File name:

ProcessHacker.exe

Full analysis: https://app.any.run/tasks/6911c03c-2213-467d-b99c-aec62c1bfb32
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: January 12, 2021, 11:54:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

B365AF317AE730A67C936F21432B9C71

SHA1:

A0BDFAC3CE1880B32FF9B696458327CE352E3B1D

SHA256:

BD2C2CF0631D881ED382817AFCCE2B093F4E412FFB170A719E2762F250ABFEA4

SSDEEP:

24576:V7eokafnkAwgcU+29fR4PQviXq1pj3EDT5m+m8I:V6efnkdlUF92PGBOT3m8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WannaCry.EXE (PID: 4056)

    • Application was dropped or rewritten from another process

      • WannaCry.EXE (PID: 4056)
      • taskdl.exe (PID: 2600)
      • WannaCry.EXE (PID: 3108)

    • Writes file to Word startup folder

      • WannaCry.EXE (PID: 4056)

    • Steals credentials from Web Browsers

      • WannaCry.EXE (PID: 4056)

    • Actions looks like stealing of personal data

      • WannaCry.EXE (PID: 4056)

    • Modifies files in Chrome extension folder

      • WannaCry.EXE (PID: 4056)

  • SUSPICIOUS

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 2272)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3740)
      • WannaCry.EXE (PID: 4056)
      • WinRAR.exe (PID: 3340)

    • Uses ICACLS.EXE to modify access control list

      • WannaCry.EXE (PID: 4056)
      • WannaCry.EXE (PID: 3108)

    • Drops a file with too old compile date

      • WannaCry.EXE (PID: 4056)

    • Uses ATTRIB.EXE to modify file attributes

      • WannaCry.EXE (PID: 4056)
      • WannaCry.EXE (PID: 3108)

    • Executes scripts

      • cmd.exe (PID: 888)

    • Creates files like Ransomware instruction

      • WannaCry.EXE (PID: 4056)

    • Starts CMD.EXE for commands execution

      • WannaCry.EXE (PID: 4056)

    • Creates files in the program directory

      • WannaCry.EXE (PID: 4056)

    • Creates files in the user directory

      • WannaCry.EXE (PID: 4056)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 2272)
      • iexplore.exe (PID: 2800)

    • Reads the hosts file

      • chrome.exe (PID: 2000)
      • chrome.exe (PID: 2272)

    • Manual execution by user

      • iexplore.exe (PID: 2800)
      • chrome.exe (PID: 2272)
      • opera.exe (PID: 2536)
      • WinRAR.exe (PID: 3740)
      • WinRAR.exe (PID: 3340)

    • Creates files in the user directory

      • opera.exe (PID: 2536)
      • iexplore.exe (PID: 3400)
      • iexplore.exe (PID: 2800)

    • Changes internet zones settings

      • iexplore.exe (PID: 2800)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3400)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2800)
      • iexplore.exe (PID: 3400)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2800)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2800)

    • Dropped object may contain Bitcoin addresses

      • WannaCry.EXE (PID: 4056)

    • Dropped object may contain URL to Tor Browser

      • WannaCry.EXE (PID: 4056)

    • Dropped object may contain TOR URL's

      • WannaCry.EXE (PID: 4056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2016:03:29 03:34:01+02:00
PEType: PE32+
LinkerVersion: 14
CodeSize: 1048064
InitializedDataSize: 684032
UninitializedDataSize: -
EntryPoint: 0xe2efc
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 2.39.0.124
ProductVersionNumber: 2.39.0.124
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (Australian)
CharacterSet: Unicode
CompanyName: wj32
FileDescription: Process Hacker
FileVersion: 2.39.0.124
InternalName: Process Hacker
LegalCopyright: Licensed under the GNU GPL, v3.
OriginalFileName: ProcessHacker.exe
ProductName: Process Hacker
ProductVersion: 2.39.0.124

Summary

Architecture: IMAGE_FILE_MACHINE_AMD64
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 29-Mar-2016 01:34:01
Detected languages:
  • English - Australia
  • English - United States
Debug artifacts:
  • D:\Projects\processhacker2\bin\Release64\ProcessHacker.pdb
CompanyName: wj32
FileDescription: Process Hacker
FileVersion: 2.39.0.124
InternalName: Process Hacker
LegalCopyright: Licensed under the GNU GPL, v3.
OriginalFilename: ProcessHacker.exe
ProductName: Process Hacker
ProductVersion: 2.39.0.124

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_AMD64
Number of sections: 7
Time date stamp: 29-Mar-2016 01:34:01
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00F0
Characteristics:
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000FFDA0
0x000FFE00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.42959
.rdata
0x00101000
0x000505E6
0x00050600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.32253
.data
0x00152000
0x0000D410
0x00006800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.71141
.pdata
0x00160000
0x0000BC40
0x0000BE00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.10708
.gfids
0x0016C000
0x000000D8
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.18669
.rsrc
0x0016D000
0x0003BCF0
0x0003BE00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.74653
.reloc
0x001A9000
0x00001500
0x00001600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
5.37313

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.21011
1756
UNKNOWN
English - Australia
RT_MANIFEST
2
3.80858
744
UNKNOWN
English - Australia
RT_ICON
3
3.29425
488
UNKNOWN
English - Australia
RT_ICON
4
3.1653
296
UNKNOWN
English - Australia
RT_ICON
5
5.5254
3752
UNKNOWN
English - Australia
RT_ICON
6
6.002
2216
UNKNOWN
English - Australia
RT_ICON
7
5.2012
1736
UNKNOWN
English - Australia
RT_ICON
8
2.89511
1384
UNKNOWN
English - Australia
RT_ICON
9
7.94638
67507
UNKNOWN
English - Australia
RT_ICON
10
5.27113
9640
UNKNOWN
English - Australia
RT_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
KERNEL32.dll
OLEAUT32.dll
SHELL32.dll
USER32.dll
UxTheme.dll
VERSION.dll

Exports

Title
Ordinal
Address
PhAddComboBoxStrings
1
0x000C6050
PhAddElementAvlTree
2
0x000DE640
PhAddEntryHashtable
3
0x000B3690
PhAddEntryHashtableEx
4
0x000B37A0
PhAddItemArray
5
0x000B2D60
PhAddItemList
6
0x000B2FE0
PhAddItemPointerList
7
0x000B3300
PhAddItemSimpleHashtable
8
0x000B3C10
PhAddItemsArray
9
0x000B2DD0
PhAddItemsList
10
0x000B3040
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
117
Monitored processes
68
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start cmd.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs opera.exe iexplore.exe iexplore.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe winrar.exe wannacry.exe icacls.exe no specs attrib.exe no specs taskdl.exe no specs cmd.exe no specs cscript.exe no specs wannacry.exe no specs attrib.exe no specs icacls.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
336"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=980,13916526846307518755,16756248440495286108,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14319062731493036619 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
404"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=980,13916526846307518755,16756248440495286108,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12580758561575634480 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
556"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=980,13916526846307518755,16756248440495286108,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=15256367987506743427 --mojo-platform-channel-handle=3896 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
572attrib +h .C:\Windows\system32\attrib.exe—WannaCry.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
716"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=980,13916526846307518755,16756248440495286108,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=15892452772609616946 --mojo-platform-channel-handle=4312 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
800"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=980,13916526846307518755,16756248440495286108,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=4877934900706932801 --mojo-platform-channel-handle=4340 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
888cmd /c 61261610452773.batC:\Windows\system32\cmd.exe—WannaCry.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
1416"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=980,13916526846307518755,16756248440495286108,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4443276151501215857 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1540"C:\Windows\System32\cmd.exe" C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1592"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=980,13916526846307518755,16756248440495286108,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5613102144359933237 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
3 109
Read events
2 804
Write events
296
Delete events
9

Modification events

(PID) Process:(2272) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2272) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2272) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2272) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2272) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2272) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2272) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2272) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3252-13245750958665039
Value:
0
(PID) Process:(2272) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2272) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:2272-13254926096256500
Value:
259
Executable files
10
Suspicious files
480
Text files
430
Unknown types
48

Dropped files

PID
Process
Filename
Type
2272chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FFD8E11-8E0.pma —
MD5:—
SHA256:—
2272chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old —
MD5:—
SHA256:—
2272chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\9bb30b3d-a58e-4d62-8676-f4fe2775141d.tmp —
MD5:—
SHA256:—
2272chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp —
MD5:—
SHA256:—
2272chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
2272chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF12a1e5.TMPtext
MD5:—
SHA256:—
2272chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
2272chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:—
SHA256:—
2272chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
2272chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF12a4c4.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
126
DNS requests
79
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3400
iexplore.exe
GET
304
151.139.128.14:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEBdaw5Ggy6goGioIpxPZ8w0%3D
US
—
—
whitelisted
2000
chrome.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D
US
der
471 b
whitelisted
3400
iexplore.exe
GET
200
2.16.107.89:80
http://crl.identrust.com/DSTROOTCAX3CRL.crl
unknown
der
1.16 Kb
whitelisted
3400
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
3400
iexplore.exe
GET
200
2.16.107.89:80
http://crl.identrust.com/DSTROOTCAX3CRL.crl
unknown
der
1.16 Kb
whitelisted
2536
opera.exe
GET
200
172.217.18.110:80
http://clients1.google.com/complete/search?q=abo&client=opera-suggest-omnibox&hl=de
US
text
141 b
whitelisted
3400
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
2000
chrome.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEAqN7HPiQ2%2F4c3rdXE3uHG8%3D
US
der
471 b
whitelisted
3400
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
2800
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2000
chrome.exe
172.217.22.99:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2000
chrome.exe
172.217.22.77:443
accounts.google.com
Google Inc.
US
whitelisted
2000
chrome.exe
172.217.23.99:443
www.google.com.ua
Google Inc.
US
whitelisted
2000
chrome.exe
172.217.16.170:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2000
chrome.exe
216.58.212.163:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2000
chrome.exe
216.58.212.142:443
apis.google.com
Google Inc.
US
whitelisted
2000
chrome.exe
172.217.22.3:443
www.gstatic.com
Google Inc.
US
whitelisted
2000
chrome.exe
172.217.18.110:443
ogs.google.com.ua
Google Inc.
US
whitelisted
2000
chrome.exe
216.58.208.36:443
www.google.com
Google Inc.
US
whitelisted
2000
chrome.exe
216.58.210.14:443
encrypted-tbn0.gstatic.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 172.217.22.99
whitelisted
accounts.google.com
  • 172.217.22.77
  • 216.58.207.77
shared
www.google.com.ua
  • 172.217.23.99
whitelisted
fonts.googleapis.com
  • 172.217.16.170
whitelisted
www.gstatic.com
  • 172.217.22.3
whitelisted
fonts.gstatic.com
  • 216.58.212.163
  • 216.58.207.35
whitelisted
apis.google.com
  • 216.58.212.142
whitelisted
ogs.google.com.ua
  • 172.217.18.110
whitelisted
www.google.com
  • 216.58.208.36
malicious
encrypted-tbn0.gstatic.com
  • 216.58.210.14
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO TLS Handshake Failure
—
—
Potentially Bad Traffic
ET INFO TLS Handshake Failure
—
—
Potentially Bad Traffic
ET INFO TLS Handshake Failure
—
—
Potentially Bad Traffic
ET INFO TLS Handshake Failure
—
—
Potentially Bad Traffic
ET INFO TLS Handshake Failure
—
—
Potentially Bad Traffic
ET INFO TLS Handshake Failure
—
—
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ProcessHacker.exe