| URL: | https://email.y.kajabimail.net/c/eJxskLtu3DAQRb9GbAILfImPgkWCxEDqfIDAx6w9sUQq5KyB_ftgvV4giF3OueQpTjyOtcYdwkv8HRM-DGodTr1VGg9Hb-WcCVtlJRiZlWEQhLVCLcJLw2CPuK0FNnyFflmxBOUXo423i72vWIIUi5XWG31nO4wRn2ClywHhhlJvseQ46P1Jh9HOPcOn_wf8OUO9jXd0Tm-2H9fr23-yz5bn4CBB4pAKh8yTKZIXp6yGxet4SsozDJJLw6WwwgnJ9RxFVtzZtJiT8MnrSfPLfOt2lc8ViG3hmegYk_o6ycdJPirCly3Oue0z9evtvdJON68lu3cYUAv0tbQ9Yg0flD3ESq3iKLgjdWxj0rxD3OgSn6DSVc46ZDwQKr0VM14s3Dlh2EB6j6idddwpyyj8QoIvP79PUv2DX4P8GwAA___fVa3p%209#cndpbGJhbmtzQGNpdHlvZmNsZW1zb24ub3Jn |
| Full analysis: | https://app.any.run/tasks/4481424f-7081-4cb0-9e18-95dbb2e88a3e |
| Verdict: | Malicious activity |
| Analysis date: | February 17, 2026, 21:01:45 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 2FAC023CFD629DF98F7CD3E298E83F2D |
| SHA1: | 1FDFB55B057499486BF1E2E6DB7DF4A83D8383B0 |
| SHA256: | 970318D0894197AFC9FC617FBCE0F792E8EFC3BD07879735008AB0CE5541688C |
| SSDEEP: | 6:2kwbAsOr0ENCTzki+egBOC6W35MQ+lxIqWXPc7iTj9iik1pXIflqr7IMByvhczO0:2hJOjQ/Z+tURWfc7WuWqr+0DIFlaDIj6 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 404 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3284,i,3095996762760257720,11469042706082329784,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=3316 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 1400 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=6044,i,3095996762760257720,11469042706082329784,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=6008 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 1512 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=5996,i,3095996762760257720,11469042706082329784,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=5480 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 1908 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=5824,i,3095996762760257720,11469042706082329784,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=5848 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 2232 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=5896,i,3095996762760257720,11469042706082329784,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=5716 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 2456 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3256,i,3095996762760257720,11469042706082329784,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=3264 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 2600 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=5808,i,3095996762760257720,11469042706082329784,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=5776 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 4024 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=5776,i,3095996762760257720,11469042706082329784,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=5972 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 4040 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=5936,i,3095996762760257720,11469042706082329784,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=5480 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 133.0.6943.127 Modules
| |||||||||||||||
| 4136 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-features=HttpsUpgrades,HttpsFirstModeV2,HttpsOnlyMode,HttpsFirstBalancedMode --no-first-run --no-default-browser-check https://email.y.kajabimail.net/c/eJxskLtu3DAQRb9GbAILfImPgkWCxEDqfIDAx6w9sUQq5KyB_ftgvV4giF3OueQpTjyOtcYdwkv8HRM-DGodTr1VGg9Hb-WcCVtlJRiZlWEQhLVCLcJLw2CPuK0FNnyFflmxBOUXo423i72vWIIUi5XWG31nO4wRn2ClywHhhlJvseQ46P1Jh9HOPcOn_wf8OUO9jXd0Tm-2H9fr23-yz5bn4CBB4pAKh8yTKZIXp6yGxet4SsozDJJLw6WwwgnJ9RxFVtzZtJiT8MnrSfPLfOt2lc8ViG3hmegYk_o6ycdJPirCly3Oue0z9evtvdJON68lu3cYUAv0tbQ9Yg0flD3ESq3iKLgjdWxj0rxD3OgSn6DSVc46ZDwQKr0VM14s3Dlh2EB6j6idddwpyyj8QoIvP79PUv2DX4P8GwAA___fVa3p%209#cndpbGJhbmtzQGNpdHlvZmNsZW1zb24ub3Jn | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 133.0.6943.127 Modules
| |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4136 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old~RF1e5542.TMP | — | |
MD5:— | SHA256:— | |||
| 4136 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF1e5532.TMP | — | |
MD5:— | SHA256:— | |||
| 4136 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old | — | |
MD5:— | SHA256:— | |||
| 4136 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF1e5542.TMP | — | |
MD5:— | SHA256:— | |||
| 4136 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 4136 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 4136 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF1e5542.TMP | — | |
MD5:— | SHA256:— | |||
| 4136 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF1e5542.TMP | — | |
MD5:— | SHA256:— | |||
| 4136 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF1e5542.TMP | — | |
MD5:— | SHA256:— | |||
| 4136 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6336 | chrome.exe | GET | 200 | 216.239.34.223:443 | https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LANGUAGE_DETECTION | unknown | binary | 258 Kb | whitelisted |
6336 | chrome.exe | GET | 200 | 172.217.16.202:443 | https://safebrowsingohttpgateway.googleapis.com/v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE | unknown | — | 41 b | whitelisted |
6336 | chrome.exe | GET | 302 | 34.102.239.211:443 | https://email.y.kajabimail.net/c/eJxskLtu3DAQRb9GbAILfImPgkWCxEDqfIDAx6w9sUQq5KyB_ftgvV4giF3OueQpTjyOtcYdwkv8HRM-DGodTr1VGg9Hb-WcCVtlJRiZlWEQhLVCLcJLw2CPuK0FNnyFflmxBOUXo423i72vWIIUi5XWG31nO4wRn2ClywHhhlJvseQ46P1Jh9HOPcOn_wf8OUO9jXd0Tm-2H9fr23-yz5bn4CBB4pAKh8yTKZIXp6yGxet4SsozDJJLw6WwwgnJ9RxFVtzZtJiT8MnrSfPLfOt2lc8ViG3hmegYk_o6ycdJPirCly3Oue0z9evtvdJON68lu3cYUAv0tbQ9Yg0flD3ESq3iKLgjdWxj0rxD3OgSn6DSVc46ZDwQKr0VM14s3Dlh2EB6j6idddwpyyj8QoIvP79PUv2DX4P8GwAA___fVa3p%209 | unknown | — | 416 b | unknown |
6336 | chrome.exe | GET | 200 | 216.58.206.67:443 | https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=133 | unknown | — | 85.6 Kb | whitelisted |
6336 | chrome.exe | GET | 200 | 142.251.127.139:80 | http://clients2.google.com/time/1/current?cup2key=8:V2vDiiQ3uGo97xAKSHI8hR41vaDsk6E8X4Xn3DscsTg&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | unknown | — | — | whitelisted |
6336 | chrome.exe | POST | 200 | 142.251.127.84:443 | https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard | unknown | text | 17 b | whitelisted |
6336 | chrome.exe | GET | 301 | 185.40.85.56:80 | http://www.3tikla.com.tr/3993484o942 | unknown | — | — | unknown |
6336 | chrome.exe | GET | 200 | 185.40.85.56:80 | http://www.3tikla.com.tr/3993484o942/ | unknown | — | — | unknown |
6336 | chrome.exe | GET | 301 | 185.40.85.56:443 | https://3tikla.com.tr/3993484o942 | unknown | binary | 795 b | unknown |
6336 | chrome.exe | GET | 200 | 188.114.97.3:443 | https://jenkins.kefreja.sbs/favicon.ico | unknown | binary | 14.4 Kb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2328 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:137 | — | Not routed | — | whitelisted |
5512 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6768 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:138 | — | Not routed | — | whitelisted |
6336 | chrome.exe | 142.251.127.139:80 | google.com | GOOGLE | US | whitelisted |
6336 | chrome.exe | 172.217.16.202:443 | safebrowsingohttpgateway.googleapis.com | GOOGLE | US | whitelisted |
6336 | chrome.exe | 216.58.206.67:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
6336 | chrome.exe | 142.251.127.84:443 | accounts.google.com | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
clients2.google.com |
| whitelisted |
safebrowsingohttpgateway.googleapis.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
email.y.kajabimail.net |
| unknown |
accounts.google.com |
| whitelisted |
3tikla.com.tr |
| unknown |