File name:

terminal.zip

Full analysis: https://app.any.run/tasks/50d2d656-07ad-4472-b415-57f2d347f8d1
Verdict: Malicious activity
Analysis date: February 20, 2024, 03:12:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

5B50185E53E0C706FBBCF98E2F734A75

SHA1:

81C271D3AE117DD81DC787F18F554BB99D754E04

SHA256:

BCB91D20C5EDAF44666F637C7D1BFE7583E161F89C239DF52AC143DB32BDB272

SSDEEP:

196608:NUujBHPWw6OVq4uLbgMii+6cDoSJbbgAChuF4L:NUupBxuLpii+66oa/gtsG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3700)
      • terminal.exe (PID: 3772)

  • SUSPICIOUS

    • Reads the Internet Settings

      • terminal.exe (PID: 3772)

    • Executable content was dropped or overwritten

      • terminal.exe (PID: 3772)

    • Reads settings of System Certificates

      • terminal.exe (PID: 3772)

    • Connects to unusual port

      • terminal.exe (PID: 3772)

    • Reads the BIOS version

      • terminal.exe (PID: 3772)

    • Changes Internet Explorer settings (feature browser emulation)

      • terminal.exe (PID: 3772)

  • INFO

    • Checks supported languages

      • terminal.exe (PID: 3772)

    • Checks proxy server information

      • terminal.exe (PID: 3772)

    • Manual execution by a user

      • terminal.exe (PID: 3772)
      • explorer.exe (PID: 2364)
      • chrome.exe (PID: 2900)
      • rundll32.exe (PID: 2372)
      • explorer.exe (PID: 2292)

    • Process checks whether UAC notifications are on

      • terminal.exe (PID: 3772)

    • Creates files or folders in the user directory

      • terminal.exe (PID: 3772)

    • Reads Windows Product ID

      • terminal.exe (PID: 3772)

    • Creates files in the program directory

      • terminal.exe (PID: 3772)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3700)

    • Reads Environment values

      • terminal.exe (PID: 3772)

    • Reads CPU info

      • terminal.exe (PID: 3772)

    • Reads the machine GUID from the registry

      • terminal.exe (PID: 3772)

    • Drops the executable file immediately after the start

      • chrome.exe (PID: 2900)

    • Application launched itself

      • chrome.exe (PID: 2900)

    • Reads the software policy settings

      • terminal.exe (PID: 3772)

    • Reads product name

      • terminal.exe (PID: 3772)

    • Reads the computer name

      • terminal.exe (PID: 3772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:02:19 22:10:18
ZipCRC: 0x4098b13c
ZipCompressedSize: 14673037
ZipUncompressedSize: 29016072
ZipFileName: terminal.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
23
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe terminal.exe explorer.exe no specs explorer.exe no specs rundll32.exe no specs chrome.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
584"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4044 --field-trial-handle=1096,i,12311406627277390696,11002565652947056953,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1408"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1912 --field-trial-handle=1096,i,12311406627277390696,11002565652947056953,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1504"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3916 --field-trial-handle=1096,i,12311406627277390696,11002565652947056953,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1596"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2124 --field-trial-handle=1096,i,12311406627277390696,11002565652947056953,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1848"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=1384 --field-trial-handle=1096,i,12311406627277390696,11002565652947056953,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1956"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3412 --field-trial-handle=1096,i,12311406627277390696,11002565652947056953,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2068"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1448 --field-trial-handle=1096,i,12311406627277390696,11002565652947056953,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2292"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2364"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2372"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Roaming\MetaQuotes\Terminal\D98BE5D03C29E37AE3CCFD40F9D53433\MQL4\Scripts\Examples\DLL\Libraries\DLLSample.dllC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
Total events
26 274
Read events
26 188
Write events
85
Delete events
1

Modification events

(PID) Process:(3700) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3700) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3700) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3700) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3700) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3700) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3700) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\terminal.zip
(PID) Process:(3700) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3700) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3700) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
3
Suspicious files
78
Text files
208
Unknown types
86

Dropped files

PID
Process
Filename
Type
3772terminal.exeC:\Users\admin\AppData\Roaming\MetaQuotes\Terminal\D98BE5D03C29E37AE3CCFD40F9D53433\mql4.zipcompressed
MD5:A8BDA911BE7DA42B5FBC7051831F1EF2
SHA256:11CB7CD66AD01433F3AA8CF5B205189B37664A3BE1A463065004B042262C0D61
3772terminal.exeC:\Users\admin\AppData\Roaming\MetaQuotes\Terminal\D98BE5D03C29E37AE3CCFD40F9D53433\templates\StrategyTester.htmhtml
MD5:14EABFE565F4093C112ACA11E4AF3B9C
SHA256:BC11A2EA23005E246D554B458C35B8BBD9C1853B5CE92AFA29D20D843CB0AEAC
3772terminal.exeC:\Users\admin\AppData\Roaming\MetaQuotes\Terminal\D98BE5D03C29E37AE3CCFD40F9D53433\MQL4\Include\Arrays\Array.mqhtext
MD5:D8CD709D6263676AED5398D602EBEB19
SHA256:E0A9C33C7F48E8F3568493A6A5C0F73CFC0CA67F244C98DB537197E33EF353F4
3772terminal.exeC:\Users\admin\AppData\Roaming\MetaQuotes\Terminal\D98BE5D03C29E37AE3CCFD40F9D53433\MQL4\Include\Arrays\ArrayInt.mqhtext
MD5:B9A328A4E38A5152B93FE25C64C1DFBC
SHA256:7BB3A442630411746D43D4EC0DF18B1B2B3D56965CF29876228375E391997DEA
3772terminal.exeC:\Users\admin\AppData\Roaming\MetaQuotes\Terminal\D98BE5D03C29E37AE3CCFD40F9D53433\templates\OptimizationReport.htmhtml
MD5:6EC497DC13E18BE3E4FE4F68B5293AEB
SHA256:2ED4AF3129FB1479732BE1AC2DB94ADC89C0CAAE1FC366884FB63240C8D8268A
3772terminal.exeC:\Users\admin\AppData\Roaming\MetaQuotes\Terminal\D98BE5D03C29E37AE3CCFD40F9D53433\templates\StatementDetailed.htmhtml
MD5:09FF68F2AFEB196762058FBD5819CFA1
SHA256:3F282E502A316466F2614191EE3DE7432E8328CDD49ED1AB63315EE88EEE4699
3772terminal.exeC:\Users\admin\AppData\Roaming\MetaQuotes\Terminal\D98BE5D03C29E37AE3CCFD40F9D53433\config\terminal.initext
MD5:9F8A94E170DAAC4481BCED95A016FFDF
SHA256:0085F8B127E6D8E9D07DAB1B61602F3F64540AFCE1E2B20E9F041F2D6154BC95
3772terminal.exeC:\Users\admin\AppData\Roaming\MetaQuotes\Terminal\D98BE5D03C29E37AE3CCFD40F9D53433\MQL4\Experts\MACD Sample.mq4text
MD5:76336FF9B38FBEBBFBAEFF0B2DE320FC
SHA256:4B9B0837BE9A580444A15513E02DBBFC4E3FBA7321133AEFE5CFB1CC7C34FD5F
3772terminal.exeC:\Users\admin\AppData\Roaming\MetaQuotes\Terminal\D98BE5D03C29E37AE3CCFD40F9D53433\MQL4\Include\Arrays\ArrayChar.mqhtext
MD5:A6D32CEDC7FD7E24D82F36039A1220AC
SHA256:595C4CB02C29CE99495ABB37E1BC93CB9384B05CE1A089A3ADE7E90090C27AF5
3772terminal.exeC:\Users\admin\AppData\Roaming\MetaQuotes\Terminal\D98BE5D03C29E37AE3CCFD40F9D53433\MQL4\Include\Arrays\ArrayObj.mqhtext
MD5:F8D64B176F2D22607BA4B0F86702EB66
SHA256:A56CF708CAEFBB655A3275DAEAC312121AED8EA1C21811B079458433C70CCE28
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
124
DNS requests
50
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
856
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
unknown
—
—
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
unknown
binary
5.98 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
unknown
binary
10.2 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
unknown
binary
10.1 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
unknown
binary
19.9 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
unknown
binary
9.96 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
unknown
binary
44.1 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
unknown
binary
89.0 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
unknown
binary
176 Kb
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
unknown
binary
351 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3772
terminal.exe
195.201.80.82:443
download.mql5.com
Hetzner Online GmbH
DE
unknown
3772
terminal.exe
78.140.180.54:443
updates.metaquotes.net
Webzilla B.V.
NL
unknown
3772
terminal.exe
52.78.60.193:443
—
AMAZON-02
KR
unknown
3772
terminal.exe
38.76.16.43:443
—
Beeks Financial Cloud Ltd
US
unknown
3772
terminal.exe
192.229.22.192:443
—
LCPRODASN
US
unknown
3772
terminal.exe
119.23.154.38:443
—
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
3772
terminal.exe
170.75.202.205:1950
—
Beeks Financial Cloud Ltd
US
unknown

DNS requests

Domain
IP
Reputation
download.mql5.com
  • 195.201.80.82
  • 78.140.180.43
whitelisted
updates.metaquotes.net
  • 78.140.180.54
unknown
api1.mql5.net
  • 78.140.180.43
unknown
content.finteza.com
  • 78.140.180.86
unknown
api2.mql5.net
  • 117.20.41.198
unknown
api3.mql5.net
  • 148.113.1.241
unknown
api4.mql5.net
  • 88.212.232.132
unknown
api5.mql5.net
  • 104.166.145.86
unknown
download.metatrader.com
  • 78.140.180.43
  • 195.201.80.82
unknown
api6.mql5.net
  • 156.38.206.18
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
terminal.zip