.exe (PID: 3380)
      • chrome.exe (PID: 3712)
      • chrome.exe (PID: 1180)
      • chrome.exe (PID: 2284)
      • chrome.exe (PID: 2852)
      • chrome.exe (PID: 2716)
      • chrome.exe (PID: 996)
      • chrome.exe (PID: 1836)
      • chrome.exe (PID: 1868)
      • chrome.exe (PID: 2620)
      • chrome.exe (PID: 1252)
      • chrome.exe (PID: 964)
      • chrome.exe (PID: 2096)
      • chrome.exe (PID: 1012)
      • chrome.exe (PID: 3772)
      • chrome.exe (PID: 3564)
      • chrome.exe (PID: 2004)
      • chrome.exe (PID: 1800)
      • chrome.exe (PID: 2940)
      • chrome.exe (PID: 4012)
      • chrome.exe (PID: 2964)
      • chrome.exe (PID: 2936)
      • chrome.exe (PID: 660)
      • chrome.exe (PID: 3440)
      • chrome.exe (PID: 3456)
      • chrome.exe (PID: 3664)
      • chrome.exe (PID: 1592)
      • chrome.exe (PID: 3920)
      • chrome.exe (PID: 2108)
      • chrome.exe (PID: 116)
      • chrome.exe (PID: 3676)
      • chrome.exe (PID: 1600)
      • chrome.exe (PID: 4024)
      • chrome.exe (PID: 764)
      • chrome.exe (PID: 2896)
      • chrome.exe (PID: 2460)
      • chrome.exe (PID: 848)
      • chrome.exe (PID: 2924)
      • chrome.exe (PID: 3672)
      • chrome.exe (PID: 2676)
      • chrome.exe (PID: 2004)
      • chrome.exe (PID: 3548)
      • chrome.exe (PID: 3920)
      • chrome.exe (PID: 616)
      • chrome.exe (PID: 3676)
      • chrome.exe (PID: 2076)
      • chrome.exe (PID: 3532)
      • chrome.exe (PID: 532)
      • chrome.exe (PID: 2104)
      • chrome.exe (PID: 2336)
      • chrome.exe (PID: 3976)
      • chrome.exe (PID: 3340)
      • chrome.exe (PID: 2044)
      • chrome.exe (PID: 3388)
      • chrome.exe (PID: 2644)
      • chrome.exe (PID: 2876)
      • chrome.exe (PID: 3436)
      • chrome.exe (PID: 388)
      • chrome.exe (PID: 3896)
      • chrome.exe (PID: 3048)
      • chrome.exe (PID: 4068)
      • chrome.exe (PID: 3432)
      • chrome.exe (PID: 996)
      • chrome.exe (PID: 2556)
      • chrome.exe (PID: 2576)
      • chrome.exe (PID: 2692)
      • chrome.exe (PID: 2312)
      • chrome.exe (PID: 1664)
      • chrome.exe (PID: 2096)
      • chrome.exe (PID: 280)
      • chrome.exe (PID: 3392)
      • chrome.exe (PID: 3088)
      • chrome.exe (PID: 448)
      • chrome.exe (PID: 3460)
      • chrome.exe (PID: 1224)
      • chrome.exe (PID: 3004)
      • chrome.exe (PID: 3876)
      • chrome.exe (PID: 3696)
      • chrome.exe (PID: 1396)
      • chrome.exe (PID: 1408)
      • chrome.exe (PID: 3684)
      • chrome.exe (PID: 1828)
      • chrome.exe (PID: 2944)
      • chrome.exe (PID: 3216)
      • chrome.exe (PID: 2264)
      • chrome.exe (PID: 3300)
      • chrome.exe (PID: 2668)
      • chrome.exe (PID: 3188)
      • chrome.exe (PID: 3452)
      • chrome.exe (PID: 2536)
      • chrome.exe (PID: 2752)
      • chrome.exe (PID: 1892)
      • chrome.exe (PID: 1012)
      • chrome.exe (PID: 1792)
      • chrome.exe (PID: 4084)
      • chrome.exe (PID: 3472)
      • chrome.exe (PID: 3652)
      • chrome.exe (PID: 3956)
      • chrome.exe (PID: 2128)
      • chrome.exe (PID: 3152)
      • chrome.exe (PID: 3368)
      • chrome.exe (PID: 2104)
      • chrome.exe (PID: 3508)
      • chrome.exe (PID: 448)
      • chrome.exe (PID: 2900)
      • chrome.exe (PID: 2748)
      • chrome.exe (PID: 4072)
      • chrome.exe (PID: 1868)
      • chrome.exe (PID: 2908)
      • chrome.exe (PID: 2364)
      • iexplore.exe (PID: 2152)
      • chrome.exe (PID: 3404)
      • iexplore.exe (PID: 3612)
      • chrome.exe (PID: 4028)
      • chrome.exe (PID: 1068)

    • Dropped object may contain Bitcoin addresses

      • opera.exe (PID: 1364)

    • Creates files in the user directory

      • opera.exe (PID: 1364)
      • iexplore.exe (PID: 3612)
      • chrome.exe (PID: 276)

    • Reads the date of Windows installation

      • opera.exe (PID: 1364)
      • chrome.exe (PID: 2104)

    • Manual execution by user

      • chrome.exe (PID: 276)
      • steam.exe (PID: 932)

    • Reads the hosts file

      • chrome.exe (PID: 2728)
      • chrome.exe (PID: 276)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2728)
      • chrome.exe (PID: 276)
      • Baixaki_Poppy Playtime_v2.981.22.448.7.exe (PID: 2980)
      • iexplore.exe (PID: 3612)
      • iexplore.exe (PID: 2152)

    • Application launched itself

      • chrome.exe (PID: 276)
      • iexplore.exe (PID: 2152)

    • Checks Windows Trust Settings

      • chrome.exe (PID: 276)
      • Baixaki_Poppy Playtime_v2.981.22.448.7.exe (PID: 2980)
      • iexplore.exe (PID: 3612)
      • iexplore.exe (PID: 2152)

    • Changes internet zones settings

      • iexplore.exe (PID: 2152)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3612)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3612)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3612)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
171
Monitored processes
127
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start opera.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs baixaki_poppy playtime_v2.981.22.448.7.exe no specs baixaki_poppy playtime_v2.981.22.448.7.exe chrome.exe no specs iexplore.exe .exe iexplore.exe chrome.exe no specs ns9dbd.tmp no specs steamservice.exe steam.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1364"C:\Program Files\Opera\opera.exe" "https://Astalavista.com"C:\Program Files\Opera\opera.exe
Explorer.EXE
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Exit code:
0
Version:
1748
Modules
Images
c:\program files\opera\opera.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
276"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
3912"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6ee2d988,0x6ee2d998,0x6ee2d9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2696"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1052,9941967689217039519,14442393190193705826,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1048 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
2728"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1052,9941967689217039519,14442393190193705826,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1332 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
960"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,9941967689217039519,14442393190193705826,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1932 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3380"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,9941967689217039519,14442393190193705826,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1948 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3712"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,9941967689217039519,14442393190193705826,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2320 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2852"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1052,9941967689217039519,14442393190193705826,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2820 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1180"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,9941967689217039519,14442393190193705826,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
Total events
62 518
Read events
61 859
Write events
649
Delete events
10

Modification events

(PID) Process:(1364) opera.exeKey:HKEY_CURRENT_USER\Software\Opera Software
Operation:writeName:Last CommandLine v2
Value:
C:\Program Files\Opera\opera.exe "https://Astalavista.com"
(PID) Process:(1364) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(276) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(276) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(276) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(276) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(276) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(276) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(276) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(276) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
19
Suspicious files
417
Text files
371
Unknown types
70

Dropped files

PID
Process
Filename
Type
1364opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xmlxml
MD5:8DCBD53A6CE6AD79E5F42CFC7EDEB950
SHA256:A4A5665E8125621C895C5A643E0442425D2936D19B80F05C8EDFBBA550D75085
1364opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\16ec093b8f51508f.customDestinations-msbinary
MD5:3F7590FD56AC999E0289444034C9CC80
SHA256:632F80B7AD1F589FE608EF8546E3E7D1B0501A9EC3E38C0140EA1C10ED3E602B
1364opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\opr4377.tmptext
MD5:5DE2728234D8042FBA3D1AD86D96B953
SHA256:157D865952504B817F961265FDAC2BF7F437B0DAF14E3B73CFE02D77254BDB5D
1364opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\global_history.dattext
MD5:F0157FBD7C23F10DD86126E6AAE86B92
SHA256:ECF6AE7ECD38638F4E579E85B896E5A25B90038B5CA019610298E240D48D69EF
1364opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.initext
MD5:F896F01E28357E8ED7AD42CE75614A34
SHA256:4400A3B5DAB0EA766AFA416E7B797B2472408700AD377D8B71A1174F80D54CFF
1364opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\oprD867.tmpxml
MD5:8DCBD53A6CE6AD79E5F42CFC7EDEB950
SHA256:A4A5665E8125621C895C5A643E0442425D2936D19B80F05C8EDFBBA550D75085
1364opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TYCU4TQBAU3C0UL9VMGA.tempbinary
MD5:3F7590FD56AC999E0289444034C9CC80
SHA256:632F80B7AD1F589FE608EF8546E3E7D1B0501A9EC3E38C0140EA1C10ED3E602B
1364opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.datbinary
MD5:7F046F829B123FD2BBA3CCDD15BE411E
SHA256:33EEBFC827B1F730FBDDDAB4834A127A6E5ECE8EDC3BEA6114397393CD462F78
1364opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\oprD7F9.tmptext
MD5:F896F01E28357E8ED7AD42CE75614A34
SHA256:4400A3B5DAB0EA766AFA416E7B797B2472408700AD377D8B71A1174F80D54CFF
1364opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00003.tmpxml
MD5:7966F3F842F1E41B71A94EE31B6DED29
SHA256:1298A8BC01D74ACDDF2825B82EB242D005C0A816617A7E187FCC0B7BA8E23272
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
80
TCP/UDP connections
289
DNS requests
164
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1364
opera.exe
GET
200
172.217.20.67:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDe76Bca6%2BVQAq8hUxeKqi3
US
der
472 b
whitelisted
1364
opera.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
592 b
whitelisted
1364
opera.exe
GET
200
172.217.20.67:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCNxxDLaXWgbRJCQBURGN3%2B
US
der
472 b
whitelisted
1364
opera.exe
GET
200
142.250.185.227:80
http://crl.pki.goog/gtsr1/gtsr1.crl
US
der
760 b
whitelisted
—
—
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjg0QUFYSnN4MFUtaEQwNDZqVGRkVkFmZw/1.0.6.0_aemomkdncapdnfajjbbcbdebjljbpmpj.crx
US
pgc
3.61 Kb
whitelisted
—
—
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvZjE0QUFYTUR2NXNIakJsbE5jbXNrUkdfQQ/4.10.2391.0_oimompecagnajdejgnnjijobebaeigek.crx
US
pgc
3.61 Kb
whitelisted
—
—
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjg0QUFYSnN4MFUtaEQwNDZqVGRkVkFmZw/1.0.6.0_aemomkdncapdnfajjbbcbdebjljbpmpj.crx
US
—
—
whitelisted
1364
opera.exe
GET
200
142.250.185.227:80
http://crl.pki.goog/gsr1/gsr1.crl
US
der
1.61 Kb
whitelisted
1364
opera.exe
GET
302
172.217.169.100:80
http://www.google.com/search?client=opera&q=https%3A%2F%2FAstalavista.com&sourceid=opera&ie=utf-8&oe=utf-8&channel=suggest
US
html
355 b
whitelisted
1364
opera.exe
GET
302
172.217.169.100:80
http://www.google.com/search?q=https%3A%2F%2FAstalavista.com&sourceid=opera&ie=utf-8&oe=utf-8&channel=suggest
US
html
339 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1364
opera.exe
93.184.220.29:80
crl3.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1364
opera.exe
142.250.185.227:80
crl.pki.goog
Google Inc.
US
whitelisted
1364
opera.exe
188.114.97.10:443
astalavista.com
Cloudflare Inc
US
malicious
1364
opera.exe
172.217.20.67:80
ocsp.pki.goog
Google Inc.
US
whitelisted
1364
opera.exe
172.217.169.100:80
www.google.com
Google Inc.
US
whitelisted
1364
opera.exe
188.114.96.10:443
astalavista.com
Cloudflare Inc
US
malicious
1364
opera.exe
185.26.182.94:443
certs.opera.com
Opera Software AS
—
whitelisted
1364
opera.exe
185.26.182.118:443
sitecheck2.opera.com
Opera Software AS
—
suspicious
1364
opera.exe
185.26.182.110:80
redir.opera.com
Opera Software AS
—
unknown
1364
opera.exe
172.217.169.100:443
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
astalavista.com
  • 188.114.97.10
  • 188.114.96.10
malicious
certs.opera.com
  • 185.26.182.94
  • 185.26.182.93
whitelisted
sitecheck2.opera.com
  • 185.26.182.118
  • 185.26.182.112
  • 185.26.182.93
  • 185.26.182.106
  • 185.26.182.111
  • 185.26.182.94
whitelisted
crl3.digicert.com
  • 93.184.220.29
whitelisted
redir.opera.com
  • 185.26.182.110
  • 185.26.182.109
whitelisted
www.google.com
  • 172.217.169.100
  • 142.250.185.164
  • 142.250.185.132
  • 142.250.186.100
whitelisted
crl.pki.goog
  • 142.250.185.227
whitelisted
ocsp.pki.goog
  • 172.217.20.67
  • 142.250.185.67
whitelisted
consent.google.com
  • 142.250.185.78
shared
www.gstatic.com
  • 172.217.169.195
  • 142.250.186.35
whitelisted

Threats

PID
Process
Class
Message
1364
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1364
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1364
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1364
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1364
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1364
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
932
steam.exe
Potential Corporate Privacy Violation
ET USER_AGENTS Steam HTTP Client User-Agent
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://Astalavista.com