URL:

http://www.mediafire.com/file/8knz86jx235p3jr/omg.exe/file

Full analysis: https://app.any.run/tasks/5de0f865-98a8-4ca4-9f78-dfbf50816a13
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 12, 2022, 23:40:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

E09CF81B2ED787C74988DA24D1EE960F

SHA1:

6D1D88518C680FEBF31F691ABD40165C07F6CE13

SHA256:

EC3C0A0AC6AA73B58D6924F4E5C0A0422B8B047E69B811AB894C2C15481DBBD2

SSDEEP:

3:N1KJS4w3eGUodoWiIuIA:Cc4w3eG5Liz9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • OMG.exe (PID: 3120)
      • OMG.exe (PID: 1776)
      • OMG.exe (PID: 3712)
      • OMG.exe (PID: 2276)
      • ndp48-web.exe (PID: 3204)
      • ndp48-web.exe (PID: 4092)
      • Setup.exe (PID: 2548)
      • SetupUtility.exe (PID: 3984)
      • SetupUtility.exe (PID: 3780)

    • Drops executable file immediately after starts

      • OMG.exe (PID: 3120)
      • OMG.exe (PID: 3712)
      • ndp48-web.exe (PID: 4092)
      • chrome.exe (PID: 2332)

    • Actions looks like stealing of personal data

      • ndp48-web.exe (PID: 4092)

    • Loads dropped or rewritten executable

      • Setup.exe (PID: 2548)

    • Changes settings of System certificates

      • Setup.exe (PID: 2548)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3972)
      • OMG.exe (PID: 3120)
      • OMG.exe (PID: 3712)
      • iexplore.exe (PID: 3532)
      • iexplore.exe (PID: 3688)
      • ndp48-web.exe (PID: 4092)
      • chrome.exe (PID: 2332)
      • TMP31D6.tmp.exe (PID: 1132)
      • Setup.exe (PID: 2548)

    • Drops a file with a compile date too recent

      • chrome.exe (PID: 3972)
      • OMG.exe (PID: 3120)
      • OMG.exe (PID: 3712)

    • Checks supported languages

      • OMG.exe (PID: 3120)
      • cmd.exe (PID: 2676)
      • OMG.exe (PID: 1776)
      • OMG.exe (PID: 3712)
      • cmd.exe (PID: 2720)
      • OMG.exe (PID: 2276)
      • Setup.exe (PID: 2548)
      • ndp48-web.exe (PID: 4092)
      • SetupUtility.exe (PID: 3984)
      • SetupUtility.exe (PID: 3780)
      • TMP31D6.tmp.exe (PID: 1132)

    • Drops a file that was compiled in debug mode

      • OMG.exe (PID: 3120)
      • OMG.exe (PID: 3712)
      • iexplore.exe (PID: 3532)
      • iexplore.exe (PID: 3688)
      • ndp48-web.exe (PID: 4092)
      • chrome.exe (PID: 2332)

    • Reads the computer name

      • OMG.exe (PID: 3120)
      • OMG.exe (PID: 1776)
      • OMG.exe (PID: 3712)
      • OMG.exe (PID: 2276)
      • ndp48-web.exe (PID: 4092)
      • Setup.exe (PID: 2548)
      • SetupUtility.exe (PID: 3984)
      • SetupUtility.exe (PID: 3780)
      • TMP31D6.tmp.exe (PID: 1132)

    • Starts CMD.EXE for commands execution

      • OMG.exe (PID: 3120)
      • OMG.exe (PID: 3712)

    • Starts Internet Explorer

      • OMG.exe (PID: 1776)
      • OMG.exe (PID: 2276)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1272)
      • iexplore.exe (PID: 3532)

    • Reads CPU info

      • Setup.exe (PID: 2548)

    • Reads Environment values

      • Setup.exe (PID: 2548)

  • INFO

    • Reads the computer name

      • chrome.exe (PID: 3972)
      • chrome.exe (PID: 1888)
      • chrome.exe (PID: 452)
      • chrome.exe (PID: 3884)
      • chrome.exe (PID: 3144)
      • chrome.exe (PID: 3484)
      • chrome.exe (PID: 3732)
      • chrome.exe (PID: 1536)
      • chrome.exe (PID: 1780)
      • chrome.exe (PID: 3816)
      • chrome.exe (PID: 300)
      • chrome.exe (PID: 3172)
      • chrome.exe (PID: 2780)
      • chrome.exe (PID: 2500)
      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 1272)
      • iexplore.exe (PID: 3688)
      • iexplore.exe (PID: 3532)

    • Checks supported languages

      • chrome.exe (PID: 3972)
      • chrome.exe (PID: 1888)
      • chrome.exe (PID: 420)
      • chrome.exe (PID: 2092)
      • chrome.exe (PID: 3808)
      • chrome.exe (PID: 3324)
      • chrome.exe (PID: 464)
      • chrome.exe (PID: 2888)
      • chrome.exe (PID: 2700)
      • chrome.exe (PID: 452)
      • chrome.exe (PID: 3884)
      • chrome.exe (PID: 3160)
      • chrome.exe (PID: 3180)
      • chrome.exe (PID: 3476)
      • chrome.exe (PID: 2848)
      • chrome.exe (PID: 2092)
      • chrome.exe (PID: 3740)
      • chrome.exe (PID: 3144)
      • chrome.exe (PID: 3212)
      • chrome.exe (PID: 3952)
      • chrome.exe (PID: 3384)
      • chrome.exe (PID: 3484)
      • chrome.exe (PID: 2520)
      • chrome.exe (PID: 2824)
      • chrome.exe (PID: 1968)
      • chrome.exe (PID: 3732)
      • chrome.exe (PID: 1400)
      • chrome.exe (PID: 1468)
      • chrome.exe (PID: 3840)
      • chrome.exe (PID: 2148)
      • chrome.exe (PID: 2568)
      • chrome.exe (PID: 3816)
      • chrome.exe (PID: 3468)
      • chrome.exe (PID: 3800)
      • chrome.exe (PID: 1780)
      • chrome.exe (PID: 3260)
      • chrome.exe (PID: 2768)
      • chrome.exe (PID: 1536)
      • chrome.exe (PID: 2104)
      • chrome.exe (PID: 3792)
      • chrome.exe (PID: 3752)
      • chrome.exe (PID: 1828)
      • chrome.exe (PID: 3992)
      • chrome.exe (PID: 240)
      • chrome.exe (PID: 3840)
      • chrome.exe (PID: 1432)
      • chrome.exe (PID: 2332)
      • chrome.exe (PID: 2980)
      • chrome.exe (PID: 1332)
      • chrome.exe (PID: 128)
      • chrome.exe (PID: 3172)
      • chrome.exe (PID: 2584)
      • chrome.exe (PID: 300)
      • chrome.exe (PID: 2380)
      • chrome.exe (PID: 2780)
      • chrome.exe (PID: 3120)
      • chrome.exe (PID: 2500)
      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 1272)
      • iexplore.exe (PID: 3688)
      • iexplore.exe (PID: 3532)
      • chrome.exe (PID: 304)
      • chrome.exe (PID: 2536)
      • chrome.exe (PID: 4092)
      • chrome.exe (PID: 2332)
      • chrome.exe (PID: 3288)
      • chrome.exe (PID: 2344)

    • Application launched itself

      • chrome.exe (PID: 3972)
      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3688)

    • Reads the hosts file

      • chrome.exe (PID: 3972)
      • chrome.exe (PID: 452)

    • Reads settings of System Certificates

      • chrome.exe (PID: 452)
      • iexplore.exe (PID: 1272)
      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3532)
      • iexplore.exe (PID: 3688)
      • Setup.exe (PID: 2548)

    • Reads the date of Windows installation

      • chrome.exe (PID: 1536)
      • iexplore.exe (PID: 2176)

    • Checks Windows Trust Settings

      • chrome.exe (PID: 3972)
      • iexplore.exe (PID: 1272)
      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3688)
      • iexplore.exe (PID: 3532)
      • Setup.exe (PID: 2548)

    • Changes internet zones settings

      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3688)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1272)
      • iexplore.exe (PID: 3532)

    • Creates files in the user directory

      • iexplore.exe (PID: 1272)
      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3532)
      • iexplore.exe (PID: 3688)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3688)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3688)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3688)
      • SetupUtility.exe (PID: 3984)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
124
Monitored processes
79
Malicious processes
5
Suspicious processes
4

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs omg.exe chrome.exe no specs cmd.exe no specs omg.exe no specs iexplore.exe iexplore.exe omg.exe cmd.exe no specs omg.exe no specs iexplore.exe iexplore.exe chrome.exe no specs chrome.exe no specs ndp48-web.exe no specs chrome.exe no specs ndp48-web.exe setup.exe chrome.exe setuputility.exe no specs chrome.exe no specs setuputility.exe no specs chrome.exe no specs tmp31d6.tmp.exe

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
240"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
300"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
304"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4396 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
420"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
452"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1276 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
464"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
1132TMP31D6.tmp.exe /Q /X:C:\08ae0f5cacad52afc4\TMP31D6.tmp.exe.tmpC:\08ae0f5cacad52afc4\TMP31D6.tmp.exe
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.8 Setup
Exit code:
0
Version:
4.8.03761.00
1272"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2176 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
1332"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5660 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
45
Suspicious files
85
Text files
317
Unknown types
29

Dropped files

PID
Process
Filename
Type
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62084558-F84.pma —
MD5:—
SHA256:—
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\b2d458fa-498f-4cf8-970a-4904c4e916b3.tmptext
MD5:164C04995BE3F7BC580DEEE0BB74E39A
SHA256:D233BF77A9CAD5A856D842ACE9A8211AC8CE4590A6C4C3CA4E3ECD1DE7BBA2EF
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferencestext
MD5:164C04995BE3F7BC580DEEE0BB74E39A
SHA256:D233BF77A9CAD5A856D842ACE9A8211AC8CE4590A6C4C3CA4E3ECD1DE7BBA2EF
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC
SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF193510.TMPtext
MD5:64AD8ED3E666540337BA541C549F72F7
SHA256:BECBDB08B5B37D203A85F2E974407334053BB1D2270F0B3C9A4DB963896F2206
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:8FF312A95D60ED89857FEB720D80D4E1
SHA256:946A57FAFDD28C3164D5AB8AB4971B21BD5EC5BFFF7554DBF832CB58CC37700B
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old~RF19352f.TMPtext
MD5:81F483F77EE490F35306A4F94DB2286B
SHA256:82434CE3C9D13F509EBEEBE3A7A1A1DE9AB4557629D9FC855761E0CFA45E8BCE
2700chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pmabinary
MD5:03C4F648043A88675A920425D824E1B3
SHA256:F91DBB7C64B4582F529C968C480D2DCE1C8727390482F31E4355A27BB3D9B450
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF1936d5.TMPtext
MD5:8304B8F42465198890090F52D3F80A4C
SHA256:80C32AC2585E7E81200104B1630F19560A156C4ABF51B5888B0FBF07323FAB34
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
74
TCP/UDP connections
233
DNS requests
162
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
452
chrome.exe
GET
301
142.250.184.206:80
http://translate.google.com/translate_a/element.js?cb=googFooterTranslate
US
—
—
whitelisted
452
chrome.exe
GET
—
104.16.203.237:80
http://www.mediafire.com/images/icons/svg_light/icons_sprite.svg
US
—
—
shared
452
chrome.exe
GET
200
104.16.203.237:80
http://www.mediafire.com/file/8knz86jx235p3jr/omg.exe/file
US
html
83.4 Kb
shared
452
chrome.exe
GET
200
104.17.166.186:80
http://c.adsco.re/
US
html
24.2 Kb
whitelisted
452
chrome.exe
GET
200
104.16.203.237:80
http://static.mediafire.com/images/filetype/file-app-v3.png
US
image
2.32 Kb
shared
452
chrome.exe
GET
200
104.16.203.237:80
http://static.mediafire.com/images/backgrounds/download/dl_promo_logo.png
US
image
2.19 Kb
shared
452
chrome.exe
GET
200
104.16.203.237:80
http://static.mediafire.com/images/backgrounds/footer/social/footerIcons.png
US
image
583 b
shared
452
chrome.exe
GET
200
104.16.203.237:80
http://static.mediafire.com/images/backgrounds/download/social/fb_16x16.png
US
image
181 b
shared
452
chrome.exe
GET
200
104.16.203.237:80
http://www.mediafire.com/images/icons/svg_dark/arrow_dropdown.svg
US
image
250 b
shared
452
chrome.exe
GET
200
104.17.166.186:80
http://c.adsco.re/
US
html
24.2 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
452
chrome.exe
104.16.203.237:80
www.mediafire.com
Cloudflare Inc
US
unknown
452
chrome.exe
216.58.212.136:443
www.googletagmanager.com
Google Inc.
US
whitelisted
452
chrome.exe
142.250.186.45:443
accounts.google.com
Google Inc.
US
suspicious
452
chrome.exe
142.250.186.174:443
clients2.google.com
Google Inc.
US
whitelisted
452
chrome.exe
142.250.184.206:80
translate.google.com
Google Inc.
US
whitelisted
452
chrome.exe
104.26.6.139:443
btloader.com
Cloudflare Inc
US
suspicious
452
chrome.exe
142.250.184.206:443
translate.google.com
Google Inc.
US
whitelisted
452
chrome.exe
52.222.206.214:443
cdn.amplitude.com
Amazon.com, Inc.
US
suspicious
452
chrome.exe
142.250.185.226:443
securepubads.g.doubleclick.net
Google Inc.
US
suspicious
452
chrome.exe
142.250.185.166:443
ad.doubleclick.net
Google Inc.
US
unknown

DNS requests

Domain
IP
Reputation
accounts.google.com
  • 142.250.186.45
shared
www.mediafire.com
  • 104.16.203.237
  • 104.16.202.237
shared
clients2.google.com
  • 142.250.186.174
whitelisted
www.googletagmanager.com
  • 216.58.212.136
whitelisted
btloader.com
  • 104.26.6.139
  • 172.67.70.134
  • 104.26.7.139
whitelisted
translate.google.com
  • 142.250.184.206
whitelisted
securepubads.g.doubleclick.net
  • 142.250.185.226
whitelisted
fundingchoicesmessages.google.com
  • 142.250.184.206
whitelisted
cdn.amplitude.com
  • 52.222.206.214
  • 52.222.206.6
  • 52.222.206.178
  • 52.222.206.118
whitelisted
static.mediafire.com
  • 104.16.203.237
  • 104.16.202.237
shared

Threats

PID
Process
Class
Message
452
chrome.exe
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
452
chrome.exe
A Network Trojan was detected
ET POLICY Terse Named Filename EXE Download - Possibly Hostile
452
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
452
chrome.exe
Misc activity
ET INFO EXE - Served Attached HTTP
884
svchost.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
884
svchost.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.mediafire.com/file/8knz86jx235p3jr/omg.exe/file