URL:

https://4horlover.com/

Full analysis: https://app.any.run/tasks/b78c31b3-4abd-4862-a6fc-0860212629ff
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: February 18, 2020, 14:31:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MD5:

A2D3B553C42899E234D9D77AD987505D

SHA1:

E5714D6949210CA854D991549FAA5C6C184F6406

SHA256:

91B17CBF59621DA8E6AA7C75F1EA43AE888256CD10F4217B588CEE2A557A48A8

SSDEEP:

3:N8oIK:2VK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to CnC server

      • chrome.exe (PID: 2428)

  • SUSPICIOUS

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3328)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 3328)

    • Reads the hosts file

      • chrome.exe (PID: 2428)
      • chrome.exe (PID: 3328)

    • Dropped object may contain TOR URL's

      • chrome.exe (PID: 3328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
96
Monitored processes
60
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
912"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1024,636083941521690653,2799474172643377514,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=14398329616981259762 --mojo-platform-channel-handle=888 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1024"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1024,636083941521690653,2799474172643377514,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=9333309635417365031 --mojo-platform-channel-handle=4436 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1136"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1024,636083941521690653,2799474172643377514,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=12487820912114900210 --mojo-platform-channel-handle=3568 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1140"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,636083941521690653,2799474172643377514,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10937598385805542434 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2568 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1332"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1024,636083941521690653,2799474172643377514,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=17366744247613786467 --mojo-platform-channel-handle=3016 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1456"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,636083941521690653,2799474172643377514,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=2144234439214970915 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1492"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,636083941521690653,2799474172643377514,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11273020518198244375 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1536"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1024,636083941521690653,2799474172643377514,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=13054996899421167809 --mojo-platform-channel-handle=2492 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1544"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6fa8a9d0,0x6fa8a9e0,0x6fa8a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1832"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,636083941521690653,2799474172643377514,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1418969215152841562 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2212 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
655
Read events
540
Write events
110
Delete events
5

Modification events

(PID) Process:(2956) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:3328-13226509900783375
Value:
259
(PID) Process:(3328) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3328) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3328) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3328) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3328) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3328) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3328) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3328) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3120-13213713943555664
Value:
0
(PID) Process:(3328) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
0
Suspicious files
174
Text files
341
Unknown types
15

Dropped files

PID
Process
Filename
Type
3328chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5E4BF54D-D00.pma —
MD5:—
SHA256:—
3328chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ab176f06-a720-4306-a513-3625155b58e8.tmp —
MD5:—
SHA256:—
3328chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
3328chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old —
MD5:—
SHA256:—
3328chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old —
MD5:—
SHA256:—
3328chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
3328chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RFa6673e.TMPtext
MD5:—
SHA256:—
3328chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
3328chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
3328chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RFa668a5.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
165
DNS requests
102
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2428
chrome.exe
GET
302
173.192.101.24:80
http://p334139.mybestdc.com/adServe/adClick?ai=eFbaHyySw2JQso4gdVjrj7wsC1RrmhjhKoi-OZIUMVPc3XxrVW3Zg4f18T9CpHqCT2L9NFyVXF55Q47z-CV1ol2k4XVJzHJX8mFgHSWE3Ta3Mf5lpH_2uAdzrw1lcod1S_sQnzFC-Jofs6Cn0z345g2errU4cGYGByo2LSlCSB1-bLn2PKcGx4lqQhXocdpyvsB0iuJvaA4l_jIE1GWrF0-cSEhrDbOxEkcnN0O_o7n7N9RLydVTTptZB4PUkMcort_GhLNyjcewpth3iNEvd_P4BsKUl697UgDHGPx9sdOxxaLzhkg6TSol4S5osn5YR0Ng4Sbb-ewIqJ00PG5Xmw&ui=PO16ZOQXEuxL2c848UsEf0d6m3Ibkqck5BqBrDJxXOG-NQJWChSnj9v5g3ZHjkgnXVfgki2ayiEph6Byrf997Ezvh4y-_NlxhbO1RS2SRxY031ka2TDg_w&si=1&oref=98a26178906e278a024c591398726b2a&rb=P84lMzRDylM&rr=0
US
—
—
suspicious
2428
chrome.exe
GET
302
173.192.101.24:80
http://mybestdc.com/aS/feedclick?s=PO16ZOQXEuxL2c848UsEf6h755a9YMVmPBNPBH7NC0zI6j6WA_S05tQ8TqGwgitios_5qWMelctOIs3E02P7fb5wYWehWATUAMgUAve0WpD7z2l48TP0icZTps4EeX4dsOyE_yhG9DLGVWViaJip_lLrLjSoYoDsg7sDrtwAAYBwnxOLKaBhGyhkV4l7p5o2Bgl42POA6PS8aJpCVm69gHyxqasjG8gcxbguncToTjHLTT7NhX8CVieFlDBFM8bek6EINja6X8MbvLw3BJ-c_AMOELSOUSH3dj7wHhVgOdWCtgQBsYgV42t44nYu0ky0KnhhwIIXd9-CLkZFCxahJpm6Oj3y3DyOa5YfGG1Wo_a1rsuA86CKsWKHLahxnwQUsf3ZlP_H1uSbBGGjwUmwqr4Fg7uQPYMU_9EZs6XmXBV7rVQhisrbxUHCK4tSYsXO4CvWIAayZX_RAHbP59QKgcoLmIkrNohyvO5nGH2lxnKupJfSEoNO7F7ntpBqmNvHrCAkl5bOZpah0eRvTzJv0gyXnbrvtsje5i_K1A7AOMXp2ZZ9sreTDEaH3az9g-K3lUi6ABbgnWDeD8qVs3tu_YQQwsDxMLaojB_PDRFawTUKGvS68L6vXM9fpLW8jdq_Jg21vNlT4nC1lTK9Az2Bfe8cbp3v4goGOUAvHFlyK2UTMbqoIdCh19SXJQizyQQ5TYtQaA8ZJQG0ccxeArsEWaODElZr0CO8L1DdkRIksh9kQcCPx0VXEVer00Rb7b0cONlSP6Q3QL36TbO-vbm_JCQPtXcJTecQ9Zv7IbM1JsbzfG4Db8U7KxuSAC_zDvI70cfc39MlKaTUxLhmpWQwF1du1VBtpQL0eDBEanPsRxxcTQtRPdux7U1T1CZWUCX4Or-0XMNb0Y1RlVsrHllsCunO6Ig06cQ2kDncvirW3HfvmKrJF4pkQi-6HqhJkCym6vSGmOi2MSGVjHS4VWfm-RfJoCg_1W9vkdhuIazetFTq8THCDMRmfA3epIYMNcYsMY2WFoaBI5lglww3M65zfM1AbNB0pgVsrv8t_3j_unUyw89SeU75Qsxd5LPanzXLDdAKerDQLXqmgOuXaofiSuB25EoZyy9cSYT6tGDk6P8cCMQbU3YLWhpyy_YN0YQtpLSZmparWHVAJnCri50GGcPz_ZVE1wyWgyhOQAN2EjOqPE8tJvq1gmmNBy-gIqOylszDrahWMmKrehFpFZ1rJ70zS8U-nvyl0FeKW-fxrmepHlNOqL0QNHy6H4_ig8pVH6u8U8JPUi5ovjXspZnO9sYjFXZ7VyMb
US
—
—
malicious
2428
chrome.exe
GET
302
216.58.208.46:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
517 b
whitelisted
2428
chrome.exe
GET
303
3.225.101.55:80
http://sp.popcash.net/ad/ad?p=117224&w=380429&t=5993a8a73eaea628&r=aHR0cHMlM0EvLzRob3Jsb3Zlci5jb20v&vw=1280&vh=620
US
html
52 b
suspicious
2428
chrome.exe
GET
200
3.225.101.55:80
http://sp.popcash.net/go/117224/380429/aHR0cHMlM0EvLzRob3Jsb3Zlci5jb20v?cb=1378116614151541
US
html
302 b
suspicious
2428
chrome.exe
GET
200
95.211.229.247:80
http://syndication.exoclick.com/splash.php?cat=2&idsite=726196&idzone=3585843&login=west-1999&type=8
NL
html
584 b
suspicious
2428
chrome.exe
GET
302
216.58.208.46:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
522 b
whitelisted
2428
chrome.exe
GET
200
88.208.26.31:80
http://nakedteenporn.info/click.php
NL
html
311 b
unknown
2428
chrome.exe
GET
302
88.208.26.31:80
http://eratrf.com/24.html
NL
html
358 b
unknown
2428
chrome.exe
GET
302
88.208.26.31:80
http://eratrf.com/29.html
NL
html
439 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2428
chrome.exe
172.217.21.195:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2428
chrome.exe
172.217.23.164:443
www.google.com
Google Inc.
US
whitelisted
2428
chrome.exe
216.58.208.46:443
clients1.google.com
Google Inc.
US
whitelisted
2428
chrome.exe
216.58.207.78:443
clients2.google.com
Google Inc.
US
whitelisted
—
—
172.217.23.164:443
www.google.com
Google Inc.
US
whitelisted
2428
chrome.exe
216.58.208.46:80
clients1.google.com
Google Inc.
US
whitelisted
—
—
159.148.69.143:80
r4---sn-a5uoxu-gpme.gvt1.com
LATNET SERVISS Ltd.
LV
whitelisted
—
—
172.217.22.97:443
clients2.googleusercontent.com
Google Inc.
US
whitelisted
2428
chrome.exe
208.93.230.26:443
st.chatango.com
Chatango LLC
US
suspicious
2428
chrome.exe
159.148.69.142:80
r3---sn-a5uoxu-gpme.gvt1.com
LATNET SERVISS Ltd.
LV
whitelisted

DNS requests

Domain
IP
Reputation
4horlover.com
  • 208.93.230.204
whitelisted
clientservices.googleapis.com
  • 172.217.21.195
whitelisted
accounts.google.com
  • 172.217.23.109
shared
www.google.com
  • 172.217.23.164
malicious
s.w.org
  • 192.0.77.48
whitelisted
clients1.google.com
  • 216.58.208.46
whitelisted
ssl.gstatic.com
  • 172.217.21.195
whitelisted
clients2.google.com
  • 216.58.207.78
whitelisted
redirector.gvt1.com
  • 216.58.208.46
whitelisted
r4---sn-a5uoxu-gpme.gvt1.com
  • 159.148.69.143
whitelisted

Threats

PID
Process
Class
Message
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://4horlover.com/