URL:

https://winimage.com

Full analysis: https://app.any.run/tasks/76ba0d14-a466-4269-930f-378a583ab69e
Verdict: Malicious activity
Analysis date: April 16, 2020, 22:01:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

E605078CB055312818DCF60119714E2B

SHA1:

D856842EE3278BC72D703A3B00A0B68117B76989

SHA256:

85B366BA8FFB1FD6B25A4531A3246AE269FB025D6310A32396CCD0A062B5340E

SSDEEP:

3:N8dbKI:25T

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • winima100.exe (PID: 1604)
      • winima100.exe (PID: 2464)
      • winimage.exe (PID: 2148)
      • winimage.exe (PID: 3000)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2796)
      • chrome.exe (PID: 620)
      • winima100.exe (PID: 2464)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 620)

    • Creates files in the program directory

      • winima100.exe (PID: 2464)

    • Checks supported languages

      • winimage.exe (PID: 2148)
      • winimage.exe (PID: 3000)

    • Low-level read access rights to disk partition

      • winimage.exe (PID: 2148)
      • winimage.exe (PID: 3000)

    • Modifies the open verb of a shell class

      • winimage.exe (PID: 2148)

    • Creates a software uninstall entry

      • winimage.exe (PID: 2148)

    • Connects to FTP

      • chrome.exe (PID: 2796)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 2796)
      • chrome.exe (PID: 620)

    • Reads settings of System Certificates

      • chrome.exe (PID: 620)
      • chrome.exe (PID: 2796)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 620)

    • Manual execution by user

      • winimage.exe (PID: 3000)

    • Application launched itself

      • chrome.exe (PID: 620)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
78
Monitored processes
33
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winima100.exe no specs winima100.exe winimage.exe no specs chrome.exe no specs winimage.exe chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
280"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,12477859729234410750,6782174067746821448,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12401636393747992033 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
340"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,12477859729234410750,6782174067746821448,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=2919543515013574809 --mojo-platform-channel-handle=3728 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
620"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://winimage.com"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1008"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,12477859729234410750,6782174067746821448,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=16789257465110288541 --mojo-platform-channel-handle=3524 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1092"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,12477859729234410750,6782174067746821448,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=10719179255596513771 --mojo-platform-channel-handle=4376 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1440"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,12477859729234410750,6782174067746821448,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12606963112735407953 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1520"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,12477859729234410750,6782174067746821448,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=10496981504659558068 --mojo-platform-channel-handle=4148 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1548"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,12477859729234410750,6782174067746821448,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=78086620188343303 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1604"C:\Users\admin\Downloads\winima100.exe" C:\Users\admin\Downloads\winima100.exe—chrome.exe
User:
admin
Company:
WinImage
Integrity Level:
MEDIUM
Description:
WinImage MicroSetup
Exit code:
3221226540
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\downloads\winima100.exe
c:\systemroot\system32\ntdll.dll
1708"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,12477859729234410750,6782174067746821448,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=11075704706866427903 --mojo-platform-channel-handle=3640 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
1 421
Read events
1 162
Write events
254
Delete events
5

Modification events

(PID) Process:(620) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(620) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(620) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(620) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3756) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:620-13231548099375500
Value:
259
(PID) Process:(620) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(620) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(620) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(620) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3120-13213713943555664
Value:
0
(PID) Process:(620) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
7
Suspicious files
41
Text files
292
Unknown types
14

Dropped files

PID
Process
Filename
Type
620chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5E98D5C3-26C.pma —
MD5:—
SHA256:—
620chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old —
MD5:—
SHA256:—
620chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\9d6374b2-7d5d-4328-9b3c-6cdd630cf123.tmp —
MD5:—
SHA256:—
620chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
620chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RFa6e1bd.TMPtext
MD5:—
SHA256:—
620chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RFa6e1dc.TMPtext
MD5:—
SHA256:—
620chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
620chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:—
SHA256:—
620chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
620chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RFa6e382.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
24
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2796
chrome.exe
GET
200
74.125.173.202:80
http://r5---sn-4g5e6nzz.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx?cms_redirect=yes&mh=QJ&mip=89.249.73.13&mm=28&mn=sn-4g5e6nzz&ms=nvh&mt=1587074417&mv=m&mvi=4&pl=25&shardbypass=yes
US
crx
293 Kb
whitelisted
2796
chrome.exe
GET
302
216.58.205.238:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
518 b
whitelisted
2796
chrome.exe
GET
302
216.58.205.238:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
523 b
whitelisted
2796
chrome.exe
GET
200
173.194.187.102:80
http://r1---sn-4g5e6nsr.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mh=bs&mip=89.249.73.13&mm=28&mn=sn-4g5e6nsr&ms=nvh&mt=1587074417&mv=m&mvi=0&pl=25&shardbypass=yes
US
crx
862 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2796
chrome.exe
172.217.18.163:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2796
chrome.exe
144.217.225.1:443
winimage.com
OVH SAS
CA
malicious
2796
chrome.exe
172.217.16.174:443
clients2.google.com
Google Inc.
US
whitelisted
2796
chrome.exe
216.58.205.238:80
redirector.gvt1.com
Google Inc.
US
whitelisted
2796
chrome.exe
74.125.173.202:80
r5---sn-4g5e6nzz.gvt1.com
Google Inc.
US
whitelisted
2796
chrome.exe
216.58.208.33:443
clients2.googleusercontent.com
Google Inc.
US
whitelisted
2796
chrome.exe
172.217.22.100:443
www.google.com
Google Inc.
US
whitelisted
2796
chrome.exe
172.217.18.99:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2796
chrome.exe
173.194.187.102:80
r1---sn-4g5e6nsr.gvt1.com
Google Inc.
US
whitelisted
2796
chrome.exe
216.58.206.3:443
www.gstatic.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
winimage.com
  • 144.217.225.1
unknown
clientservices.googleapis.com
  • 172.217.18.163
whitelisted
accounts.google.com
  • 172.217.16.141
shared
clients2.google.com
  • 172.217.16.174
whitelisted
redirector.gvt1.com
  • 216.58.205.238
whitelisted
r5---sn-4g5e6nzz.gvt1.com
  • 74.125.173.202
whitelisted
clients2.googleusercontent.com
  • 216.58.208.33
whitelisted
r1---sn-4g5e6nsr.gvt1.com
  • 173.194.187.102
whitelisted
www.google.com
  • 172.217.22.100
malicious
ssl.gstatic.com
  • 172.217.18.99
whitelisted

Threats

No threats detected
Process
Message
winima100.exe
Total of file : 8
winima100.exe
Total of file : 8
winima100.exe
Total of file : 8
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://winimage.com