File name:

unionreturns.rtf.exe

Full analysis: https://app.any.run/tasks/7ccab669-6116-4527-a983-848eca6ad626
Verdict: Malicious activity
Analysis date: December 02, 2023, 21:28:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
revengerat
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

4C2ED6148F7E4787FD8D1017BD81CC11

SHA1:

6ACF9A455C5CABE93D4AA625E7B70BC42200A533

SHA256:

B73C950CCC87F4C49A9A5AC1B5E28936B07F40CEF46CFAC60C0ED43D15F2D994

SSDEEP:

24576:1oFbrcrnIxMfzcayo389j1GwZlZ/Zvi4z/v6HsEnWeonu2NAz1tsliem9B:1oFbrcrnIxMfzcayo389j1GwZlZ/ZviL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes appearance of the Explorer extensions

      • unionreturns.rtf.exe (PID: 2428)

    • Drops the executable file immediately after the start

      • devenv.exe (PID: 1116)
      • unionreturns.rtf.exe (PID: 2428)

    • REVENGERAT has been detected (YARA)

      • admtools.exe (PID: 2184)

  • SUSPICIOUS

    • Reads the Internet Settings

      • unionreturns.rtf.exe (PID: 2428)
      • devenv.exe (PID: 1116)
      • dnSpy.exe (PID: 3536)

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 1160)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 1160)

    • Connects to unusual port

      • admtools.exe (PID: 2184)

  • INFO

    • Checks supported languages

      • unionreturns.rtf.exe (PID: 2428)
      • devenv.exe (PID: 1116)
      • admtools.exe (PID: 2184)
      • dnSpy.exe (PID: 3536)
      • wmpnscfg.exe (PID: 3012)

    • Reads the computer name

      • unionreturns.rtf.exe (PID: 2428)
      • devenv.exe (PID: 1116)
      • admtools.exe (PID: 2184)
      • wmpnscfg.exe (PID: 3012)
      • dnSpy.exe (PID: 3536)

    • Reads the machine GUID from the registry

      • unionreturns.rtf.exe (PID: 2428)
      • devenv.exe (PID: 1116)
      • admtools.exe (PID: 2184)
      • dnSpy.exe (PID: 3536)

    • The process uses the downloaded file

      • chrome.exe (PID: 988)
      • WinRAR.exe (PID: 1160)

    • Manual execution by a user

      • dnSpy.exe (PID: 3536)
      • chrome.exe (PID: 3452)
      • wmpnscfg.exe (PID: 3012)

    • Application launched itself

      • chrome.exe (PID: 3452)

    • Creates files in the program directory

      • dnSpy.exe (PID: 3536)

    • Drops the executable file immediately after the start

      • chrome.exe (PID: 4060)
      • WinRAR.exe (PID: 1160)

    • Creates files or folders in the user directory

      • dnSpy.exe (PID: 3536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (62)
.exe | Win64 Executable (generic) (23.3)
.dll | Win32 Dynamic Link Library (generic) (5.5)
.exe | Win32 Executable (generic) (3.8)
.exe | Win16/32 Executable Delphi generic (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2105:05:31 07:12:31+02:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 80
CodeSize: 558080
InitializedDataSize: 117248
UninitializedDataSize: -
EntryPoint: 0x8a2ce
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.2.51.0
ProductVersionNumber: 4.2.51.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 4.2.51.0
InternalName: -.exe
LegalCopyright: © Microsoft Corporation
LegalTrademarks: -
OriginalFileName: -.exe
ProductName: -
ProductVersion: 4.2.51.0
AssemblyVersion: 4.2.51.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
73
Monitored processes
29
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start runas.exe no specs unionreturns.rtf.exe devenv.exe no specs #REVENGERAT admtools.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs wmpnscfg.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs dnspy.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=1992 --field-trial-handle=1136,i,1764999150789524893,5813773545488116793,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
372"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=992 --field-trial-handle=1136,i,1764999150789524893,5813773545488116793,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
844"C:\Windows\System32\runas.exe" /user:administrator C:\Users\admin\Desktop\unionreturns.rtf.exeC:\Windows\System32\runas.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Run As Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\runas.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
860"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=1240 --field-trial-handle=1136,i,1764999150789524893,5813773545488116793,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
988"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3652 --field-trial-handle=1136,i,1764999150789524893,5813773545488116793,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1116"C:\Users\Public\Documents\devenv.exe" C:\Users\Public\Documents\devenv.exe—unionreturns.rtf.exe
User:
Administrator
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\public\documents\devenv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1160"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\dnSpy-net-win32.zip"C:\Program Files\WinRAR\WinRAR.exe—chrome.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1752"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3116 --field-trial-handle=1136,i,1764999150789524893,5813773545488116793,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1832"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3944 --field-trial-handle=1136,i,1764999150789524893,5813773545488116793,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2184"C:\Users\Public\Documents\admtools.exe" C:\Users\Public\Documents\admtools.exe
unionreturns.rtf.exe
User:
Administrator
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\public\documents\admtools.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
7 085
Read events
6 978
Write events
104
Delete events
3

Modification events

(PID) Process:(2428) unionreturns.rtf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:delete valueName:ProxyBypass
Value:
0
(PID) Process:(2428) unionreturns.rtf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:delete valueName:IntranetName
Value:
0
(PID) Process:(2428) unionreturns.rtf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2428) unionreturns.rtf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2428) unionreturns.rtf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
2
(PID) Process:(2428) unionreturns.rtf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:HideFileExt
Value:
1
(PID) Process:(1116) devenv.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1116) devenv.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1116) devenv.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1116) devenv.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
1 686
Suspicious files
247
Text files
51
Unknown types
3

Dropped files

PID
Process
Filename
Type
2428unionreturns.rtf.exeC:\RCX7778.tmpexecutable
MD5:C816F066703EF00DB510852028271CFF
SHA256:BC19321B63544026201C26E13124A022F50AEB1A428E08C847A2183C727B298C
2428unionreturns.rtf.exeC:\RCX77C8.tmpexecutable
MD5:F42955F7E4FCD31F7A9743A5A1E1D228
SHA256:BE8EB4911479B562B160328D1FB533B195020783B14DBBE9AD13442BC364B899
2428unionreturns.rtf.exeC:\RCX76EA.tmpexecutable
MD5:DA854CB03DA64F851F912561BFF7EB81
SHA256:58A4DAF54D45ECEA9E4A731EE5A1EA237E3CFC357AD848BBE235164CE7ABFF90
2428unionreturns.rtf.exeC:\Users\Administrator\NTUSER.DAT.exeexecutable
MD5:4C2ED6148F7E4787FD8D1017BD81CC11
SHA256:B73C950CCC87F4C49A9A5AC1B5E28936B07F40CEF46CFAC60C0ED43D15F2D994
2428unionreturns.rtf.exeC:\RCX76CA.tmpexecutable
MD5:4C2ED6148F7E4787FD8D1017BD81CC11
SHA256:B73C950CCC87F4C49A9A5AC1B5E28936B07F40CEF46CFAC60C0ED43D15F2D994
2428unionreturns.rtf.exeC:\Users\Administrator\ntuser.dat.LOG1.exeexecutable
MD5:4C2ED6148F7E4787FD8D1017BD81CC11
SHA256:B73C950CCC87F4C49A9A5AC1B5E28936B07F40CEF46CFAC60C0ED43D15F2D994
2428unionreturns.rtf.exeC:\Users\Public\Documents\devenv.exeexecutable
MD5:3FE2B1337F824DFCBF545CCFFB5454F3
SHA256:001D3941132DD30110E1A650ABBC4DD49D352F06D08D491A4F6503ACFF875E67
1116devenv.exeC:\Users\Public\Documents\p2p.dllexecutable
MD5:6CFFF9C292A1BB84D395AF36A514B969
SHA256:A3967A0CC27A52334C159387BE84DBA99EC5F5F2978260F6B1E3AFA648A060DB
2428unionreturns.rtf.exeC:\RCX77A8.tmpexecutable
MD5:4C2ED6148F7E4787FD8D1017BD81CC11
SHA256:B73C950CCC87F4C49A9A5AC1B5E28936B07F40CEF46CFAC60C0ED43D15F2D994
2428unionreturns.rtf.exeC:\Users\Public\Documents\admtools.exeexecutable
MD5:86CA40FFE87618AD86BD49E5A9B6DA69
SHA256:9BD3D486E541B5C7E9EEC713B6162FAF97B21C0CF61A56A996F838A6F4F0BE59
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
40
DNS requests
47
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
868
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567854667.14/obedbbhbpmojnkanicioggnmelmoomoc_20230916.567854667.14_all_ENUS500000_lr7434qyx46lykosg2elaepqdi.crx3
unknown
—
—
unknown
868
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567854667.14/obedbbhbpmojnkanicioggnmelmoomoc_20230916.567854667.14_all_ENUS500000_lr7434qyx46lykosg2elaepqdi.crx3
unknown
binary
6.74 Kb
unknown
868
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567854667.14/obedbbhbpmojnkanicioggnmelmoomoc_20230916.567854667.14_all_ENUS500000_lr7434qyx46lykosg2elaepqdi.crx3
unknown
binary
10.0 Kb
unknown
868
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567854667.14/obedbbhbpmojnkanicioggnmelmoomoc_20230916.567854667.14_all_ENUS500000_lr7434qyx46lykosg2elaepqdi.crx3
unknown
binary
9.96 Kb
unknown
868
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567854667.14/obedbbhbpmojnkanicioggnmelmoomoc_20230916.567854667.14_all_ENUS500000_lr7434qyx46lykosg2elaepqdi.crx3
unknown
binary
21.4 Kb
unknown
868
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567854667.14/obedbbhbpmojnkanicioggnmelmoomoc_20230916.567854667.14_all_ENUS500000_lr7434qyx46lykosg2elaepqdi.crx3
unknown
binary
9.87 Kb
unknown
868
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567854667.14/obedbbhbpmojnkanicioggnmelmoomoc_20230916.567854667.14_all_ENUS500000_lr7434qyx46lykosg2elaepqdi.crx3
unknown
text
43.9 Kb
unknown
868
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567854667.14/obedbbhbpmojnkanicioggnmelmoomoc_20230916.567854667.14_all_ENUS500000_lr7434qyx46lykosg2elaepqdi.crx3
unknown
binary
91.0 Kb
unknown
868
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567854667.14/obedbbhbpmojnkanicioggnmelmoomoc_20230916.567854667.14_all_ENUS500000_lr7434qyx46lykosg2elaepqdi.crx3
unknown
binary
183 Kb
unknown
868
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567854667.14/obedbbhbpmojnkanicioggnmelmoomoc_20230916.567854667.14_all_ENUS500000_lr7434qyx46lykosg2elaepqdi.crx3
unknown
binary
366 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2184
admtools.exe
45.84.227.157:50
pex.0x01.cf
Beget LLC
RU
unknown
3452
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
3288
chrome.exe
66.102.1.84:443
accounts.google.com
GOOGLE
US
unknown
3288
chrome.exe
142.250.185.99:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
3288
chrome.exe
142.250.187.100:443
www.google.com
GOOGLE
US
whitelisted
3288
chrome.exe
172.217.16.131:443
update.googleapis.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
pex.0x01.cf
  • 45.84.227.157
unknown
api.peer2profit.com
  • —
unknown
clientservices.googleapis.com
  • 142.250.185.99
whitelisted
accounts.google.com
  • 66.102.1.84
shared
www.google.com
  • 142.250.187.100
whitelisted
update.googleapis.com
  • 172.217.16.131
whitelisted
github.com
  • 140.82.121.4
shared
safebrowsing.googleapis.com
  • 172.217.17.234
whitelisted
github.githubassets.com
  • 185.199.110.154
  • 185.199.109.154
  • 185.199.111.154
  • 185.199.108.154
whitelisted
avatars.githubusercontent.com
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.108.133
  • 185.199.111.133
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO DNS Query for Suspicious .cf Domain
Process
Message
dnSpy.exe
Profiler was prevented from loading notification profiler due to app settings. Process ID (decimal): 3536. Message ID: [0x2509].
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
unionreturns.rtf.exe