URL:

https://smartpdftool.com/

Full analysis: https://app.any.run/tasks/b23f088e-cde2-4d9b-84fc-1daa481e20ca
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: August 06, 2024, 22:37:27
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
adware
advancedinstaller
loader
stealer
Indicators:
MD5:

4527CCB30CD6AB3C867A8447CD6ACE53

SHA1:

A90E41FD1DE668C911DB1D1744F1A0DAB48A6281

SHA256:

9EE83ECF8AA31DCCE120113366D06DF3CA1BA24AB8FEADBF5D61E0B173C39E49

SSDEEP:

3:N8FuVFJ2K:2M2K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2088)
      • powershell.exe (PID: 4084)

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 8112)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 8060)
      • msiexec.exe (PID: 2388)
      • onestart_installer.exe (PID: 8152)
      • setup.exe (PID: 3864)
      • onestart.exe (PID: 8012)

    • ADVANCEDINSTALLER has been detected (SURICATA)

      • msiexec.exe (PID: 2388)

    • Actions looks like stealing of personal data

      • notification_helper.exe (PID: 7948)
      • onestart.exe (PID: 5984)
      • onestart.exe (PID: 7956)

    • Steals credentials from Web Browsers

      • onestart.exe (PID: 5984)

    • Changes the autorun value in the registry

      • onestart.exe (PID: 5984)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 7392)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 8112)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 8112)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 8112)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 8112)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2388)
      • msiexec.exe (PID: 8112)
      • DBar.exe (PID: 6244)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 8060)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 8060)

    • Access to an unwanted program domain was detected

      • msiexec.exe (PID: 2388)

    • Potential Corporate Privacy Violation

      • msiexec.exe (PID: 2388)

    • Process requests binary or script from the Internet

      • msiexec.exe (PID: 2388)

    • Executable content was dropped or overwritten

      • onestart_installer.exe (PID: 8152)
      • setup.exe (PID: 3864)
      • onestart.exe (PID: 8012)

    • Application launched itself

      • setup.exe (PID: 3864)
      • setup.exe (PID: 7072)
      • onestart.exe (PID: 5984)
      • onestart.exe (PID: 4080)

    • Starts CMD.EXE for commands execution

      • setup.exe (PID: 3864)
      • msiexec.exe (PID: 8112)
      • onestart.exe (PID: 5984)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 4540)
      • cmd.exe (PID: 4088)
      • cmd.exe (PID: 7180)
      • cmd.exe (PID: 1860)
      • cmd.exe (PID: 7416)
      • cmd.exe (PID: 7868)
      • cmd.exe (PID: 1108)
      • cmd.exe (PID: 8096)
      • cmd.exe (PID: 7308)
      • cmd.exe (PID: 7756)
      • cmd.exe (PID: 3136)

    • The process creates files with name similar to system file names

      • setup.exe (PID: 3864)

    • The process deletes folder without confirmation

      • setup.exe (PID: 3864)

    • Creates a software uninstall entry

      • setup.exe (PID: 3864)

    • Process drops legitimate windows executable

      • setup.exe (PID: 3864)

    • The process drops C-runtime libraries

      • setup.exe (PID: 3864)

    • Searches for installed software

      • setup.exe (PID: 3864)

    • The executable file from the user directory is run by the CMD process

      • DBar.exe (PID: 6244)
      • onestartupdater.exe (PID: 2992)

    • Reads the date of Windows installation

      • msiexec.exe (PID: 8112)
      • DBar.exe (PID: 6244)

    • Reads Mozilla Firefox installation path

      • onestart.exe (PID: 5984)

  • INFO

    • Reads Microsoft Office registry keys

      • chrome.exe (PID: 6428)
      • setup.exe (PID: 3864)
      • onestart.exe (PID: 5984)

    • The process uses the downloaded file

      • chrome.exe (PID: 7888)
      • chrome.exe (PID: 6428)

    • Reads the computer name

      • msiexec.exe (PID: 8060)
      • msiexec.exe (PID: 8112)
      • msiexec.exe (PID: 2388)
      • onestart_installer.exe (PID: 8152)
      • setup.exe (PID: 3864)
      • notification_helper.exe (PID: 7948)
      • setup.exe (PID: 7072)
      • onestart.exe (PID: 5984)
      • onestart.exe (PID: 4080)
      • DBar.exe (PID: 6244)
      • onestart.exe (PID: 5900)
      • onestart.exe (PID: 1288)
      • onestartupdater.exe (PID: 2992)
      • onestart.exe (PID: 7172)

    • Checks supported languages

      • msiexec.exe (PID: 8112)
      • msiexec.exe (PID: 8060)
      • onestart_installer.exe (PID: 8152)
      • msiexec.exe (PID: 2388)
      • setup.exe (PID: 3864)
      • setup.exe (PID: 7072)
      • notification_helper.exe (PID: 7948)
      • setup.exe (PID: 644)
      • onestart.exe (PID: 5984)
      • DBar.exe (PID: 6244)
      • onestart.exe (PID: 7104)
      • onestart.exe (PID: 4080)
      • onestart.exe (PID: 1288)
      • onestart.exe (PID: 5900)
      • onestart.exe (PID: 2064)
      • onestart.exe (PID: 7956)
      • onestartupdater.exe (PID: 2992)
      • onestart.exe (PID: 1356)
      • onestart.exe (PID: 6392)
      • onestart.exe (PID: 3548)
      • onestart.exe (PID: 3540)
      • setup.exe (PID: 1224)
      • onestart.exe (PID: 2532)
      • onestart.exe (PID: 6776)
      • onestart.exe (PID: 7172)
      • onestart.exe (PID: 7552)
      • onestart.exe (PID: 6164)
      • onestart.exe (PID: 2088)
      • onestart.exe (PID: 8012)

    • Reads the software policy settings

      • msiexec.exe (PID: 8008)
      • powershell.exe (PID: 2088)
      • msiexec.exe (PID: 8060)
      • powershell.exe (PID: 4084)
      • DBar.exe (PID: 6244)

    • Reads Environment values

      • msiexec.exe (PID: 8112)
      • msiexec.exe (PID: 2388)
      • DBar.exe (PID: 6244)

    • Create files in a temporary directory

      • msiexec.exe (PID: 8112)
      • powershell.exe (PID: 2088)
      • powershell.exe (PID: 4084)
      • onestart.exe (PID: 7956)
      • onestart.exe (PID: 5984)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 2088)
      • powershell.exe (PID: 4084)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 8008)
      • powershell.exe (PID: 2088)
      • powershell.exe (PID: 4084)
      • Taskmgr.exe (PID: 6580)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 8008)
      • msiexec.exe (PID: 8060)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 8008)

    • Application launched itself

      • chrome.exe (PID: 6428)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 2388)
      • setup.exe (PID: 3864)
      • onestart_installer.exe (PID: 8152)
      • notification_helper.exe (PID: 7948)
      • setup.exe (PID: 7072)
      • msiexec.exe (PID: 8112)
      • DBar.exe (PID: 6244)
      • onestart.exe (PID: 5984)
      • onestart.exe (PID: 1288)
      • onestartupdater.exe (PID: 2992)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 8060)
      • DBar.exe (PID: 6244)
      • onestart.exe (PID: 5984)

    • Checks proxy server information

      • msiexec.exe (PID: 2388)
      • DBar.exe (PID: 6244)
      • onestart.exe (PID: 5984)

    • Process checks computer location settings

      • msiexec.exe (PID: 8112)
      • DBar.exe (PID: 6244)
      • onestart.exe (PID: 5984)
      • onestart.exe (PID: 6164)
      • onestart.exe (PID: 6392)
      • onestart.exe (PID: 3548)
      • onestart.exe (PID: 3540)
      • onestart.exe (PID: 2532)
      • onestart.exe (PID: 6776)
      • onestart.exe (PID: 7552)
      • onestart.exe (PID: 1356)
      • onestart.exe (PID: 2088)

    • Creates files in the program directory

      • DBar.exe (PID: 6244)

    • Disables trace logs

      • DBar.exe (PID: 6244)

    • Manual execution by a user

      • Taskmgr.exe (PID: 6580)
      • Taskmgr.exe (PID: 7744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
250
Monitored processes
109
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msiexec.exe msiexec.exe msiexec.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs #ADVANCEDINSTALLER msiexec.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs onestart_installer.exe setup.exe setup.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs xcopy.exe no specs notification_helper.exe chrome.exe no specs setup.exe no specs setup.exe no specs onestart.exe cmd.exe no specs conhost.exe no specs onestart.exe no specs xcopy.exe no specs onestart.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs dbar.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs onestart.exe no specs onestart.exe onestart.exe no specs chrome.exe no specs onestart.exe cmd.exe no specs onestartupdater.exe onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe chrome.exe no specs taskmgr.exe no specs taskmgr.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
232\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
644"C:\Users\admin\AppData\Local\OneStart.ai\OneStart Installer\CR_1033E.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=126.0.6478.118 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x7ff71397ca30,0x7ff71397ca3c,0x7ff71397ca48C:\Users\admin\AppData\Local\OneStart.ai\OneStart Installer\CR_1033E.tmp\setup.exe—setup.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
MEDIUM
Description:
OneStart Installer
Exit code:
0
Version:
126.0.6478.118
Modules
Images
c:\users\admin\appdata\local\onestart.ai\onestart installer\cr_1033e.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
904C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1108C:\Windows\System32\cmd.exe /c "taskkill /im DBar.exe"C:\Windows\System32\cmd.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1132\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1224"C:\Users\admin\AppData\Local\OneStart.ai\OneStart Installer\CR_1033E.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=126.0.6478.118 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x7ff71397ca30,0x7ff71397ca3c,0x7ff71397ca48C:\Users\admin\AppData\Local\OneStart.ai\OneStart Installer\CR_1033E.tmp\setup.exe—setup.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
MEDIUM
Description:
OneStart Installer
Exit code:
0
Version:
126.0.6478.118
Modules
Images
c:\users\admin\appdata\local\onestart.ai\onestart installer\cr_1033e.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1288"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --field-trial-handle=2068,i,5309903496724510339,17240461887478960670,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
MEDIUM
Description:
OneStart
Version:
126.0.6478.118
Modules
Images
c:\users\admin\appdata\local\onestart.ai\onestart\application\onestart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\onestart.ai\onestart\application\126.0.6478.118\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
1356"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4264,i,5309903496724510339,17240461887478960670,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe—onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
LOW
Description:
OneStart
Exit code:
0
Version:
126.0.6478.118
Modules
Images
c:\users\admin\appdata\local\onestart.ai\onestart\application\onestart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\onestart.ai\onestart\application\126.0.6478.118\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
1360taskkill /im DBar.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1420"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5920 --field-trial-handle=1916,i,2794642311991705709,4589278780672502785,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
68 653
Read events
68 160
Write events
457
Delete events
36

Modification events

(PID) Process:(6428) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6428) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6428) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(6428) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(6428) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6428) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(6428) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6428) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(6428) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(6428) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
66
Suspicious files
369
Text files
103
Unknown types
248

Dropped files

PID
Process
Filename
Type
6428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RFe5a31.TMP —
MD5:—
SHA256:—
6428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
6428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RFe5a31.TMP —
MD5:—
SHA256:—
6428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
6428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Variationsbinary
MD5:961E3604F228B0D10541EBF921500C86
SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
6428chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.oldtext
MD5:A95974F48FC4A0E16E9D7729D7874157
SHA256:926422473F59B7759EA8EB2064FD6DF9D00A88B548DEF1D5C3E08860357C03A2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
47
TCP/UDP connections
100
DNS requests
76
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3376
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3376
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6384
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
1700
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7588
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
6428
chrome.exe
GET
200
100.24.223.135:80
http://ocsps.ssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQg3SSkKA74hABkhmlBtJTz8w3hlAQU%2BWC71OPVNPa49QaAJadz20ZpqJ4CEEJLalPOx2YUHCpjsaUcQQQ%3D
unknown
—
—
whitelisted
7588
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
7588
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
6428
chrome.exe
GET
200
18.244.18.55:80
http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl
unknown
—
—
whitelisted
7588
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3028
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4084
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6428
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
6692
chrome.exe
18.66.102.17:443
smartpdftool.com
—
US
unknown
6692
chrome.exe
173.194.69.84:443
accounts.google.com
GOOGLE
US
unknown
6692
chrome.exe
142.250.185.138:443
fonts.googleapis.com
GOOGLE
US
whitelisted
6692
chrome.exe
172.217.18.3:443
fonts.gstatic.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.78
whitelisted
smartpdftool.com
  • 18.66.102.17
  • 18.66.102.41
  • 18.66.102.96
  • 18.66.102.52
unknown
accounts.google.com
  • 173.194.69.84
  • 108.177.127.84
whitelisted
fonts.googleapis.com
  • 142.250.185.138
whitelisted
fonts.gstatic.com
  • 172.217.18.3
whitelisted
content-autofill.googleapis.com
  • 142.250.186.42
  • 216.58.206.74
  • 216.58.206.42
  • 142.250.185.106
  • 142.250.74.202
  • 142.250.186.138
  • 172.217.16.138
  • 142.250.185.202
  • 142.250.181.234
  • 142.250.185.234
  • 142.250.184.202
  • 142.250.185.138
  • 142.250.186.74
  • 142.250.185.170
  • 172.217.18.10
  • 216.58.212.170
whitelisted
www.google.com
  • 172.217.16.196
whitelisted
www.bing.com
  • 104.126.37.144
  • 104.126.37.155
  • 104.126.37.162
  • 104.126.37.128
  • 104.126.37.185
  • 104.126.37.129
  • 104.126.37.176
  • 104.126.37.130
  • 104.126.37.171
  • 104.126.37.186
  • 104.126.37.177
  • 104.126.37.145
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
2388
msiexec.exe
Potentially Bad Traffic
ET POLICY Executable served from Amazon S3
2388
msiexec.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1288
onestart.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
1288
onestart.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
1288
onestart.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
1288
onestart.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
1288
onestart.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
1288
onestart.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://smartpdftool.com/