File name:

ANY ADOBE PROGRAM FOR FREE by 2Cheap.rar

Full analysis: https://app.any.run/tasks/9a430d53-d624-4c82-9a3a-86804a5efc3c
Verdict: Malicious activity
Analysis date: October 30, 2018, 08:32:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

937B9BC6C403E8B67265ABAF688852CB

SHA1:

A8EF23B147AAB4EAA085B68645B8D1832983EECC

SHA256:

9DF25F22102CDC824F57388A4A4EB1B77B0B9EC1D90D5E0CE270BAE4DCC18C5C

SSDEEP:

49152:y+Sfw4h9l/wvO6XeJ35aM+IOnXjXDpyCdSeBqIYcEnbgNAaSm:y7/v6yWEmTT9dSeB7jEnbdI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • Creative_Cloud_Set-Up.exe (PID: 600)
      • install.exe (PID: 2764)
      • Setup.exe (PID: 920)
      • vcredist_x86.exe (PID: 2248)

    • Application was dropped or rewritten from another process

      • adobe.snr.patch-painter.exe (PID: 772)
      • adobe.snr.patch-painter.exe (PID: 2448)
      • Creative_Cloud_Set-Up.exe (PID: 600)
      • adobe.snr.patch-painter.exe (PID: 3604)
      • VCREDI~2.EXE (PID: 3612)
      • Setup.exe (PID: 920)
      • install.exe (PID: 2764)
      • adobe.snr.patch-painter.exe (PID: 1960)

    • Changes the autorun value in the registry

      • gccustomhook.exe (PID: 3496)
      • AAMCustomHook.exe (PID: 340)
      • vcredist_x86.exe (PID: 4024)
      • VCREDI~3.EXE (PID: 2808)
      • vcredist_x64.exe (PID: 2152)
      • VCREDI~2.EXE (PID: 3612)

    • Changes settings of System certificates

      • AGSService.exe (PID: 2820)

  • SUSPICIOUS

    • Reads internet explorer settings

      • Creative_Cloud_Set-Up.exe (PID: 600)

    • Changes IE settings (feature browser emulation)

      • Creative_Cloud_Set-Up.exe (PID: 600)

    • Reads Internet Cache Settings

      • Creative_Cloud_Set-Up.exe (PID: 600)

    • Creates files in the user directory

      • Creative_Cloud_Set-Up.exe (PID: 600)

    • Executable content was dropped or overwritten

      • Creative_Cloud_Set-Up.exe (PID: 600)
      • msiexec.exe (PID: 3824)
      • vcredist_x64.exe (PID: 2152)
      • VCREDI~2.EXE (PID: 3612)
      • vcredist_x86.exe (PID: 3968)
      • vcredist_x64.exe (PID: 1176)
      • vcredist_x86.exe (PID: 2248)

    • Creates files in the program directory

      • AAMCustomHook.exe (PID: 340)
      • gccustomhook.exe (PID: 3496)
      • AGSService.exe (PID: 2820)
      • Creative_Cloud_Set-Up.exe (PID: 600)
      • vcredist_x64.exe (PID: 2692)

    • Adds / modifies Windows certificates

      • AGSService.exe (PID: 2820)

    • Removes files from Windows directory

      • AGSService.exe (PID: 2820)
      • msiexec.exe (PID: 3824)

    • Creates files in the Windows directory

      • AGSService.exe (PID: 2820)
      • msiexec.exe (PID: 3824)

    • Application launched itself

      • vcredist_x86.exe (PID: 2848)

    • Searches for installed software

      • vcredist_x86.exe (PID: 2248)
      • vcredist_x86.exe (PID: 2848)

    • Creates or modifies windows services

      • vcredist_x86.exe (PID: 2848)

  • INFO

    • Reads settings of System Certificates

      • Creative_Cloud_Set-Up.exe (PID: 600)
      • chrome.exe (PID: 1860)

    • Application launched itself

      • chrome.exe (PID: 1860)
      • msiexec.exe (PID: 3824)

    • Dropped object may contain Bitcoin addresses

      • chrome.exe (PID: 1860)
      • Creative_Cloud_Set-Up.exe (PID: 600)

    • Changes settings of System certificates

      • chrome.exe (PID: 1860)

    • Creates files in the program directory

      • msiexec.exe (PID: 3824)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3824)

    • Creates or modifies windows services

      • vssvc.exe (PID: 1680)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 1680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 1957586
UncompressedSize: 2093760
OperatingSystem: Win32
ModifyDate: 2018:10:28 19:50:06
PackingMethod: Normal
ArchivedFileName: Creative_Cloud_Set-Up.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
98
Monitored processes
41
Malicious processes
9
Suspicious processes
5

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe no specs adobe.snr.patch-painter.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs creative_cloud_set-up.exe chrome.exe no specs chrome.exe no specs adobe.snr.patch-painter.exe no specs adobe.snr.patch-painter.exe aamcustomhook.exe gccustomhook.exe agsservice.exe adobeipcbrokercustomhook.exe no specs runtimecustomhook.exe no specs vcredist_x86.exe vcredi~3.exe msiexec.exe no specs msiexec.exe notepad.exe no specs notepad.exe no specs msiexec.exe no specs vcredist_x64.exe vcredi~2.exe msiexec.exe no specs vcredist_x86.exe install.exe no specs vcredist_x64.exe no specs vcredist_x64.exe setup.exe vcredist_x86.exe no specs vcredist_x86.exe vssvc.exe no specs adobe.snr.patch-painter.exe

Process information

PID
CMD
Path
Indicators
Parent process
340"C:\Program Files\Common Files\Adobe\OOBE\PDApp\core\AAMCustomHook.exe" --createInventory=1 --doPostInstallStep=1 C:\Program Files\Common Files\Adobe\OOBE\PDApp\core\AAMCustomHook.exe
Creative_Cloud_Set-Up.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
HIGH
Description:
Adobe Application Manager
Exit code:
0
Version:
10.0.0.49
Modules
Images
c:\program files\common files\adobe\oobe\pdapp\core\aamcustomhook.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
600"C:\Users\admin\Desktop\Creative_Cloud_Set-Up.exe" C:\Users\admin\Desktop\Creative_Cloud_Set-Up.exe
explorer.exe
User:
admin
Company:
Adobe Inc.
Integrity Level:
HIGH
Description:
Adobe Installer
Exit code:
0
Version:
4.7.0.400
Modules
Images
c:\users\admin\desktop\creative_cloud_set-up.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
772"C:\Users\admin\Desktop\adobe.snr.patch-painter.exe" C:\Users\admin\Desktop\adobe.snr.patch-painter.exe
explorer.exe
User:
admin
Company:
PainteR
Integrity Level:
HIGH
Description:
Universal Adobe Patcher
Exit code:
0
Version:
1.5.0.0
Modules
Images
c:\users\admin\desktop\adobe.snr.patch-painter.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
844"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ANY ADOBE PROGRAM FOR FREE by 2Cheap.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
920c:\b17a4b3d4688671f45c2\Setup.exe /q /norestartc:\b17a4b3d4688671f45c2\Setup.exe
vcredist_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setup Installer
Exit code:
5100
Version:
10.0.40219.325 built by: SP1LDR
Modules
Images
c:\b17a4b3d4688671f45c2\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\b17a4b3d4688671f45c2\setupengine.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1176"C:\Program Files\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc10\64bit\vcredist_x64.exe" /q /norestartC:\Program Files\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc10\64bit\vcredist_x64.exe
RuntimeCustomHook.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2010 x64 Redistributable Setup
Exit code:
5100
Version:
10.0.40219.325
Modules
Images
c:\program files\common files\adobe\adobe desktop common\runtime\customhook\vc10\64bit\vcredist_x64.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1336"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=68.0.3440.106 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x6f5e00b0,0x6f5e00c0,0x6f5e00ccC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1680C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1860"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1960"C:\Users\admin\Desktop\Adobe\adobe.snr.patch-painter.exe" C:\Users\admin\Desktop\Adobe\adobe.snr.patch-painter.exe
explorer.exe
User:
admin
Company:
PainteR
Integrity Level:
HIGH
Description:
Universal Adobe Patcher
Exit code:
0
Version:
1.5.0.0
Modules
Images
c:\users\admin\desktop\adobe\adobe.snr.patch-painter.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
2 971
Read events
2 191
Write events
745
Delete events
35

Modification events

(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(844) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\ANY ADOBE PROGRAM FOR FREE by 2Cheap.rar
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(844) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:@C:\Windows\system32\msinfo32.exe,-10001
Value:
System Information File
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000200000003000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
52
Suspicious files
151
Text files
349
Unknown types
52

Dropped files

PID
Process
Filename
Type
844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa844.3812\Creative_Cloud_Set-Up.exe —
MD5:—
SHA256:—
844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa844.3812\adobe.snr.patch-painter.exe —
MD5:—
SHA256:—
844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa844.3812\file_id.diz —
MD5:—
SHA256:—
844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa844.3812\painter.nfo —
MD5:—
SHA256:—
1860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\LOG.old —
MD5:—
SHA256:—
1860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old —
MD5:—
SHA256:—
1860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\70f61a7e-994e-4ebb-88d1-b35fa67ebe95.tmp —
MD5:—
SHA256:—
1860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp —
MD5:—
SHA256:—
1860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp —
MD5:—
SHA256:—
1860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\9e3c6ec4-d91f-4842-8782-528d2ee77bc0.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
208
TCP/UDP connections
409
DNS requests
201
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
600
Creative_Cloud_Set-Up.exe
HEAD
200
2.16.186.82:80
http://ccmdl.adobe.com/AdobeProducts/KCCC/1/win32/packages/ACCC_4_7_PDIMPackage_400/PDIM.zip
unknown
—
—
whitelisted
600
Creative_Cloud_Set-Up.exe
HEAD
200
2.16.186.82:80
http://ccmdl.adobe.com/AdobeProducts/KCCC/1/win32/packages/ProvApp_P6_7_mbls_Library_485/provapp-p6.zip
unknown
—
—
whitelisted
600
Creative_Cloud_Set-Up.exe
HEAD
200
2.16.186.82:80
http://ccmdl.adobe.com/AdobeProducts/KCCC/1/win32/packages/ProvApp_PDApp_10_0_Library_49/provapp-PDApp.zip
unknown
—
—
whitelisted
600
Creative_Cloud_Set-Up.exe
HEAD
200
2.16.186.82:80
http://ccmdl.adobe.com/AdobeProducts/KCCC/1/win32/packages/ProvApp_DECore_9_0_Library_279/provapp-DECore.zip
unknown
—
—
whitelisted
600
Creative_Cloud_Set-Up.exe
HEAD
200
2.16.186.82:80
http://ccmdl.adobe.com/AdobeProducts/KCCC/1/win32/packages/ProvApp_D6_9_0_Library_278/provapp-D6.zip
unknown
compressed
1.53 Mb
whitelisted
600
Creative_Cloud_Set-Up.exe
GET
206
2.16.186.82:80
http://ccmdl.adobe.com/AdobeProducts/KCCC/1/win32/packages/ACCC_4_7_PDIMPackage_400/PDIM.zip
unknown
compressed
1.53 Mb
whitelisted
1860
chrome.exe
GET
200
104.108.33.150:80
http://ssl.trustwave.com/issuers/STCA.crt
NL
der
956 b
whitelisted
1860
chrome.exe
GET
200
54.192.94.43:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
600
Creative_Cloud_Set-Up.exe
HEAD
200
2.16.186.82:80
http://ccmdl.adobe.com/AdobeProducts/KCCC/1/win32/packages/ProvApp_AdobeGCClient_10_0_Library_253/provapp-AdobeGCClient.zip
unknown
—
—
whitelisted
1860
chrome.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/47BEABC922EAE80E78783462A79F45C254FDE68B.crt
US
der
969 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1860
chrome.exe
216.58.205.195:443
www.google.de
Google Inc.
US
whitelisted
1860
chrome.exe
216.58.205.132:443
www.google.com
Google Inc.
US
whitelisted
1860
chrome.exe
216.58.205.131:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
1860
chrome.exe
172.64.199.25:443
temp-mail.org
Cloudflare Inc
US
shared
1860
chrome.exe
54.230.93.231:443
go.ezoic.net
Amazon.com, Inc.
US
unknown
1860
chrome.exe
216.58.205.142:443
consent.google.com
Google Inc.
US
whitelisted
1860
chrome.exe
185.33.223.203:443
ib.adnxs.com
AppNexus, Inc
—
suspicious
1860
chrome.exe
216.58.198.42:443
ajax.googleapis.com
Google Inc.
US
whitelisted
1860
chrome.exe
185.64.189.112:443
hbopenbid.pubmatic.com
PubMatic, Inc.
GB
unknown
1860
chrome.exe
74.214.194.134:443
bid.contextweb.com
PulsePoint B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 216.58.205.131
whitelisted
www.google.de
  • 216.58.205.195
whitelisted
www.gstatic.com
  • 216.58.205.195
whitelisted
safebrowsing.googleapis.com
  • 216.58.205.138
whitelisted
accounts.google.com
  • 216.58.205.141
shared
ssl.gstatic.com
  • 216.58.205.131
whitelisted
www.google.com
  • 216.58.205.132
malicious
www.google.nl
  • 216.58.205.195
whitelisted
consent.google.com
  • 216.58.205.142
shared
translate.googleapis.com
  • 216.58.205.138
whitelisted

Threats

No threats detected
Process
Message
Setup.exe
A StopBlock was hit or a System Requirement was not met.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ANY ADOBE PROGRAM FOR FREE by 2Cheap.rar