| URL: | http://www.publicdomainregistry.com |
| Full analysis: | https://app.any.run/tasks/e9cc35b0-13bb-403a-b0e7-548c2ab77544 |
| Verdict: | Malicious activity |
| Analysis date: | June 07, 2024, 03:02:45 |
| OS: | Ubuntu 22.04.2 |
| MD5: | DEE13DBE8C6433E153A71864AF1B58AD |
| SHA1: | 7C2FF065EE1C2E17E240D081F4AAA8AAD532D5BE |
| SHA256: | 87676CA39BD01515B3DD5416603458E92AF4A944864E5BF943342E4CA2A39D07 |
| SSDEEP: | 3:N1KJS4oHBIM8jI:Cc4oaBjI |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
302
Monitored processes
87
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 12446 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome http://www\.publicdomainregistry\.com " | /bin/sh | — | any-guest-agent |
User: root Integrity Level: UNKNOWN | ||||
| 12447 | sudo -iu user google-chrome http://www.publicdomainregistry.com | /usr/bin/sudo | — | sh |
User: root Integrity Level: UNKNOWN | ||||
| 12448 | /usr/bin/google-chrome http://www.publicdomainregistry.com | /opt/google/chrome/chrome | sudo | |
User: user Integrity Level: UNKNOWN | ||||
| 12449 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 12450 | readlink -f /usr/bin/google-chrome | /usr/bin/readlink | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 12451 | dirname /opt/google/chrome/google-chrome | /usr/bin/dirname | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 12452 | mkdir -p /home/user/.local/share/applications | /usr/bin/mkdir | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 12453 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN | ||||
| 12454 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN | ||||
| 12455 | /opt/google/chrome/chrome | — | chrome | |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
Executable files
7
Suspicious files
360
Text files
15
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 12448 | chrome | /home/user/.config/google-chrome/ShaderCache/data_3 | binary | |
MD5:— | SHA256:— | |||
| 12448 | chrome | /home/user/.config/google-chrome/ShaderCache/data_2 | binary | |
MD5:— | SHA256:— | |||
| 12448 | chrome | /home/user/.config/google-chrome/ShaderCache/data_0 | binary | |
MD5:— | SHA256:— | |||
| 12448 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_3 | vxd | |
MD5:— | SHA256:— | |||
| 12448 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_2 | vxd | |
MD5:— | SHA256:— | |||
| 12448 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_0 | vxd | |
MD5:— | SHA256:— | |||
| 12448 | chrome | /home/user/.config/google-chrome/Default/DawnCache/data_3 | vxd | |
MD5:— | SHA256:— | |||
| 12448 | chrome | /home/user/.config/google-chrome/Default/DawnCache/data_2 | vxd | |
MD5:— | SHA256:— | |||
| 12448 | chrome | /home/user/.config/google-chrome/Default/DawnCache/data_0 | vxd | |
MD5:— | SHA256:— | |||
| 12597 | chrome | /home/user/.cache/mesa_shader_cache/index | koa | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
81
DNS requests
60
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/lvx4ng4qhhp4kpddwmwjgzrumu_2024.6.5.140657/eeigpngbgcognadeebkilcpcaedhellh_2024.06.05.140657_all_ccj7nw5iotmqmvpbhiiji4wfca.crx3 | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/1.9d9e344f2ec01a105724988c1eeaca6521d2136dc519e481dca8ca54598f88cc/1.ff0e88cc4f10c87e09be229b861a5ce2909b22d830b3634c51e29b150342eee0/5fcdfe21e0783d502fe05d583015c247173f2f9f6ce539262cf7885fefceabfa.puff | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acbr7kjwzecl32eljahbeumyllpa_8823/hfnkpimlhhgieaddgfemjhofmfblmnib_8823_all_ac2riqdl6xiviawenpfxncaz4xkq.crx3 | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/niikhdgajlphfehepabhhblakbdgeefj/1.ee07b2f0f8ffe0dc1aa0d91c6fd4f209609aed577a994351ef5d2e6b30f3590c/1.1dbb3990e16ba546e7367ef84c38441173fbb5a7b570bb9b183d3b6faaeb622d/5d59bb1efda1801ea34cddab6620a896a1e4916bcb9f164ac52b2305414b31c2.puff | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/lmelglejhemejginpboagddgdfbepgmp/1.3e6a99367b6b37be5ad828dac3f4612241ac241264ca3955b108ff8b9333b5d3/1.7c7270ef0b71ec063a98f512831a53690989605dcb0fbf503b95ca5bb4f98b63/52ad120a5d427563fdc59b68c6d3e362041126c0fd5c5ee848d9c837706267fd.puff | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/jxqgeyodl2wb4o4hxkzt62egnm_20240429.634529504.14/obedbbhbpmojnkanicioggnmelmoomoc_20240429.634529504.14_all_ENGB500000_drh7pqj4o7a7karn7sdqrnqyte.crx3 | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/d56bt2pkaiinbgqrvcp6b5kkfi_2024.6.5.4/jflhchccmppkfebkiaminageehmchikm_2024.06.05.04_all_acmku7jxh2infq26guwihmgbpvja.crx3 | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/gonpemdgkjcecdgbnaabipppbmgfggbe/1.e73a7fe8092191e16e2807ea7f48e54261b783aa2525152082ca6a0d59274dbd/1.046a7153ace40b4c1fcb2423ffdd0bda38820d2bade6aa5ab6929fe80e4acea3/5f6d5d03503db866ffdb28b772991231a1e832d579f71dd48c56f70200a76d3e.puff | unknown | — | — | unknown |
— | — | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/kiabhabjdbkjdpjbpigfodbdjmbglcoo/1.9e8b5281e830ef98473ebe00b121ecdad269c9dec6a305cdffc18f8df0f2aa17/1.153e9301be7e862a33e2cab936a0a97e2f8bdf2dae1be516d6fe8a5f184ce028/3865325347bda7f565702e2ccfb3e95df4655ae831a6c8f84fd358a3b01270f7.puff | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 185.125.188.55:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
— | — | 185.125.188.58:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
12448 | chrome | 239.255.255.250:1900 | — | — | — | unknown |
— | — | 216.58.206.67:443 | clientservices.googleapis.com | GOOGLE | US | unknown |
— | — | 142.250.185.74:443 | safebrowsingohttpgateway.googleapis.com | GOOGLE | US | unknown |
470 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 74.125.71.84:443 | accounts.google.com | — | — | unknown |
— | — | 151.101.129.91:443 | google-ohttp-relay-safebrowsing.fastly-edge.com | FASTLY | US | unknown |
— | — | 104.17.176.154:443 | www.publicdomainregistry.com | CLOUDFLARENET | — | unknown |
— | — | 142.250.185.100:443 | www.google.com | — | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
api.snapcraft.io |
| unknown |
60.100.168.192.in-addr.arpa |
| unknown |
clientservices.googleapis.com |
| whitelisted |
www.publicdomainregistry.com |
| unknown |
safebrowsingohttpgateway.googleapis.com |
| unknown |
google-ohttp-relay-safebrowsing.fastly-edge.com |
| unknown |
accounts.google.com |
| shared |
publicdomainregistry.com |
| unknown |
www.google.com |
| whitelisted |
update.googleapis.com |
| unknown |