URL:

https://vtsamples.commondatastorage.googleapis.com/7a6ceb6ace388bfb6c1698a723df98ec107e7043e955d64b03fba81cb65627db?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1690225636&Signature=dJywbNr3dJzVEzT6nIe91Lo7btBRsqqdaEqPOiala5wyCtFA%2F6OIfUJ202LRpaRfnsJvphpONFnw%0AExLTG2uB260PEpLWItZPFOSl5mO3KBzQqaNu%2BUVHQEOeQgFpqcVtlzfeR5mb5ZnMFVEJUJs3F%2Fba%0A%2FaJhjIU7bMAvNnsLwv19PBrboSWLr0dABoXQ%2BukTGqmj5NFcGWIMIQCPrJ%2BhtiEX26SRIUbgu%2BqA%0AXuvQ2Bk4Q1EJjmaOYosjopDeJXOzmYxS9ov0By1h3WgmZ72jCIai4VGRrlWxvUFS3YA%2FORfaz%2BGN%0AErra1z8e%2Brp%2BHoTSxzzoAdJ5pqSlONgHC%2Bc33Q%3D%3D&response-content-disposition=attachment%3B%20filename%3D%227a6ceb6ace388bfb6c1698a723df98ec107e7043e955d64b03fba81cb65627db%22&response-content-type=application%2Foctet-stream;

Full analysis: https://app.any.run/tasks/5cb9cdb1-d79c-480a-8d8c-c1938156b167
Verdict: Malicious activity
Threats:

DarkComet RAT is a malicious program designed to remotely control or administer a victim's computer, steal private data and spy on the victim.

Malware Trends Tracker     >>>
Analysis date: July 24, 2023, 18:31:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
nanocore
darkcomet
Indicators:
MD5:

2CCB7277D40C165F73BB96965D6AC2F7

SHA1:

C5EFB97D6A871D071D68F08FD8038FBFC7DEE5F3

SHA256:

DDB053A8AEB979B03FEF0C0D5F8C192CEDB660432AEE143080005FD2F9DCEBB4

SSDEEP:

24:2h2Rx1pKlwIXprxOSzsemlXdiAj7LyiOSUy1ixAIe:vETSyekAj7Ly7G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Order Reqest Details 2023 Jbc.exe (PID: 2716)
      • Order Reqest Details 2023 Jbc.exe (PID: 600)
      • Order Reqest Details 2023 Jbc.exe (PID: 3488)
      • NEW STUB.EXE (PID: 1480)
      • msdcsc.exe (PID: 2424)
      • Order Reqest Details 2023 Jbc.exe (PID: 2948)
      • NEW STUB.EXE (PID: 3236)
      • msdcsc.exe (PID: 1836)

    • Changes the login/logoff helper path in the registry

      • Order Reqest Details 2023 Jbc.exe (PID: 3488)

    • Uses Task Scheduler to run other applications

      • Order Reqest Details 2023 Jbc.exe (PID: 2716)
      • Order Reqest Details 2023 Jbc.exe (PID: 600)
      • msdcsc.exe (PID: 2424)

    • NANOCORE detected by memory dumps

      • NEW STUB.EXE (PID: 1480)
      • Order Reqest Details 2023 Jbc.exe (PID: 2948)

    • Adds path to the Windows Defender exclusion list

      • Order Reqest Details 2023 Jbc.exe (PID: 600)

    • Changes the autorun value in the registry

      • Order Reqest Details 2023 Jbc.exe (PID: 2948)

    • Creates or modifies Windows services

      • Order Reqest Details 2023 Jbc.exe (PID: 2948)

    • DARKCOMET detected by memory dumps

      • Order Reqest Details 2023 Jbc.exe (PID: 2948)

    • Changes Security Center notification settings

      • msdcsc.exe (PID: 1836)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Order Reqest Details 2023 Jbc.exe (PID: 2716)
      • Order Reqest Details 2023 Jbc.exe (PID: 3488)
      • NEW STUB.EXE (PID: 1480)

    • Reads the Internet Settings

      • Order Reqest Details 2023 Jbc.exe (PID: 2716)
      • Order Reqest Details 2023 Jbc.exe (PID: 3488)
      • Order Reqest Details 2023 Jbc.exe (PID: 600)
      • Order Reqest Details 2023 Jbc.exe (PID: 2948)
      • msdcsc.exe (PID: 2424)

    • Application launched itself

      • Order Reqest Details 2023 Jbc.exe (PID: 2716)
      • Order Reqest Details 2023 Jbc.exe (PID: 600)
      • msdcsc.exe (PID: 2424)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 2920)
      • cmd.exe (PID: 2872)

    • Starts CMD.EXE for commands execution

      • Order Reqest Details 2023 Jbc.exe (PID: 3488)

    • Starts itself from another location

      • Order Reqest Details 2023 Jbc.exe (PID: 3488)

    • Start notepad (likely ransomware note)

      • Order Reqest Details 2023 Jbc.exe (PID: 3488)
      • Order Reqest Details 2023 Jbc.exe (PID: 2948)

    • Starts POWERSHELL.EXE for commands execution

      • Order Reqest Details 2023 Jbc.exe (PID: 600)

    • Connects to unusual port

      • NEW STUB.EXE (PID: 1480)
      • Order Reqest Details 2023 Jbc.exe (PID: 2948)

    • Script adds exclusion path to Windows Defender

      • Order Reqest Details 2023 Jbc.exe (PID: 600)

  • INFO

    • The process checks LSA protection

      • notepad++.exe (PID: 3972)
      • notepad++.exe (PID: 1616)
      • Order Reqest Details 2023 Jbc.exe (PID: 2716)
      • Order Reqest Details 2023 Jbc.exe (PID: 3488)
      • NEW STUB.EXE (PID: 1480)
      • Order Reqest Details 2023 Jbc.exe (PID: 600)
      • Order Reqest Details 2023 Jbc.exe (PID: 2948)
      • NEW STUB.EXE (PID: 3236)
      • msdcsc.exe (PID: 1836)
      • msdcsc.exe (PID: 2424)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2528)
      • chrome.exe (PID: 2068)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2528)

    • Manual execution by a user

      • notepad++.exe (PID: 3972)
      • Order Reqest Details 2023 Jbc.exe (PID: 2716)
      • WinRAR.exe (PID: 2528)
      • notepad++.exe (PID: 1616)
      • Order Reqest Details 2023 Jbc.exe (PID: 600)
      • taskmgr.exe (PID: 3272)

    • Application launched itself

      • chrome.exe (PID: 1532)

    • Checks supported languages

      • Order Reqest Details 2023 Jbc.exe (PID: 2716)
      • Order Reqest Details 2023 Jbc.exe (PID: 600)
      • Order Reqest Details 2023 Jbc.exe (PID: 3488)
      • NEW STUB.EXE (PID: 1480)
      • msdcsc.exe (PID: 2424)
      • Order Reqest Details 2023 Jbc.exe (PID: 2948)
      • NEW STUB.EXE (PID: 3236)
      • msdcsc.exe (PID: 1836)

    • Reads the computer name

      • Order Reqest Details 2023 Jbc.exe (PID: 2716)
      • Order Reqest Details 2023 Jbc.exe (PID: 600)
      • Order Reqest Details 2023 Jbc.exe (PID: 3488)
      • NEW STUB.EXE (PID: 1480)
      • msdcsc.exe (PID: 2424)
      • Order Reqest Details 2023 Jbc.exe (PID: 2948)
      • NEW STUB.EXE (PID: 3236)
      • msdcsc.exe (PID: 1836)

    • Creates files or folders in the user directory

      • Order Reqest Details 2023 Jbc.exe (PID: 2716)
      • NEW STUB.EXE (PID: 1480)

    • Create files in a temporary directory

      • Order Reqest Details 2023 Jbc.exe (PID: 2716)
      • Order Reqest Details 2023 Jbc.exe (PID: 3488)
      • Order Reqest Details 2023 Jbc.exe (PID: 600)
      • msdcsc.exe (PID: 2424)

    • Reads the machine GUID from the registry

      • Order Reqest Details 2023 Jbc.exe (PID: 2716)
      • NEW STUB.EXE (PID: 1480)
      • Order Reqest Details 2023 Jbc.exe (PID: 3488)
      • Order Reqest Details 2023 Jbc.exe (PID: 600)
      • NEW STUB.EXE (PID: 3236)
      • msdcsc.exe (PID: 2424)

    • Process checks are UAC notifies on

      • NEW STUB.EXE (PID: 1480)

    • Reads Environment values

      • NEW STUB.EXE (PID: 1480)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Nanocore

(PID) Process(1480) NEW STUB.EXE
KeyboardLoggingTrue
BuildTime2021-04-18 18:21:52.193672
Version1.2.2.0
Mutex94803e62-45dd-47d9-9960-20dd767ecae3
DefaultGroupAPILA 2021
PrimaryConnectionHosttony3311.ddns.net
BackupConnectionHosttony3311.ddns.net
ConnectionPort10108
RunOnStartupTrue
RequestElevationFalse
BypassUserAccountControlFalse
ClearZoneIdentifierTrue
ClearAccessControlTrue
SetCriticalProcessFalse
PreventSystemSleepTrue
ActivateAwayModeFalse
EnableDebugModeFalse
RunDelay0
ConnectDelay4000
RestartDelay5000
TimeoutInterval5000
KeepAliveTimeout30000
MutexTimeout5000
LanTimeout2500
WanTimeout8000
BufferSize65535
MaxPacketSize10485760
GCThreshold10485760
UseCustomDnsServerTrue
PrimaryDnsServer8.8.8.8
BackupDnsServer8.8.4.4
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
81
Monitored processes
34
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs notepad++.exe winrar.exe order reqest details 2023 jbc.exe notepad++.exe order reqest details 2023 jbc.exe schtasks.exe no specs order reqest details 2023 jbc.exe cmd.exe no specs cmd.exe no specs #NANOCORE new stub.exe attrib.exe no specs attrib.exe no specs notepad.exe no specs taskmgr.exe no specs msdcsc.exe no specs powershell.exe no specs powershell.exe no specs schtasks.exe no specs #NANOCORE order reqest details 2023 jbc.exe new stub.exe no specs notepad.exe no specs schtasks.exe no specs msdcsc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
556attrib "C:\Users\admin\Desktop\Order Reqest Details 2023 Jbc.exe" +s +hC:\Windows\System32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
600"C:\Users\admin\Desktop\Order Reqest Details 2023 Jbc.exe" C:\Users\admin\Desktop\Order Reqest Details 2023 Jbc.exe
explorer.exe
User:
admin
Company:
Hewlett-Packard
Integrity Level:
HIGH
Description:
BeeTrial
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\order reqest details 2023 jbc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1480"C:\Users\admin\AppData\Local\Temp\NEW STUB.EXE" C:\Users\admin\AppData\Local\Temp\NEW STUB.EXE
Order Reqest Details 2023 Jbc.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\new stub.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Nanocore
(PID) Process(1480) NEW STUB.EXE
KeyboardLoggingTrue
BuildTime2021-04-18 18:21:52.193672
Version1.2.2.0
Mutex94803e62-45dd-47d9-9960-20dd767ecae3
DefaultGroupAPILA 2021
PrimaryConnectionHosttony3311.ddns.net
BackupConnectionHosttony3311.ddns.net
ConnectionPort10108
RunOnStartupTrue
RequestElevationFalse
BypassUserAccountControlFalse
ClearZoneIdentifierTrue
ClearAccessControlTrue
SetCriticalProcessFalse
PreventSystemSleepTrue
ActivateAwayModeFalse
EnableDebugModeFalse
RunDelay0
ConnectDelay4000
RestartDelay5000
TimeoutInterval5000
KeepAliveTimeout30000
MutexTimeout5000
LanTimeout2500
WanTimeout8000
BufferSize65535
MaxPacketSize10485760
GCThreshold10485760
UseCustomDnsServerTrue
PrimaryDnsServer8.8.8.8
BackupDnsServer8.8.4.4
1496"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DsgRewOasQTpD" /XML "C:\Users\admin\AppData\Local\Temp\tmpCC5.tmp"C:\Windows\System32\schtasks.exe—Order Reqest Details 2023 Jbc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1532"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://vtsamples.commondatastorage.googleapis.com/7a6ceb6ace388bfb6c1698a723df98ec107e7043e955d64b03fba81cb65627db?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1690225636&Signature=dJywbNr3dJzVEzT6nIe91Lo7btBRsqqdaEqPOiala5wyCtFA%2F6OIfUJ202LRpaRfnsJvphpONFnw%0AExLTG2uB260PEpLWItZPFOSl5mO3KBzQqaNu%2BUVHQEOeQgFpqcVtlzfeR5mb5ZnMFVEJUJs3F%2Fba%0A%2FaJhjIU7bMAvNnsLwv19PBrboSWLr0dABoXQ%2BukTGqmj5NFcGWIMIQCPrJ%2BhtiEX26SRIUbgu%2BqA%0AXuvQ2Bk4Q1EJjmaOYosjopDeJXOzmYxS9ov0By1h3WgmZ72jCIai4VGRrlWxvUFS3YA%2FORfaz%2BGN%0AErra1z8e%2Brp%2BHoTSxzzoAdJ5pqSlONgHC%2Bc33Q%3D%3D&response-content-disposition=attachment%3B%20filename%3D%227a6ceb6ace388bfb6c1698a723df98ec107e7043e955d64b03fba81cb65627db%22&response-content-type=application%2Foctet-stream;"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1616"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\Order Reqest Details 2023 Jbc.exe"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
1836"C:\Users\admin\Documents\MSDCSC\msdcsc.exe"C:\Users\admin\Documents\MSDCSC\msdcsc.exe—msdcsc.exe
User:
admin
Company:
Hewlett-Packard
Integrity Level:
MEDIUM
Description:
BeeTrial
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\documents\msdcsc\msdcsc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\ole32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2068"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 --field-trial-handle=1176,i,17033238403367282551,17601205735516064256,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\cryptbase.dll
2180"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DsgRewOasQTpD" /XML "C:\Users\admin\AppData\Local\Temp\tmp76DE.tmp"C:\Windows\System32\schtasks.exe—Order Reqest Details 2023 Jbc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\schtasks.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2260"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1996 --field-trial-handle=1176,i,17033238403367282551,17601205735516064256,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
Total events
9 323
Read events
9 122
Write events
201
Delete events
0

Modification events

(PID) Process:(1532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(1532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(1532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
1
(PID) Process:(1532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(1532) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(1532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid_installdate
Value:
0
(PID) Process:(1532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid_enableddate
Value:
0
Executable files
5
Suspicious files
27
Text files
48
Unknown types
0

Dropped files

PID
Process
Filename
Type
1532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF1096c3.TMP —
MD5:—
SHA256:—
1532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
1532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF1096c3.TMPtext
MD5:C214500EDB0B5F56B9D3D27B32964AB2
SHA256:6254FD03CFC08A142D6AEB8C037D25D42564C0CC6F294A3716DF19FDF254EBCE
1532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LOG.old~RF10a77d.TMP —
MD5:—
SHA256:—
1532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LOG.old —
MD5:—
SHA256:—
1532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:9F941EA08DBDCA2EB3CFA1DBBBA6F5DC
SHA256:127F71DF0D2AD895D4F293E62284D85971AE047CA15F90B87BF6335898B0B655
1532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF1096e3.TMPtext
MD5:CF083E99BB51786FA31BD0E0FE2686E4
SHA256:BC8DE81EFA52674CA26D55DFAFCBCE7A4D38994BEF5D267548EADF9985DBF5AC
1532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old~RF1097dd.TMPtext
MD5:74174B4F8AEB3CFDC18745625ED7865C
SHA256:419223BAED85740D27E427C390FDCA869AE1F4089A8415DE13CC4305F6907FDF
1532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\802d4c7b-5e1d-45f2-beb0-b03fde4d4c56.tmpbinary
MD5:5058F1AF8388633F609CADB75A75DC9D
SHA256:—
1532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.oldtext
MD5:561161B0FF5BCA89BF47F8AC972A7499
SHA256:ECCA5CCFA0BEED7581B39FCE03D0FD3B694DF0F92BFFF780F702118AD51FC17D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
167
DNS requests
32
Threats
11

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3340
chrome.exe
172.217.16.138:443
optimizationguide-pa.googleapis.com
—
—
whitelisted
3340
chrome.exe
172.217.18.106:443
optimizationguide-pa.googleapis.com
GOOGLE
US
whitelisted
3340
chrome.exe
142.250.186.138:443
www.googleapis.com
GOOGLE
US
whitelisted
868
svchost.exe
34.104.35.123:80
edgedl.me.gvt1.com
GOOGLE
US
whitelisted
3340
chrome.exe
142.250.185.163:443
update.googleapis.com
GOOGLE
US
whitelisted
3340
chrome.exe
142.250.74.206:443
clients1.google.com
GOOGLE
US
whitelisted
1480
NEW STUB.EXE
197.211.58.197:10108
tony3311.ddns.net
Globacom-AS
NG
unknown
2948
Order Reqest Details 2023 Jbc.exe
89.37.99.71:39399
timmy08.ddns.net
Hyonix LLC
NL
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
vtsamples.commondatastorage.googleapis.com
  • 216.58.206.48
whitelisted
accounts.google.com
  • 142.250.184.205
shared
sb-ssl.google.com
  • 216.58.206.46
whitelisted
www.google.com
  • 142.250.185.164
malicious
optimizationguide-pa.googleapis.com
  • 142.250.186.106
  • 172.217.18.106
  • 142.250.185.138
  • 142.250.181.234
  • 142.250.185.74
  • 216.58.212.170
  • 142.250.185.202
  • 142.250.185.106
  • 142.250.185.170
  • 216.58.212.138
  • 142.250.184.202
  • 172.217.16.138
  • 216.58.206.42
  • 142.250.186.74
  • 172.217.23.106
  • 142.250.185.234
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
www.googleapis.com
  • 172.217.16.138
  • 142.250.186.138
  • 142.250.185.202
  • 142.250.186.74
  • 142.250.185.106
  • 142.250.185.170
  • 142.250.184.202
  • 142.250.185.74
  • 142.250.74.202
  • 142.250.185.138
  • 172.217.18.106
  • 142.250.181.234
  • 142.250.186.42
  • 142.250.186.106
  • 142.250.184.234
  • 142.250.185.234
whitelisted
update.googleapis.com
  • 142.250.185.163
whitelisted
edgedl.me.gvt1.com
  • 34.104.35.123
whitelisted
clients1.google.com
  • 142.250.74.206
whitelisted

Threats

PID
Process
Class
Message
1480
NEW STUB.EXE
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1480
NEW STUB.EXE
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1480
NEW STUB.EXE
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1480
NEW STUB.EXE
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1480
NEW STUB.EXE
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1084
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1480
NEW STUB.EXE
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1480
NEW STUB.EXE
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1480
NEW STUB.EXE
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1084
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://vtsamples.commondatastorage.googleapis.com/7a6ceb6ace388bfb6c1698a723df98ec107e7043e955d64b03fba81cb65627db?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1690225636&Signature=dJywbNr3dJzVEzT6nIe91Lo7btBRsqqdaEqPOiala5wyCtFA%2F6OIfUJ202LRpaRfnsJvphpONFnw%0AExLTG2uB260PEpLWItZPFOSl5mO3KBzQqaNu%2BUVHQEOeQgFpqcVtlzfeR5mb5ZnMFVEJUJs3F%2Fba%0A%2FaJhjIU7bMAvNnsLwv19PBrboSWLr0dABoXQ%2BukTGqmj5NFcGWIMIQCPrJ%2BhtiEX26SRIUbgu%2BqA%0AXuvQ2Bk4Q1EJjmaOYosjopDeJXOzmYxS9ov0By1h3WgmZ72jCIai4VGRrlWxvUFS3YA%2FORfaz%2BGN%0AErra1z8e%2Brp%2BHoTSxzzoAdJ5pqSlONgHC%2Bc33Q%3D%3D&response-content-disposition=attachment%3B%20filename%3D%227a6ceb6ace388bfb6c1698a723df98ec107e7043e955d64b03fba81cb65627db%22&response-content-type=application%2Foctet-stream;