URL:

https://mc.163.com

Full analysis: https://app.any.run/tasks/9d5596cd-8570-41dd-833b-29c82e54e2e4
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 23, 2020, 14:21:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

11342ACB1A2D1177D3A8C4AD523DF5EC

SHA1:

98063DA2EFB5BD8B048514021623A527037292C7

SHA256:

E99B66B76E45C5413C57760E529E46B0D8DF6DC63EDB0E21C6DF363BBF76BF7A

SSDEEP:

3:N8EHT:2EHT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads executable files from the Internet

      • chrome.exe (PID: 780)

    • Application was dropped or rewritten from another process

      • mclauncher_1.5.0.5724.exe (PID: 3260)
      • WPFLauncher.exe (PID: 1296)
      • MCLauncherUpdater.exe (PID: 3708)
      • MCLauncherUpdater.exe (PID: 2320)
      • WPFLauncher.exe (PID: 3328)
      • WPFLauncher.exe (PID: 3688)
      • CefSharp.BrowserSubprocess.exe (PID: 2548)
      • 7z.exe (PID: 1888)

    • Actions looks like stealing of personal data

      • explorer.exe (PID: 372)

    • Loads dropped or rewritten executable

      • WPFLauncher.exe (PID: 1296)
      • WPFLauncher.exe (PID: 3328)
      • WPFLauncher.exe (PID: 3688)
      • iexplore.exe (PID: 3096)
      • CefSharp.BrowserSubprocess.exe (PID: 2548)

    • Changes settings of System certificates

      • WPFLauncher.exe (PID: 1296)
      • MCLauncherUpdater.exe (PID: 2320)

    • Starts Visual C# compiler

      • sdiagnhost.exe (PID: 3080)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3828)
      • mclauncher_1.5.0.5724.exe (PID: 3260)
      • mclauncher_1.5.0.5724.tmp (PID: 4068)
      • MCLauncherUpdater.exe (PID: 3708)
      • MCLauncherUpdater.exe (PID: 2320)
      • msdt.exe (PID: 3544)
      • 7z.exe (PID: 1888)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3828)

    • Reads the Windows organization settings

      • mclauncher_1.5.0.5724.tmp (PID: 4068)

    • Starts CMD.EXE for commands execution

      • mclauncher_1.5.0.5724.tmp (PID: 4068)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3244)
      • cmd.exe (PID: 940)
      • cmd.exe (PID: 1392)
      • cmd.exe (PID: 3264)
      • cmd.exe (PID: 4092)
      • cmd.exe (PID: 3948)

    • Reads Windows owner or organization settings

      • mclauncher_1.5.0.5724.tmp (PID: 4068)

    • Low-level read access rights to disk partition

      • WPFLauncher.exe (PID: 1296)
      • WPFLauncher.exe (PID: 3328)

    • Creates files in the program directory

      • WPFLauncher.exe (PID: 1296)
      • MCLauncherUpdater.exe (PID: 2320)
      • WPFLauncher.exe (PID: 3328)

    • Executes scripts

      • cmd.exe (PID: 3192)

    • Reads Environment values

      • WPFLauncher.exe (PID: 1296)
      • MCLauncherUpdater.exe (PID: 2320)
      • WPFLauncher.exe (PID: 3328)

    • Adds / modifies Windows certificates

      • WPFLauncher.exe (PID: 1296)
      • MCLauncherUpdater.exe (PID: 2320)

    • Starts itself from another location

      • MCLauncherUpdater.exe (PID: 3708)

    • Executed via COM

      • sdiagnhost.exe (PID: 3080)

    • Modifies the open verb of a shell class

      • WPFLauncher.exe (PID: 3328)

    • Reads the BIOS version

      • WPFLauncher.exe (PID: 3328)

    • Changes IE settings (feature browser emulation)

      • WPFLauncher.exe (PID: 3328)

    • Starts Internet Explorer

      • WPFLauncher.exe (PID: 3328)

    • Creates files in the user directory

      • CefSharp.BrowserSubprocess.exe (PID: 2548)

  • INFO

    • Manual execution by user

      • mclauncher_1.5.0.5724.exe (PID: 3260)

    • Reads settings of System Certificates

      • chrome.exe (PID: 3828)
      • explorer.exe (PID: 372)
      • iexplore.exe (PID: 3096)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 3828)
      • iexplore.exe (PID: 1860)
      • iexplore.exe (PID: 3096)

    • Reads the hosts file

      • chrome.exe (PID: 3828)
      • chrome.exe (PID: 780)
      • WPFLauncher.exe (PID: 3328)

    • Application was dropped or rewritten from another process

      • mclauncher_1.5.0.5724.tmp (PID: 4068)
      • ie4uinit.exe (PID: 1712)

    • Application launched itself

      • chrome.exe (PID: 3828)

    • Loads dropped or rewritten executable

      • mclauncher_1.5.0.5724.tmp (PID: 4068)

    • Creates a software uninstall entry

      • mclauncher_1.5.0.5724.tmp (PID: 4068)

    • Creates files in the program directory

      • mclauncher_1.5.0.5724.tmp (PID: 4068)

    • Changes internet zones settings

      • iexplore.exe (PID: 1860)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3096)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3096)

    • Creates files in the user directory

      • iexplore.exe (PID: 3096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
74
Malicious processes
9
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs mclauncher_1.5.0.5724.exe mclauncher_1.5.0.5724.tmp cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs ie4uinit.exe no specs explorer.exe cmd.exe no specs cscript.exe no specs wpflauncher.exe mclauncherupdater.exe mclauncherupdater.exe 7z.exe wpflauncher.exe pcwrun.exe no specs msdt.exe sdiagnhost.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs wpflauncher.exe iexplore.exe iexplore.exe cefsharp.browsersubprocess.exe

Process information

PID
CMD
Path
Indicators
Parent process
340"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,2466912648294163009,2371545885736409011,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17963473974826962972 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
372C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1073807364
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
404"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1000,2466912648294163009,2371545885736409011,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=6311962555161668746 --mojo-platform-channel-handle=2052 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
480"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1000,2466912648294163009,2371545885736409011,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=17867757212296423159 --mojo-platform-channel-handle=4104 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
608C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES8320.tmp" "c:\Users\admin\AppData\Local\Temp\CSC830F.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
620"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3320 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
628"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\luoudkda.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.4927 (NetFXspW7.050727-4900)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
664"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,2466912648294163009,2371545885736409011,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9650639326287958476 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2516 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
780"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1000,2466912648294163009,2371545885736409011,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=281515300815805205 --mojo-platform-channel-handle=1588 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
856"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,2466912648294163009,2371545885736409011,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6402562960136735078 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2528 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
8 968
Read events
8 054
Write events
900
Delete events
14

Modification events

(PID) Process:(372) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3828) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3828) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3828) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3828) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(372) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB0100000042FC59FEDE58F34090DB57BACFB219F7000000000200000000001066000000010000200000009A7483C08BA2E174020CBD2F602947C37D18E95EC43546F91A0B94AECEAF3AD1000000000E80000000020000200000009014B02BA838A96E2FDEA141790D3782EADCFD0B4C24CCD2741B1DB133792CD130000000D2DC7E2E78F9A942C56EB5FC9C47F0B4BBACF9DEF190BB2DBBAFED0EFD7D976C0B0B4E90593C30D624DAEA38E48814F04000000030C650B00247820819A98CD18DFD38A44C29D36914DA43C6F6BB5D89E48900EBE24C027EB6A29ABEFB0264C6544DA8DBB66DED3A9A8C1F14B794DEB36DF6B751
(PID) Process:(620) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:3828-13232125296731500
Value:
259
(PID) Process:(3828) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3828) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3828) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
Executable files
273
Suspicious files
102
Text files
543
Unknown types
30

Dropped files

PID
Process
Filename
Type
3828chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5EA1A471-EF4.pma —
MD5:—
SHA256:—
3828chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\6e9311c8-3ce7-4e1f-ac43-89c3664c5125.tmp —
MD5:—
SHA256:—
3828chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
3828chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old —
MD5:—
SHA256:—
3828chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old —
MD5:—
SHA256:—
3828chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Last Tabsbinary
MD5:—
SHA256:—
3828chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RFa6e1bd.TMPtext
MD5:—
SHA256:—
3828chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
3828chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
3828chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RFa6e3f0.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
121
DNS requests
61
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2320
MCLauncherUpdater.exe
GET
304
67.27.157.254:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
—
—
whitelisted
372
explorer.exe
GET
200
67.27.157.254:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
56.0 Kb
whitelisted
780
chrome.exe
GET
200
173.194.150.231:80
http://r1---sn-2gb7sn7s.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjY5QUFXTEQwc2RPVXhRY3picjhxblh1dw/7619.603.0.2_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mh=Qx&mip=45.86.200.5&mm=28&mn=sn-2gb7sn7s&ms=nvh&mt=1587651677&mv=m&mvi=0&pl=25&shardbypass=yes
US
crx
816 Kb
whitelisted
372
explorer.exe
GET
304
67.27.157.254:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
56.0 Kb
whitelisted
3096
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D
US
der
471 b
whitelisted
3096
iexplore.exe
GET
200
47.246.43.227:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoEcNCWvIoSyJCm34Ju7Es%3D
US
der
471 b
whitelisted
3096
iexplore.exe
GET
200
47.246.43.227:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAVwh4tFXPeubD3BmTggkPI%3D
US
der
471 b
whitelisted
3096
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp1.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR3enuod9bxDxzpICGW%2B2sabjf17QQUkFj%2FsJx1qFFUd7Ht8qNDFjiebMUCEAEa7Gc4oUtE5q0TVS1Z7cw%3D
US
der
471 b
whitelisted
3096
iexplore.exe
GET
200
47.246.43.227:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAo11VDmP1eeJ4hw21hMopU%3D
US
der
471 b
whitelisted
3096
iexplore.exe
GET
200
47.246.43.227:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAVwh4tFXPeubD3BmTggkPI%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
780
chrome.exe
59.111.0.134:443
mc.163.com
Guangzhou NetEase Computer System Co., Ltd.
CN
unknown
780
chrome.exe
172.217.23.99:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
780
chrome.exe
172.217.22.109:443
accounts.google.com
Google Inc.
US
whitelisted
780
chrome.exe
172.217.16.170:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
780
chrome.exe
150.138.169.193:443
mc.res.netease.com
Xiangtan
CN
unknown
780
chrome.exe
163.171.128.148:443
nie.res.netease.com
—
US
malicious
780
chrome.exe
42.186.209.42:443
adl.netease.com
Guangzhou NetEase Computer System Co., Ltd.
CN
unknown
780
chrome.exe
172.217.18.99:443
ssl.gstatic.com
Google Inc.
US
whitelisted
780
chrome.exe
59.111.0.100:443
gad.netease.com
Guangzhou NetEase Computer System Co., Ltd.
CN
unknown
780
chrome.exe
163.171.132.119:443
urswebzj.nosdn.127.net
—
US
malicious

DNS requests

Domain
IP
Reputation
mc.163.com
  • 59.111.0.134
  • 42.186.122.58
unknown
clientservices.googleapis.com
  • 172.217.23.99
whitelisted
accounts.google.com
  • 172.217.22.109
shared
www.google.com
  • 172.217.23.164
malicious
safebrowsing.googleapis.com
  • 172.217.16.170
whitelisted
mc.res.netease.com
  • 150.138.169.193
unknown
webinput.nie.netease.com
  • 59.111.0.132
unknown
nie.res.netease.com
  • 163.171.128.148
malicious
adl.netease.com
  • 42.186.209.42
unknown
ssl.gstatic.com
  • 172.217.18.99
whitelisted

Threats

PID
Process
Class
Message
780
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
WPFLauncher.exe
%s------------------------------------------------ --- WinLicense Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
WPFLauncher.exe
%s------------------------------------------------ --- WinLicense Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://mc.163.com