URL:

http://www.mediafire.com/file/8knz86jx235p3jr/omg.exe/file

Full analysis: https://app.any.run/tasks/5de0f865-98a8-4ca4-9f78-dfbf50816a13
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 12, 2022, 23:40:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

E09CF81B2ED787C74988DA24D1EE960F

SHA1:

6D1D88518C680FEBF31F691ABD40165C07F6CE13

SHA256:

EC3C0A0AC6AA73B58D6924F4E5C0A0422B8B047E69B811AB894C2C15481DBBD2

SSDEEP:

3:N1KJS4w3eGUodoWiIuIA:Cc4w3eG5Liz9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • OMG.exe (PID: 3120)
      • OMG.exe (PID: 1776)
      • OMG.exe (PID: 3712)
      • OMG.exe (PID: 2276)
      • ndp48-web.exe (PID: 3204)
      • ndp48-web.exe (PID: 4092)
      • Setup.exe (PID: 2548)
      • SetupUtility.exe (PID: 3984)
      • SetupUtility.exe (PID: 3780)

    • Drops executable file immediately after starts

      • OMG.exe (PID: 3120)
      • OMG.exe (PID: 3712)
      • ndp48-web.exe (PID: 4092)
      • chrome.exe (PID: 2332)

    • Loads dropped or rewritten executable

      • Setup.exe (PID: 2548)

    • Actions looks like stealing of personal data

      • ndp48-web.exe (PID: 4092)

    • Changes settings of System certificates

      • Setup.exe (PID: 2548)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3972)
      • OMG.exe (PID: 3120)
      • OMG.exe (PID: 3712)
      • iexplore.exe (PID: 3532)
      • iexplore.exe (PID: 3688)
      • ndp48-web.exe (PID: 4092)
      • chrome.exe (PID: 2332)
      • TMP31D6.tmp.exe (PID: 1132)
      • Setup.exe (PID: 2548)

    • Drops a file with a compile date too recent

      • OMG.exe (PID: 3120)
      • chrome.exe (PID: 3972)
      • OMG.exe (PID: 3712)

    • Reads the computer name

      • OMG.exe (PID: 3120)
      • OMG.exe (PID: 1776)
      • OMG.exe (PID: 3712)
      • OMG.exe (PID: 2276)
      • ndp48-web.exe (PID: 4092)
      • Setup.exe (PID: 2548)
      • SetupUtility.exe (PID: 3984)
      • SetupUtility.exe (PID: 3780)
      • TMP31D6.tmp.exe (PID: 1132)

    • Starts CMD.EXE for commands execution

      • OMG.exe (PID: 3120)
      • OMG.exe (PID: 3712)

    • Checks supported languages

      • OMG.exe (PID: 3120)
      • cmd.exe (PID: 2676)
      • OMG.exe (PID: 1776)
      • OMG.exe (PID: 2276)
      • cmd.exe (PID: 2720)
      • OMG.exe (PID: 3712)
      • ndp48-web.exe (PID: 4092)
      • Setup.exe (PID: 2548)
      • SetupUtility.exe (PID: 3984)
      • SetupUtility.exe (PID: 3780)
      • TMP31D6.tmp.exe (PID: 1132)

    • Drops a file that was compiled in debug mode

      • OMG.exe (PID: 3120)
      • OMG.exe (PID: 3712)
      • iexplore.exe (PID: 3532)
      • iexplore.exe (PID: 3688)
      • ndp48-web.exe (PID: 4092)
      • chrome.exe (PID: 2332)

    • Starts Internet Explorer

      • OMG.exe (PID: 1776)
      • OMG.exe (PID: 2276)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1272)
      • iexplore.exe (PID: 3532)

    • Reads Environment values

      • Setup.exe (PID: 2548)

    • Reads CPU info

      • Setup.exe (PID: 2548)

  • INFO

    • Checks supported languages

      • chrome.exe (PID: 3972)
      • chrome.exe (PID: 2700)
      • chrome.exe (PID: 1888)
      • chrome.exe (PID: 452)
      • chrome.exe (PID: 420)
      • chrome.exe (PID: 2092)
      • chrome.exe (PID: 2520)
      • chrome.exe (PID: 3884)
      • chrome.exe (PID: 464)
      • chrome.exe (PID: 3160)
      • chrome.exe (PID: 2888)
      • chrome.exe (PID: 3180)
      • chrome.exe (PID: 3808)
      • chrome.exe (PID: 3144)
      • chrome.exe (PID: 2824)
      • chrome.exe (PID: 3476)
      • chrome.exe (PID: 3324)
      • chrome.exe (PID: 2092)
      • chrome.exe (PID: 2848)
      • chrome.exe (PID: 3740)
      • chrome.exe (PID: 3212)
      • chrome.exe (PID: 3952)
      • chrome.exe (PID: 1968)
      • chrome.exe (PID: 1400)
      • chrome.exe (PID: 3816)
      • chrome.exe (PID: 1536)
      • chrome.exe (PID: 3484)
      • chrome.exe (PID: 1468)
      • chrome.exe (PID: 3384)
      • chrome.exe (PID: 3732)
      • chrome.exe (PID: 3800)
      • chrome.exe (PID: 3840)
      • chrome.exe (PID: 2568)
      • chrome.exe (PID: 2148)
      • chrome.exe (PID: 3468)
      • chrome.exe (PID: 3260)
      • chrome.exe (PID: 3792)
      • chrome.exe (PID: 2104)
      • chrome.exe (PID: 3840)
      • chrome.exe (PID: 1780)
      • chrome.exe (PID: 2768)
      • chrome.exe (PID: 2332)
      • chrome.exe (PID: 1828)
      • chrome.exe (PID: 3752)
      • chrome.exe (PID: 1332)
      • chrome.exe (PID: 2980)
      • chrome.exe (PID: 3992)
      • chrome.exe (PID: 240)
      • chrome.exe (PID: 128)
      • chrome.exe (PID: 2584)
      • chrome.exe (PID: 1432)
      • chrome.exe (PID: 300)
      • chrome.exe (PID: 3172)
      • chrome.exe (PID: 2380)
      • chrome.exe (PID: 2780)
      • chrome.exe (PID: 2500)
      • chrome.exe (PID: 3120)
      • iexplore.exe (PID: 1272)
      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3688)
      • iexplore.exe (PID: 3532)
      • chrome.exe (PID: 304)
      • chrome.exe (PID: 2536)
      • chrome.exe (PID: 4092)
      • chrome.exe (PID: 2332)
      • chrome.exe (PID: 3288)
      • chrome.exe (PID: 2344)

    • Reads the computer name

      • chrome.exe (PID: 3972)
      • chrome.exe (PID: 1888)
      • chrome.exe (PID: 452)
      • chrome.exe (PID: 3884)
      • chrome.exe (PID: 3144)
      • chrome.exe (PID: 3484)
      • chrome.exe (PID: 3732)
      • chrome.exe (PID: 3816)
      • chrome.exe (PID: 1536)
      • chrome.exe (PID: 1780)
      • chrome.exe (PID: 300)
      • chrome.exe (PID: 3172)
      • chrome.exe (PID: 2780)
      • chrome.exe (PID: 2500)
      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 1272)
      • iexplore.exe (PID: 3688)
      • iexplore.exe (PID: 3532)

    • Reads the hosts file

      • chrome.exe (PID: 3972)
      • chrome.exe (PID: 452)

    • Application launched itself

      • chrome.exe (PID: 3972)
      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3688)

    • Reads settings of System Certificates

      • chrome.exe (PID: 452)
      • iexplore.exe (PID: 1272)
      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3532)
      • iexplore.exe (PID: 3688)
      • Setup.exe (PID: 2548)

    • Reads the date of Windows installation

      • chrome.exe (PID: 1536)
      • iexplore.exe (PID: 2176)

    • Checks Windows Trust Settings

      • chrome.exe (PID: 3972)
      • iexplore.exe (PID: 1272)
      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3532)
      • iexplore.exe (PID: 3688)
      • Setup.exe (PID: 2548)

    • Changes internet zones settings

      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3688)

    • Creates files in the user directory

      • iexplore.exe (PID: 1272)
      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3532)
      • iexplore.exe (PID: 3688)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1272)
      • iexplore.exe (PID: 3532)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3688)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2176)
      • iexplore.exe (PID: 3688)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3688)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3688)
      • SetupUtility.exe (PID: 3984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
124
Monitored processes
79
Malicious processes
5
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs omg.exe chrome.exe no specs cmd.exe no specs omg.exe no specs iexplore.exe iexplore.exe omg.exe cmd.exe no specs omg.exe no specs iexplore.exe iexplore.exe chrome.exe no specs chrome.exe no specs ndp48-web.exe no specs chrome.exe no specs ndp48-web.exe setup.exe chrome.exe setuputility.exe no specs chrome.exe no specs setuputility.exe no specs chrome.exe no specs tmp31d6.tmp.exe

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
240"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
300"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
304"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4396 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
420"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
452"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1276 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
464"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
1132TMP31D6.tmp.exe /Q /X:C:\08ae0f5cacad52afc4\TMP31D6.tmp.exe.tmpC:\08ae0f5cacad52afc4\TMP31D6.tmp.exe
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.8 Setup
Exit code:
0
Version:
4.8.03761.00
1272"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2176 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
1332"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1028,12818854655705898441,17777998216335483303,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5660 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
45
Suspicious files
85
Text files
317
Unknown types
29

Dropped files

PID
Process
Filename
Type
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62084558-F84.pma —
MD5:—
SHA256:—
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\b2d458fa-498f-4cf8-970a-4904c4e916b3.tmptext
MD5:—
SHA256:—
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferencestext
MD5:—
SHA256:—
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF193510.TMPtext
MD5:936EB7280DA791E6DD28EF3A9B46D39C
SHA256:CBAF2AFD831B32F6D1C12337EE5D2F090D6AE1F4DCB40B08BEF49BF52AD9721F
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old~RF19352f.TMPtext
MD5:81F483F77EE490F35306A4F94DB2286B
SHA256:82434CE3C9D13F509EBEEBE3A7A1A1DE9AB4557629D9FC855761E0CFA45E8BCE
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.oldtext
MD5:7721CDA9F5B73CE8A135471EB53B4E0E
SHA256:DD730C576766A46FFC84E682123248ECE1FF1887EC0ACAB22A5CE93A450F4500
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC
SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:8FF312A95D60ED89857FEB720D80D4E1
SHA256:946A57FAFDD28C3164D5AB8AB4971B21BD5EC5BFFF7554DBF832CB58CC37700B
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old~RF1935eb.TMPtext
MD5:B628564B8042F6E2CC2F53710AAECDC0
SHA256:1D3B022BDEE9F48D79E3EC1E93F519036003642D3D72D10B05CFD47F43EFBF13
3972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
74
TCP/UDP connections
233
DNS requests
162
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
452
chrome.exe
GET
301
142.250.184.206:80
http://translate.google.com/translate_a/element.js?cb=googFooterTranslate
US
—
—
whitelisted
452
chrome.exe
GET
200
104.17.166.186:80
http://6.adsco.re/
US
—
—
whitelisted
452
chrome.exe
GET
200
104.17.166.186:80
http://6.adsco.re/
US
—
—
whitelisted
452
chrome.exe
GET
—
104.16.203.237:80
http://www.mediafire.com/images/icons/svg_light/icons_sprite.svg
US
—
—
shared
452
chrome.exe
GET
200
162.252.214.5:80
http://4.adsco.re/
US
text
63 b
whitelisted
452
chrome.exe
GET
200
162.252.214.5:80
http://4.adsco.re/
US
text
63 b
whitelisted
452
chrome.exe
GET
200
104.16.203.237:80
http://www.mediafire.com/file/8knz86jx235p3jr/omg.exe/file
US
html
83.4 Kb
shared
452
chrome.exe
GET
200
104.16.203.237:80
http://www.mediafire.com/js/prebid5.17.0.js
US
text
78.0 Kb
shared
452
chrome.exe
GET
200
104.16.203.237:80
http://static.mediafire.com/images/backgrounds/download/dl_promo_logo.png
US
image
2.19 Kb
shared
452
chrome.exe
GET
200
104.17.166.186:80
http://c.adsco.re/
US
html
24.2 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
452
chrome.exe
142.250.185.166:443
ad.doubleclick.net
Google Inc.
US
unknown
452
chrome.exe
104.26.3.70:443
ad-delivery.net
Cloudflare Inc
US
suspicious
452
chrome.exe
216.58.212.174:443
www.google-analytics.com
Google Inc.
US
whitelisted
452
chrome.exe
142.250.181.234:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
452
chrome.exe
35.244.159.8:443
mediafire-d.openx.net
—
US
whitelisted
452
chrome.exe
142.250.186.174:443
clients2.google.com
Google Inc.
US
whitelisted
452
chrome.exe
104.16.203.237:80
www.mediafire.com
Cloudflare Inc
US
unknown
452
chrome.exe
104.26.6.139:443
btloader.com
Cloudflare Inc
US
suspicious
452
chrome.exe
52.222.206.214:443
cdn.amplitude.com
Amazon.com, Inc.
US
suspicious
452
chrome.exe
142.250.184.206:80
translate.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
accounts.google.com
  • 142.250.186.45
shared
www.mediafire.com
  • 104.16.203.237
  • 104.16.202.237
shared
clients2.google.com
  • 142.250.186.174
whitelisted
www.googletagmanager.com
  • 216.58.212.136
whitelisted
btloader.com
  • 104.26.6.139
  • 172.67.70.134
  • 104.26.7.139
whitelisted
translate.google.com
  • 142.250.184.206
whitelisted
securepubads.g.doubleclick.net
  • 142.250.185.226
whitelisted
fundingchoicesmessages.google.com
  • 142.250.184.206
whitelisted
cdn.amplitude.com
  • 52.222.206.214
  • 52.222.206.6
  • 52.222.206.178
  • 52.222.206.118
whitelisted
static.mediafire.com
  • 104.16.203.237
  • 104.16.202.237
shared

Threats

PID
Process
Class
Message
452
chrome.exe
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
452
chrome.exe
A Network Trojan was detected
ET POLICY Terse Named Filename EXE Download - Possibly Hostile
452
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
452
chrome.exe
Misc activity
ET INFO EXE - Served Attached HTTP
884
svchost.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
884
svchost.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.mediafire.com/file/8knz86jx235p3jr/omg.exe/file