URL:

https://kappa.lol/3FElg

Full analysis: https://app.any.run/tasks/72826997-32fd-41c9-b347-885e0dde7aae
Verdict: Malicious activity
Analysis date: August 25, 2024, 00:02:02
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MD5:

2E5485549F93D2B54FCA7E58A297278B

SHA1:

0616EF8A8AC58E9E3EBE05DC1C5AD8FFF42955F4

SHA256:

8C3BF45627209B379A490D9D95B73B5013728589D510C8D9FED1C24D1DF831C1

SSDEEP:

3:N8BM9KwCn:2q90

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2396)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2396)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned — копия.exe (PID: 5128)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 4772)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 3584)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 6228)

    • Reads Internet Explorer settings

      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 6228)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned — копия.exe (PID: 5128)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 4772)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 3584)

    • Executes application which crashes

      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 6228)

    • Process creates executable files without a name

      • WinRAR.exe (PID: 2396)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 6560)

    • Reads the computer name

      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 6228)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned — копия.exe (PID: 5128)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 4772)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 3584)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2396)

    • Checks supported languages

      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 6228)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 4772)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned — копия.exe (PID: 5128)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 3584)

    • Reads the software policy settings

      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 6228)
      • WerFault.exe (PID: 1668)
      • WerFault.exe (PID: 4344)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned — копия.exe (PID: 5128)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 4772)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 3584)

    • Reads the machine GUID from the registry

      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 6228)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned — копия.exe (PID: 5128)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 4772)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 3584)

    • Disables trace logs

      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 6228)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned — копия.exe (PID: 5128)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 4772)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 3584)

    • Checks proxy server information

      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 6228)
      • WerFault.exe (PID: 1668)
      • WerFault.exe (PID: 4344)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned — копия.exe (PID: 5128)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 4772)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 3584)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 1668)
      • WerFault.exe (PID: 4344)

    • Creates files in the program directory

      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 6228)

    • Reads Environment values

      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned — копия.exe (PID: 5128)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 4772)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 3584)
      • Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe (PID: 6228)

    • Reads Microsoft Office registry keys

      • chrome.exe (PID: 6560)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
162
Monitored processes
25
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe interface-noanti_dotkill-nofakeobf_slayed-cleaned.exe no specs interface-noanti_dotkill-nofakeobf_slayed-cleaned.exe werfault.exe chrome.exe no specs werfault.exe interface-noanti_dotkill-nofakeobf_slayed-cleaned — копия.exe no specs interface-noanti_dotkill-nofakeobf_slayed-cleaned — копия.exe interface-noanti_dotkill-nofakeobf_slayed-cleaned.exe no specs interface-noanti_dotkill-nofakeobf_slayed-cleaned.exe chrome.exe no specs interface-noanti_dotkill-nofakeobf_slayed-cleaned.exe no specs interface-noanti_dotkill-nofakeobf_slayed-cleaned.exe

Process information

PID
CMD
Path
Indicators
Parent process
1076"C:\Users\admin\AppData\Local\Temp\Rar$EXa2396.3640\Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2396.3640\Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Interface
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2396.3640\interface-noanti_dotkill-nofakeobf_slayed-cleaned.exe
c:\windows\system32\ntdll.dll
1104"C:\Users\admin\AppData\Local\Temp\Rar$EXa2396.2137\Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned — копия.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2396.2137\Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned — копия.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Interface
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2396.2137\interface-noanti_dotkill-nofakeobf_slayed-cleaned — копия.exe
c:\windows\system32\ntdll.dll
1668C:\WINDOWS\system32\WerFault.exe -u -p 6228 -s 2192C:\Windows\System32\WerFault.exe
Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
2088"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4784 --field-trial-handle=1964,i,6635854157448158034,16151952681451755258,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2396"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Roblox.7z"C:\Program Files\WinRAR\WinRAR.exe
chrome.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3140"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5324 --field-trial-handle=1964,i,6635854157448158034,16151952681451755258,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3584"C:\Users\admin\AppData\Local\Temp\Rar$EXa2396.3640\Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2396.3640\Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Description:
Interface
Exit code:
1
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2396.3640\interface-noanti_dotkill-nofakeobf_slayed-cleaned.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4068"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3992 --field-trial-handle=1964,i,6635854157448158034,16151952681451755258,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4088"C:\Users\admin\AppData\Local\Temp\Rar$EXa2396.46514\Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2396.46514\Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Interface
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2396.46514\interface-noanti_dotkill-nofakeobf_slayed-cleaned.exe
c:\windows\system32\ntdll.dll
4344C:\WINDOWS\system32\WerFault.exe -u -p 6228 -s 1424C:\Windows\System32\WerFault.exe
Interface-noAnti_dotkill-nofakeobf_Slayed-cleaned.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
Total events
26 820
Read events
26 663
Write events
139
Delete events
18

Modification events

(PID) Process:(6560) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6560) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6560) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(6560) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(6560) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6560) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(6560) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6560) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(6560) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(6560) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
72
Suspicious files
128
Text files
27
Unknown types
3

Dropped files

PID
Process
Filename
Type
6560chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6560chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6560chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
6560chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6560chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF11e656.TMP —
MD5:—
SHA256:—
6560chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
6560chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF11e665.TMP —
MD5:—
SHA256:—
6560chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6560chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:FCE53E052E5CF7C20819320F374DEA88
SHA256:CD95DE277E746E92CC2C53D9FC92A8F6F0C3EDFB7F1AD9A4E9259F927065BC89
6560chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Variationsbinary
MD5:961E3604F228B0D10541EBF921500C86
SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
43
DNS requests
32
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4820
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6504
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
568
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6504
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
6504
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
6504
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
6504
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
6504
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
6504
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
6504
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6000
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6124
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6560
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
6812
chrome.exe
74.125.206.84:443
accounts.google.com
GOOGLE
US
whitelisted
6812
chrome.exe
188.114.96.3:443
kappa.lol
CLOUDFLARENET
NL
unknown
6124
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6560
chrome.exe
224.0.0.251:5353
—
—
—
unknown
6812
chrome.exe
216.58.206.68:443
www.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
kappa.lol
  • 188.114.96.3
  • 188.114.97.3
unknown
accounts.google.com
  • 74.125.206.84
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
www.google.com
  • 216.58.206.68
  • 142.250.186.68
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
sb-ssl.google.com
  • 142.250.186.174
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.136
  • 40.126.32.138
  • 40.126.32.133
  • 40.126.32.134
  • 40.126.32.140
  • 20.190.160.17
  • 40.126.32.74
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
safebrowsing.google.com
  • 172.217.18.110
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://kappa.lol/3FElg