URL: | https://l.facebook.com/l.php?u=https%3A%2F%2Fbit.ly%2F3d3bePL%3Ffbclid%3DIwAR1LlY2KQPN-xwHXrcMRAkmgnJwFM2y_kkuHN7EIQFV-29gaJqeq9zwFH3U&h=AT2g2PQMvThj6xiSpPH1wrLlfvxMTDdd7xm9zz_X3iLw3cPT-BL-uX7GBmHhsQnSRH9q4V-4SDb2zFnUlHK019swqon8sBEiMIwAeARFyb5g6dbcHICkBQM75jbNcbCMHur_dNSb5ah-Fg6KIg&__tn__=-UK-R&c[0]=AT0GI4od3uUs7hXZ997HqcErT7V-RQfn3ftXeWIbT6kjBGTMEqniPtkBQBMzKfrye-cqvcTHjCERt0NsHmf-s2-u3vkYYWBBPqyMZtqeyTK4thWY7RSPoxVGHsMJaeGPypCLLkpDc3hPlKubrswFIwXP_5Q6Z0VKpCM |
Full analysis: | https://app.any.run/tasks/b9d3e4c1-9755-442a-9ad8-a857441be7d6 |
Verdict: | Malicious activity |
Analysis date: | March 25, 2021, 23:21:28 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 29214B1C767B298AC29AE3BF1F223523 |
SHA1: | 6D597DA33EDE91C99130D76D9E9016D6BC15620D |
SHA256: | A8F136CD618CB14DCD69456EEA366E386784562E73556DDBD62442E0A1E4A76E |
SSDEEP: | 6:2DzVaPzsYyqH7RyLto7ClSxHLX7Icapl74Ydice8lTxNKiJ1PGDkyGIo5Ka/aIQQ:20YYn1yJo7ClSxD7IcilwiT5oGFIa/JZ |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
976 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,5907741752931038976,6855133772358889398,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12125470888125416708 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
1344 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,5907741752931038976,6855133772358889398,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11454635169633459910 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=720 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
1540 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,5907741752931038976,6855133772358889398,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1399731740142748754 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2924 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
1940 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://l.facebook.com/l.php?u=https%3A%2F%2Fbit.ly%2F3d3bePL%3Ffbclid%3DIwAR1LlY2KQPN-xwHXrcMRAkmgnJwFM2y_kkuHN7EIQFV-29gaJqeq9zwFH3U&h=AT2g2PQMvThj6xiSpPH1wrLlfvxMTDdd7xm9zz_X3iLw3cPT-BL-uX7GBmHhsQnSRH9q4V-4SDb2zFnUlHK019swqon8sBEiMIwAeARFyb5g6dbcHICkBQM75jbNcbCMHur_dNSb5ah-Fg6KIg&__tn__=-UK-R&c[0]=AT0GI4od3uUs7hXZ997HqcErT7V-RQfn3ftXeWIbT6kjBGTMEqniPtkBQBMzKfrye-cqvcTHjCERt0NsHmf-s2-u3vkYYWBBPqyMZtqeyTK4thWY7RSPoxVGHsMJaeGPypCLLkpDc3hPlKubrswFIwXP_5Q6Z0VKpCM" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
1980 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1032,5907741752931038976,6855133772358889398,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=4174925457641805554 --mojo-platform-channel-handle=1476 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
2124 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,5907741752931038976,6855133772358889398,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16049301962514151740 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2104 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
2132 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,5907741752931038976,6855133772358889398,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3034112412807218406 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2116 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
2200 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,5907741752931038976,6855133772358889398,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11790969949321214158 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2372 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
2220 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,5907741752931038976,6855133772358889398,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6630887904608204364 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1724 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
2476 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2540 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
|
(PID) Process: | (1940) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
Operation: | write | Name: | failed_count |
Value: 0 | |||
(PID) Process: | (1940) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
Operation: | write | Name: | state |
Value: 2 | |||
(PID) Process: | (1940) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
Operation: | write | Name: | StatusCodes |
Value: | |||
(PID) Process: | (1940) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
(PID) Process: | (1940) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
Operation: | write | Name: | state |
Value: 1 | |||
(PID) Process: | (2476) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
Operation: | write | Name: | 1940-13261188103786500 |
Value: 259 | |||
(PID) Process: | (1940) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
Operation: | write | Name: | dr |
Value: 1 | |||
(PID) Process: | (1940) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
(PID) Process: | (1940) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
Operation: | delete value | Name: | 3252-13245750958665039 |
Value: 0 | |||
(PID) Process: | (1940) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
Operation: | write | Name: | usagestats |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1940 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-605D1B08-794.pma | — | |
MD5:— | SHA256:— | |||
1940 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old | — | |
MD5:— | SHA256:— | |||
1940 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\7ce7fb48-590a-4a41-abd6-0fb434705d92.tmp | — | |
MD5:— | SHA256:— | |||
1940 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp | — | |
MD5:— | SHA256:— | |||
1940 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF48682.TMP | text | |
MD5:— | SHA256:— | |||
1940 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF486b1.TMP | text | |
MD5:— | SHA256:— | |||
1940 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old~RF4871e.TMP | text | |
MD5:— | SHA256:— | |||
1940 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old | text | |
MD5:— | SHA256:— | |||
1940 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old | — | |
MD5:— | SHA256:— | |||
1940 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF488c4.TMP | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1980 | chrome.exe | GET | 200 | 52.16.208.23:80 | http://dw.lp.eu.adslog.net/lp/dk/contentGreen/pin.php?gateway=nth&token=true&has_lookup=&service_id=&click_id=605d1b4de98e930001c60c9d&pub_id=1309&pubref=605d1b4de98e930001c60c9d&offer_id=58914&sub_id=85471&cid=0cf24660-66c4-418f-8c69-532453743a03&rotate_id=0a523e7e-b116-4785-94cf-504880ad647f&ip=157.97.120.10&portalDomain=dw.lp.eu.adslog.net&country=&successMessage=SMS%20sendt%20til%20mobiltelefonen!&msisdn=0045&opportunityEndUserId=34193018 | IE | html | 3.12 Kb | unknown |
1980 | chrome.exe | GET | 200 | 52.16.208.23:80 | http://dw.lp.eu.adslog.net/lp/dk/contentGreen/pin.php?gateway=nth&token=true&msisdn=0045&click_id=605d1b4de98e930001c60c9d&pub_id=1309&pubref=605d1b4de98e930001c60c9d&offer_id=58914&sub_id=85471&cid=0cf24660-66c4-418f-8c69-532453743a03&rotate_id=0a523e7e-b116-4785-94cf-504880ad647f&operator=&ip=157.97.120.10&opportunityEndUserId=34193018&portalDomain=dw.lp.eu.adslog.net&errMessage=Ugyldig%20pin!%20Pr%C3%B8v%20igen | IE | html | 3.14 Kb | unknown |
1980 | chrome.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D | US | der | 471 b | whitelisted |
1980 | chrome.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEAqN7HPiQ2%2F4c3rdXE3uHG8%3D | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1980 | chrome.exe | 31.13.92.37:443 | l.facebook.com | Facebook, Inc. | IE | whitelisted |
1980 | chrome.exe | 67.199.248.10:443 | bit.ly | Bitly Inc | US | shared |
1980 | chrome.exe | 172.217.16.97:443 | lh4.googleusercontent.com | Google Inc. | US | whitelisted |
1980 | chrome.exe | 172.217.18.65:443 | lh5.googleusercontent.com | Google Inc. | US | whitelisted |
1980 | chrome.exe | 216.58.214.206:443 | clients1.google.com | Google Inc. | US | whitelisted |
1980 | chrome.exe | 172.217.18.67:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
1980 | chrome.exe | 65.9.58.122:443 | cpbldi.com | AT&T Services, Inc. | US | suspicious |
1980 | chrome.exe | 142.250.186.132:443 | www.google.com | Google Inc. | US | whitelisted |
1980 | chrome.exe | 13.32.23.164:443 | d1xkyo9j4r7vnn.cloudfront.net | Amazon.com, Inc. | US | unknown |
1980 | chrome.exe | 172.67.69.215:443 | bucket.cpabuild.com | — | US | unknown |
Domain | IP | Reputation |
---|---|---|
l.facebook.com |
| whitelisted |
accounts.google.com |
| shared |
bit.ly |
| shared |
ocsp.digicert.com |
| whitelisted |
sites.google.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
lh5.googleusercontent.com |
| whitelisted |
apis.google.com |
| whitelisted |
lh4.googleusercontent.com |
| whitelisted |