analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

7Clicker (1).jar

Full analysis: https://app.any.run/tasks/62b0d2ae-1b1b-4092-bc94-490d7013c565
Verdict: Malicious activity
Analysis date: January 25, 2022, 02:46:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/java-archive
File info: Java archive data (JAR)
MD5:

8FD172F85EE2111BB2C796F255DFCA77

SHA1:

E9DBBE9A7AC5D9829F62597469F4053B01721DCE

SHA256:

DD21FB853285D3CE6738A32E82B1727DED2CC569883F0E85A407EF4E1C15C40B

SSDEEP:

6144:7nhVBkJYJjEJ7WtPbnxG1Rh/dCwfmb/Oy+z0ph7u0c+nQXLWnFYmDG7i5m6JeCh1:7hpsEPGl0SIkz2hS0vnQticaeCh1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • javaw.exe (PID: 2256)

    • Loads the Task Scheduler COM API

      • rundll32.exe (PID: 4016)

    • Changes internet zones settings

      • ie4uinit.exe (PID: 3976)

    • Changes the autorun value in the registry

      • unregmp2.exe (PID: 392)
      • reg.exe (PID: 3948)
      • sidebar.exe (PID: 3892)

    • Writes to a start menu file

      • regsvr32.exe (PID: 2512)

    • Changes the Startup folder

      • regsvr32.exe (PID: 2512)

    • Steals credentials from Web Browsers

      • pingsender.exe (PID: 3248)
      • pingsender.exe (PID: 2644)
      • pingsender.exe (PID: 3192)

    • Actions looks like stealing of personal data

      • pingsender.exe (PID: 3248)
      • pingsender.exe (PID: 2644)
      • pingsender.exe (PID: 3192)

  • SUSPICIOUS

    • Checks supported languages

      • javaw.exe (PID: 2256)
      • chrmstp.exe (PID: 2684)
      • chrmstp.exe (PID: 3340)
      • jusched.exe (PID: 3056)
      • IMEKLMG.EXE (PID: 3220)
      • IMEKLMG.EXE (PID: 3692)
      • imkrmig.exe (PID: 3280)
      • pingsender.exe (PID: 2644)
      • pingsender.exe (PID: 3248)
      • pingsender.exe (PID: 3192)
      • Skype.exe (PID: 2560)
      • Skype.exe (PID: 3580)
      • Skype.exe (PID: 3952)
      • Skype.exe (PID: 3340)
      • Skype.exe (PID: 1096)
      • Skype.exe (PID: 1740)
      • Skype.exe (PID: 1888)
      • sidebar.exe (PID: 3892)

    • Reads the computer name

      • javaw.exe (PID: 2256)
      • chrmstp.exe (PID: 2684)
      • IMEKLMG.EXE (PID: 3692)
      • IMEKLMG.EXE (PID: 3220)
      • pingsender.exe (PID: 3248)
      • pingsender.exe (PID: 2644)
      • pingsender.exe (PID: 3192)
      • Skype.exe (PID: 3580)
      • Skype.exe (PID: 2560)
      • Skype.exe (PID: 1888)
      • Skype.exe (PID: 1740)
      • Skype.exe (PID: 3952)
      • Skype.exe (PID: 3340)
      • Skype.exe (PID: 1096)
      • sidebar.exe (PID: 3892)

    • Executable content was dropped or overwritten

      • javaw.exe (PID: 2256)

    • Creates files in the program directory

      • javaw.exe (PID: 2256)
      • ie4uinit.exe (PID: 3976)
      • chrmstp.exe (PID: 2684)

    • Drops a file that was compiled in debug mode

      • javaw.exe (PID: 2256)

    • Uses ICACLS.EXE to modify access control list

      • javaw.exe (PID: 2256)

    • Executed via Task Scheduler

      • sipnotify.exe (PID: 2300)

    • Executed as Windows Service

      • taskhost.exe (PID: 2224)
      • EOSNotify.exe (PID: 3220)

    • Application launched itself

      • ie4uinit.exe (PID: 3976)
      • rundll32.exe (PID: 4016)
      • chrmstp.exe (PID: 2684)
      • Skype.exe (PID: 3580)
      • Skype.exe (PID: 3952)

    • Reads internet explorer settings

      • ie4uinit.exe (PID: 3976)
      • sidebar.exe (PID: 3892)

    • Uses RUNDLL32.EXE to load library

      • ie4uinit.exe (PID: 3976)
      • rundll32.exe (PID: 4016)

    • Reads Microsoft Outlook installation path

      • ie4uinit.exe (PID: 3976)
      • sidebar.exe (PID: 3892)

    • Reads Environment values

      • unregmp2.exe (PID: 392)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • ie4uinit.exe (PID: 3976)
      • unregmp2.exe (PID: 392)
      • regsvr32.exe (PID: 2512)

    • Changes default file association

      • unregmp2.exe (PID: 392)
      • Skype.exe (PID: 3580)

    • Reads the date of Windows installation

      • chrmstp.exe (PID: 2684)

    • Creates files in the Windows directory

      • chrmstp.exe (PID: 3340)

    • Check for Java to be installed

      • jusched.exe (PID: 3056)

    • Loads DLL from Mozilla Firefox

      • pingsender.exe (PID: 2644)
      • pingsender.exe (PID: 3248)
      • pingsender.exe (PID: 3192)

    • Reads CPU info

      • Skype.exe (PID: 3580)

    • Uses REG.EXE to modify Windows registry

      • Skype.exe (PID: 3580)

  • INFO

    • Checks supported languages

      • icacls.exe (PID: 1936)
      • chrome.exe (PID: 3228)
      • chrome.exe (PID: 1088)
      • chrome.exe (PID: 2812)
      • chrome.exe (PID: 2368)
      • chrome.exe (PID: 2236)
      • chrome.exe (PID: 4060)
      • chrome.exe (PID: 3424)
      • chrome.exe (PID: 3128)
      • chrome.exe (PID: 1200)
      • chrome.exe (PID: 2816)
      • chrome.exe (PID: 4036)
      • chrome.exe (PID: 3916)
      • chrome.exe (PID: 3064)
      • chrome.exe (PID: 684)
      • chrome.exe (PID: 3424)
      • chrome.exe (PID: 1248)
      • firefox.exe (PID: 2852)
      • firefox.exe (PID: 1284)
      • firefox.exe (PID: 3792)
      • firefox.exe (PID: 1044)
      • firefox.exe (PID: 2520)
      • firefox.exe (PID: 3476)
      • firefox.exe (PID: 188)
      • ie4uinit.exe (PID: 3976)
      • sipnotify.exe (PID: 2300)
      • taskhost.exe (PID: 2224)
      • rundll32.exe (PID: 3648)
      • rundll32.exe (PID: 4016)
      • RunDll32.exe (PID: 3556)
      • RunDll32.exe (PID: 2368)
      • ie4uinit.exe (PID: 3732)
      • ie4uinit.exe (PID: 3576)
      • unregmp2.exe (PID: 392)
      • ie4uinit.exe (PID: 520)
      • regsvr32.exe (PID: 2512)
      • firefox.exe (PID: 2232)
      • firefox.exe (PID: 2320)
      • firefox.exe (PID: 2300)
      • firefox.exe (PID: 3380)
      • firefox.exe (PID: 4036)
      • firefox.exe (PID: 628)
      • EOSNotify.exe (PID: 3220)
      • firefox.exe (PID: 1888)
      • firefox.exe (PID: 3780)
      • explorer.exe (PID: 3128)
      • reg.exe (PID: 3948)
      • reg.exe (PID: 1472)
      • firefox.exe (PID: 4008)
      • firefox.exe (PID: 1992)
      • firefox.exe (PID: 1272)
      • firefox.exe (PID: 2504)
      • firefox.exe (PID: 3008)
      • firefox.exe (PID: 4060)
      • firefox.exe (PID: 1828)

    • Reads the computer name

      • icacls.exe (PID: 1936)
      • chrome.exe (PID: 3228)
      • chrome.exe (PID: 2368)
      • chrome.exe (PID: 2236)
      • chrome.exe (PID: 1200)
      • chrome.exe (PID: 3128)
      • firefox.exe (PID: 2852)
      • firefox.exe (PID: 2520)
      • firefox.exe (PID: 1284)
      • firefox.exe (PID: 3792)
      • firefox.exe (PID: 3476)
      • firefox.exe (PID: 188)
      • sipnotify.exe (PID: 2300)
      • taskhost.exe (PID: 2224)
      • ie4uinit.exe (PID: 3976)
      • rundll32.exe (PID: 3648)
      • rundll32.exe (PID: 4016)
      • RunDll32.exe (PID: 3556)
      • RunDll32.exe (PID: 2368)
      • regsvr32.exe (PID: 2512)
      • unregmp2.exe (PID: 392)
      • ie4uinit.exe (PID: 3732)
      • firefox.exe (PID: 3380)
      • firefox.exe (PID: 628)
      • firefox.exe (PID: 2300)
      • firefox.exe (PID: 2320)
      • firefox.exe (PID: 4036)
      • firefox.exe (PID: 1888)
      • firefox.exe (PID: 3780)
      • EOSNotify.exe (PID: 3220)
      • explorer.exe (PID: 3128)
      • firefox.exe (PID: 3008)
      • firefox.exe (PID: 1992)
      • firefox.exe (PID: 1272)
      • firefox.exe (PID: 2504)
      • firefox.exe (PID: 1828)
      • firefox.exe (PID: 4060)

    • Manual execution by user

      • chrome.exe (PID: 3228)
      • firefox.exe (PID: 1044)
      • ie4uinit.exe (PID: 3976)
      • unregmp2.exe (PID: 392)
      • regsvr32.exe (PID: 2512)
      • ie4uinit.exe (PID: 520)
      • ie4uinit.exe (PID: 3576)
      • chrmstp.exe (PID: 2684)
      • IMEKLMG.EXE (PID: 3220)
      • IMEKLMG.EXE (PID: 3692)
      • jusched.exe (PID: 3056)
      • firefox.exe (PID: 2232)
      • explorer.exe (PID: 3128)
      • Skype.exe (PID: 3580)
      • sidebar.exe (PID: 3892)
      • firefox.exe (PID: 4008)

    • Reads the hosts file

      • chrome.exe (PID: 3228)
      • chrome.exe (PID: 2236)
      • Skype.exe (PID: 3580)

    • Application launched itself

      • chrome.exe (PID: 3228)
      • firefox.exe (PID: 1044)
      • firefox.exe (PID: 2852)
      • firefox.exe (PID: 2300)
      • firefox.exe (PID: 2232)
      • firefox.exe (PID: 3008)
      • firefox.exe (PID: 4008)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2236)
      • pingsender.exe (PID: 3248)
      • pingsender.exe (PID: 2644)
      • pingsender.exe (PID: 3192)
      • Skype.exe (PID: 3580)

    • Reads CPU info

      • firefox.exe (PID: 2852)
      • firefox.exe (PID: 2300)
      • firefox.exe (PID: 3008)

    • Creates files in the program directory

      • firefox.exe (PID: 2852)
      • firefox.exe (PID: 2300)
      • firefox.exe (PID: 3008)

    • Creates files in the user directory

      • firefox.exe (PID: 2852)

    • Reads the date of Windows installation

      • firefox.exe (PID: 2852)
      • firefox.exe (PID: 2300)

    • Checks Windows Trust Settings

      • pingsender.exe (PID: 2644)
      • pingsender.exe (PID: 3248)
      • pingsender.exe (PID: 3192)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2016:02:28 13:45:26
ZipCRC: 0xa651ba9f
ZipCompressedSize: 156
ZipUncompressedSize: 218
ZipFileName: META-INF/MANIFEST.MF
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
73
Malicious processes
4
Suspicious processes
6

Behavior graph

Click at the process to see the details
start javaw.exe icacls.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs taskhost.exe no specs sipnotify.exe ie4uinit.exe no specs ie4uinit.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs ie4uinit.exe no specs unregmp2.exe ie4uinit.exe no specs regsvr32.exe chrmstp.exe no specs chrmstp.exe no specs imeklmg.exe no specs imeklmg.exe no specs imkrmig.exe no specs jusched.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs eosnotify.exe no specs firefox.exe no specs firefox.exe no specs pingsender.exe pingsender.exe pingsender.exe explorer.exe no specs skype.exe skype.exe no specs reg.exe skype.exe no specs reg.exe no specs skype.exe no specs skype.exe no specs skype.exe no specs skype.exe no specs sidebar.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2256"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\7Clicker (1).jar.zip"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe
Explorer.EXE
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1936C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\system32\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
3228"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
2812"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6de1d988,0x6de1d998,0x6de1d9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
2368"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1052,222303760808231005,13077140600850888874,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1072 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\lpk.dll
2236"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1052,222303760808231005,13077140600850888874,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1416 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\chrome.exe
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
3424"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,222303760808231005,13077140600850888874,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
1088"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,222303760808231005,13077140600850888874,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1920 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
4060"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,222303760808231005,13077140600850888874,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
1200"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1052,222303760808231005,13077140600850888874,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2800 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
54 252
Read events
52 767
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
273
Text files
236
Unknown types
103

Dropped files

PID
Process
Filename
Type
3228chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61EF649A-C9C.pma —
MD5:—
SHA256:—
2256javaw.exeC:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8061.timestamptext
MD5:2FD3538642772A6C425C3579002D7565
SHA256:5439DE71A677EB320AB75D2049B102434BA01DC115DE4FE876C74B77892174D9
3228chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:5BD3C311F2136A7A88D3E197E55CF902
SHA256:FA331915E1797E59979A3E4BCC2BD0D3DEAA039B94D4DB992BE251FD02A224B9
3228chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:8FF312A95D60ED89857FEB720D80D4E1
SHA256:946A57FAFDD28C3164D5AB8AB4971B21BD5EC5BFFF7554DBF832CB58CC37700B
3228chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old~RF14129c.TMPtext
MD5:B628564B8042F6E2CC2F53710AAECDC0
SHA256:1D3B022BDEE9F48D79E3EC1E93F519036003642D3D72D10B05CFD47F43EFBF13
2812chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pmabinary
MD5:03C4F648043A88675A920425D824E1B3
SHA256:F91DBB7C64B4582F529C968C480D2DCE1C8727390482F31E4355A27BB3D9B450
3228chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC
SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731
3228chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old~RF1412ac.TMPtext
MD5:109A25C32EE1132ECD6D9F3ED9ADF01A
SHA256:DA6028DB9485C65E683643658326F02B1D0A1566DE14914EF28E5248EB94F0DD
2256javaw.exeC:\Users\admin\AppData\Local\Temp\JNativeHook-FCBC1DC5993F3B7C153159E29CD4364927BC9517.dllexecutable
MD5:B4CE035F926531D6B4DFA8477C6477E4
SHA256:F6FFEAD3B5F3DB5A7A00D1FEF874C3D3ED7ECF095DA2D981EBD691FDFA685716
2256javaw.exeC:\Users\admin\AppData\Local\Temp\jar_cache8459907258375472171.tmpjava
MD5:105B2B56BF43F91BAD6715211A407F6E
SHA256:D5F84AE5BC8B335C5A85D47EDC839425FF183C61F7A75AF60B39D762B807BE32
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
267
TCP/UDP connections
179
DNS requests
157
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2236
chrome.exe
GET
404
50.87.195.134:80
http://krunker.com/
US
xml
341 b
malicious
2852
firefox.exe
GET
404
34.107.221.82:80
http://detectportal.firefox.com/success.txt
US
xml
341 b
whitelisted
2852
firefox.exe
GET
404
34.107.221.82:80
http://detectportal.firefox.com/success.txt
US
xml
341 b
whitelisted
2236
chrome.exe
GET
404
142.250.179.163:80
http://www.gstatic.com/generate_204
US
xml
341 b
whitelisted
2852
firefox.exe
GET
404
34.107.221.82:80
http://detectportal.firefox.com/success.txt
US
xml
341 b
whitelisted
2236
chrome.exe
GET
404
142.250.179.163:80
http://www.gstatic.com/generate_204
US
xml
341 b
whitelisted
2852
firefox.exe
GET
404
34.107.221.82:80
http://detectportal.firefox.com/success.txt
US
xml
341 b
whitelisted
2236
chrome.exe
GET
404
66.254.114.41:80
http://pornhub.com/
US
xml
341 b
whitelisted
2852
firefox.exe
GET
404
34.107.221.82:80
http://detectportal.firefox.com/success.txt
US
xml
341 b
whitelisted
2852
firefox.exe
GET
404
34.107.221.82:80
http://detectportal.firefox.com/success.txt
US
xml
341 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2236
chrome.exe
142.250.179.142:443
clients2.google.com
Google Inc.
US
whitelisted
2236
chrome.exe
142.250.186.68:443
www.google.com
Google Inc.
US
whitelisted
—
—
142.250.186.68:443
www.google.com
Google Inc.
US
whitelisted
2236
chrome.exe
142.250.186.77:443
accounts.google.com
Google Inc.
US
suspicious
—
—
142.251.39.99:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2236
chrome.exe
142.250.179.163:80
www.gstatic.com
Google Inc.
US
whitelisted
2236
chrome.exe
142.250.186.35:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2236
chrome.exe
50.87.195.134:80
krunker.com
Unified Layer
US
malicious
2236
chrome.exe
142.250.185.138:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
2852
firefox.exe
143.204.98.29:443
firefox.settings.services.mozilla.com
—
US
malicious

DNS requests

Domain
IP
Reputation
clients2.google.com
  • 142.250.179.142
whitelisted
www.google.com
  • 142.250.186.68
  • 2a00:1450:4001:829::2004
whitelisted
accounts.google.com
  • 142.250.186.77
shared
clientservices.googleapis.com
  • 142.251.39.99
whitelisted
update.googleapis.com
  • 142.251.39.99
whitelisted
krunker.com
  • 50.87.195.134
unknown
ssl.gstatic.com
  • 142.250.186.35
whitelisted
www.gstatic.com
  • 142.250.179.163
whitelisted
support.google.com
  • 142.250.179.142
whitelisted
pornhub.com
  • 66.254.114.41
whitelisted

Threats

PID
Process
Class
Message
2852
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2852
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2852
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2852
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2852
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2852
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2852
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2852
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2852
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2852
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
39 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
7Clicker (1).jar