analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

binaries.7z

Full analysis: https://app.any.run/tasks/877cd101-61c6-4949-bb5e-316dc86a6c70
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: July 03, 2021, 22:51:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

CB33309B3C76278395422ACE5C1529DC

SHA1:

9C901F95A70ED67AC2C4BE781B3DD452758D1C47

SHA256:

8DE70EC83ECBA96CE98CE5DE65C64F7B2635C5C0F112D98A02BC25221ED46576

SSDEEP:

393216:8GG82WSlrJHKi3Pmq+9Dqhlc3VFXYLxYEQGFPx4DXDbT:Tboj3P69DyW7XcFWTbT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Everything-1.4.1.1009.x86-Setup.exe (PID: 2188)
      • Everything.exe (PID: 2820)
      • Everything.exe (PID: 2500)
      • Everything.exe (PID: 2748)
      • Everything.exe (PID: 4004)
      • Everything.exe (PID: 1936)
      • Everything.exe (PID: 2104)
      • amonl.exe (PID: 2040)
      • Adobe_Photoshop_CS_V8_by_ChLanKBooT.exe (PID: 3816)
      • codsp.exe (PID: 1368)
      • cr-nsg15.exe (PID: 3360)
      • cr-kawa3.exe (PID: 2568)
      • CR-MW356.EXE (PID: 3140)
      • cmdinfo.exe (PID: 2676)
      • crack(2).exe (PID: 3052)
      • Crack(1).exe (PID: 1768)
      • crack.exe (PID: 2372)
      • crack(3).exe (PID: 3068)
      • crack(4).exe (PID: 1000)
      • crack(4).exe (PID: 2660)
      • crk_ClaireU.exe (PID: 3112)
      • damn_raduga30.exe (PID: 2316)
      • fff-k530.exe (PID: 356)
      • ECLCA113.exe (PID: 2972)
      • crk_LeonU.exe (PID: 2092)
      • IDM.patch.exe (PID: 2500)
      • KanjiBrowze.exe (PID: 1964)
      • fff-o2k3.exe (PID: 3888)
      • IDM.patch.exe (PID: 2240)
      • kara-kg.exe (PID: 4076)
      • Kagayak_IV.exe (PID: 3012)
      • Karaoke_Dream_(v.1.34)_Keygen.Exe (PID: 3908)
      • keygen(2).exe (PID: 2980)
      • kassa.exe (PID: 3636)
      • Keygen.exe (PID: 3124)
      • Keygen(1).exe (PID: 3792)
      • keygen.exe (PID: 3256)
      • katarnkg.exe (PID: 2680)
      • KaZaAbannerKiller.exe (PID: 2976)
      • keygen.exe (PID: 2444)
      • KeyMaker.EXE (PID: 3404)
      • keymaker.exe (PID: 1020)
      • Loader.exe (PID: 2552)
      • NOD32-CRK.exe (PID: 2664)
      • NOD32.exe (PID: 3784)
      • patch.exe (PID: 2720)
      • Patch.exe (PID: 2924)
      • patch.exe (PID: 532)
      • nod32l.exe (PID: 3600)
      • Patch.exe (PID: 1312)
      • md5checker.exe (PID: 3932)
      • Patcher.exe (PID: 3436)
      • Patcher.exe (PID: 2776)
      • nod32ccl.exe (PID: 3092)
      • OS-Adobe_CS2_KeyGen_Tryout_to_Full.exe (PID: 4044)
      • ra_Kalenderv2.04r2b36patch.exe (PID: 3892)
      • RapidshareHacking.exe (PID: 2084)
      • ra_Kalenderv2.04r2b36patch.exe (PID: 2992)
      • Sims2.exe (PID: 3184)
      • start(1).exe (PID: 324)
      • start.exe (PID: 3856)
      • SwishMax.exe (PID: 3728)
      • Trainer.exe (PID: 3876)
      • tmgmw357.EXE (PID: 3000)
      • War3x-TFT-Kg.exe (PID: 2100)
      • WindowsXP Product Key Viewer.exe (PID: 2912)

    • Drops executable file immediately after starts

      • Everything-1.4.1.1009.x86-Setup.exe (PID: 2188)
      • Everything.exe (PID: 2500)
      • WinRAR.exe (PID: 3028)
      • fff-o2k3.exe (PID: 3888)
      • IDM.patch.exe (PID: 2500)
      • chrome.exe (PID: 2852)

    • Loads dropped or rewritten executable

      • Everything-1.4.1.1009.x86-Setup.exe (PID: 2188)
      • SearchProtocolHost.exe (PID: 2440)
      • cmdinfo.exe (PID: 2676)
      • IDM.patch.exe (PID: 2500)
      • fff-o2k3.exe (PID: 3888)
      • Patch.exe (PID: 1312)

    • Changes the autorun value in the registry

      • Everything.exe (PID: 2748)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2376)
      • Everything-1.4.1.1009.x86-Setup.exe (PID: 2188)
      • Everything.exe (PID: 2820)
      • Everything.exe (PID: 2748)
      • Everything.exe (PID: 2500)
      • Everything.exe (PID: 2104)
      • Everything.exe (PID: 1936)
      • Everything.exe (PID: 4004)
      • WinRAR.exe (PID: 3028)
      • Adobe_Photoshop_CS_V8_by_ChLanKBooT.exe (PID: 3816)
      • cr-nsg15.exe (PID: 3360)
      • amonl.exe (PID: 2040)
      • cmdinfo.exe (PID: 2676)
      • CR-MW356.EXE (PID: 3140)
      • crack(2).exe (PID: 3052)
      • cr-kawa3.exe (PID: 2568)
      • Crack(1).exe (PID: 1768)
      • crack(3).exe (PID: 3068)
      • crack(4).exe (PID: 2660)
      • crk_ClaireU.exe (PID: 3112)
      • ECLCA113.exe (PID: 2972)
      • damn_raduga30.exe (PID: 2316)
      • crk_LeonU.exe (PID: 2092)
      • crack.exe (PID: 2372)
      • fff-k530.exe (PID: 356)
      • fff-o2k3.exe (PID: 3888)
      • Kagayak_IV.exe (PID: 3012)
      • IDM.patch.exe (PID: 2500)
      • Keygen(1).exe (PID: 3792)
      • KaZaAbannerKiller.exe (PID: 2976)
      • keygen(2).exe (PID: 2980)
      • Karaoke_Dream_(v.1.34)_Keygen.Exe (PID: 3908)
      • katarnkg.exe (PID: 2680)
      • kara-kg.exe (PID: 4076)
      • keygen.exe (PID: 2444)
      • KanjiBrowze.exe (PID: 1964)
      • KeyMaker.EXE (PID: 3404)
      • kassa.exe (PID: 3636)
      • keygen.exe (PID: 3256)
      • Keygen.exe (PID: 3124)
      • Loader.exe (PID: 2552)
      • nod32l.exe (PID: 3600)
      • keymaker.exe (PID: 1020)
      • OS-Adobe_CS2_KeyGen_Tryout_to_Full.exe (PID: 4044)
      • md5checker.exe (PID: 3932)
      • patch.exe (PID: 532)
      • NOD32-CRK.exe (PID: 2664)
      • NOD32.exe (PID: 3784)
      • nod32ccl.exe (PID: 3092)
      • Patch.exe (PID: 1312)
      • Patcher.exe (PID: 3436)
      • ra_Kalenderv2.04r2b36patch.exe (PID: 3892)
      • start(1).exe (PID: 324)
      • RapidshareHacking.exe (PID: 2084)
      • start.exe (PID: 3856)
      • tmgmw357.EXE (PID: 3000)
      • Trainer.exe (PID: 3876)
      • War3x-TFT-Kg.exe (PID: 2100)
      • WindowsXP Product Key Viewer.exe (PID: 2912)

    • Reads the computer name

      • WinRAR.exe (PID: 2376)
      • Everything-1.4.1.1009.x86-Setup.exe (PID: 2188)
      • Everything.exe (PID: 2820)
      • Everything.exe (PID: 2500)
      • Everything.exe (PID: 4004)
      • Everything.exe (PID: 1936)
      • Everything.exe (PID: 2748)
      • Everything.exe (PID: 2104)
      • WinRAR.exe (PID: 3028)
      • cmdinfo.exe (PID: 2676)
      • crack(4).exe (PID: 2660)
      • fff-o2k3.exe (PID: 3888)
      • IDM.patch.exe (PID: 2500)
      • keygen.exe (PID: 3256)
      • Patch.exe (PID: 1312)
      • start.exe (PID: 3856)
      • Crack(1).exe (PID: 1768)
      • ECLCA113.exe (PID: 2972)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 2216)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2216)
      • chrome.exe (PID: 2608)
      • Everything-1.4.1.1009.x86-Setup.exe (PID: 2188)
      • Everything.exe (PID: 2500)
      • WinRAR.exe (PID: 3028)
      • fff-o2k3.exe (PID: 3888)
      • IDM.patch.exe (PID: 2500)
      • chrome.exe (PID: 2852)

    • Application launched itself

      • Everything.exe (PID: 2820)

    • Creates files in the program directory

      • Everything.exe (PID: 2748)
      • Everything.exe (PID: 2500)

    • Creates a software uninstall entry

      • Everything.exe (PID: 2500)

    • Creates a directory in Program Files

      • Everything.exe (PID: 2500)

    • Starts itself from another location

      • Everything.exe (PID: 2500)

    • Executed as Windows Service

      • Everything.exe (PID: 4004)

    • Creates files in the user directory

      • Everything.exe (PID: 2104)

    • Changes default file association

      • Everything.exe (PID: 2748)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 3028)
      • chrome.exe (PID: 2852)

    • Creates files like Ransomware instruction

      • WinRAR.exe (PID: 3028)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3028)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 3028)
      • IDM.patch.exe (PID: 2500)
      • fff-o2k3.exe (PID: 3888)

    • Reads Windows owner or organization settings

      • cmdinfo.exe (PID: 2676)
      • keygen.exe (PID: 3256)

    • Reads Environment values

      • cmdinfo.exe (PID: 2676)

    • Reads the Windows organization settings

      • cmdinfo.exe (PID: 2676)

    • Executes application which crashes

      • Everything.exe (PID: 1936)

    • Creates files in the Windows directory

      • IDM.patch.exe (PID: 2500)

  • INFO

    • Checks supported languages

      • chrome.exe (PID: 2608)
      • chrome.exe (PID: 2216)
      • chrome.exe (PID: 2500)
      • chrome.exe (PID: 1332)
      • chrome.exe (PID: 432)
      • chrome.exe (PID: 3556)
      • chrome.exe (PID: 2224)
      • chrome.exe (PID: 3488)
      • chrome.exe (PID: 3644)
      • chrome.exe (PID: 1248)
      • chrome.exe (PID: 2820)
      • chrome.exe (PID: 2156)
      • chrome.exe (PID: 3124)
      • chrome.exe (PID: 440)
      • chrome.exe (PID: 2492)
      • chrome.exe (PID: 2052)
      • chrome.exe (PID: 2436)
      • chrome.exe (PID: 1952)
      • chrome.exe (PID: 1744)
      • chrome.exe (PID: 2600)
      • chrome.exe (PID: 3900)
      • chrome.exe (PID: 2700)
      • chrome.exe (PID: 2044)
      • chrome.exe (PID: 3312)
      • chrome.exe (PID: 3248)
      • chrome.exe (PID: 1464)
      • chrome.exe (PID: 3216)
      • chrome.exe (PID: 3028)
      • chrome.exe (PID: 1268)
      • chrome.exe (PID: 3588)
      • chrome.exe (PID: 3052)
      • chrome.exe (PID: 4048)
      • chrome.exe (PID: 1756)
      • chrome.exe (PID: 2924)
      • chrome.exe (PID: 2384)
      • chrome.exe (PID: 592)
      • chrome.exe (PID: 2712)
      • chrome.exe (PID: 1952)
      • chrome.exe (PID: 2716)
      • chrome.exe (PID: 3996)
      • chrome.exe (PID: 2296)
      • chrome.exe (PID: 3600)
      • chrome.exe (PID: 3280)
      • chrome.exe (PID: 2096)
      • chrome.exe (PID: 3248)
      • ntvdm.exe (PID: 2864)
      • ntvdm.exe (PID: 3424)
      • chrome.exe (PID: 3280)
      • pcaui.exe (PID: 3316)
      • chrome.exe (PID: 3488)
      • chrome.exe (PID: 1444)
      • chrome.exe (PID: 2968)
      • chrome.exe (PID: 2292)
      • chrome.exe (PID: 2852)
      • Explorer.exe (PID: 1836)
      • chrome.exe (PID: 3440)
      • chrome.exe (PID: 1168)
      • chrome.exe (PID: 3828)
      • chrome.exe (PID: 3580)
      • chrome.exe (PID: 3636)

    • Reads the computer name

      • chrome.exe (PID: 2216)
      • chrome.exe (PID: 2500)
      • chrome.exe (PID: 1248)
      • chrome.exe (PID: 2608)
      • chrome.exe (PID: 3052)
      • chrome.exe (PID: 2712)
      • chrome.exe (PID: 3600)
      • chrome.exe (PID: 2096)
      • chrome.exe (PID: 3280)
      • pcaui.exe (PID: 3316)
      • Explorer.exe (PID: 1836)

    • Manual execution by user

      • chrome.exe (PID: 2216)
      • WinRAR.exe (PID: 3028)

    • Reads the hosts file

      • chrome.exe (PID: 2216)
      • chrome.exe (PID: 2608)

    • Application launched itself

      • chrome.exe (PID: 2216)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2608)
      • chrome.exe (PID: 2216)

    • Checks Windows Trust Settings

      • chrome.exe (PID: 2216)

    • Reads the date of Windows installation

      • chrome.exe (PID: 3280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
187
Monitored processes
129
Malicious processes
33
Suspicious processes
13

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs everything-1.4.1.1009.x86-setup.exe everything.exe no specs everything.exe everything.exe everything.exe no specs everything.exe no specs everything.exe no specs chrome.exe no specs winrar.exe chrome.exe no specs searchprotocolhost.exe no specs chrome.exe no specs chrome.exe no specs adobe_photoshop_cs_v8_by_chlankboot.exe no specs amonl.exe no specs cmdinfo.exe no specs codsp.exe no specs cr-kawa3.exe no specs cr-mw356.exe no specs cr-nsg15.exe no specs crack(1).exe no specs crack(2).exe no specs crack(3).exe crack(4).exe no specs crack(4).exe ntvdm.exe no specs crack.exe no specs crk_claireu.exe no specs crk_leonu.exe no specs ntvdm.exe no specs damn_raduga30.exe no specs eclca113.exe no specs fff-k530.exe no specs fff-o2k3.exe idm.patch.exe no specs idm.patch.exe kagayak_iv.exe no specs kanjibrowze.exe no specs kara-kg.exe no specs karaoke_dream_(v.1.34)_keygen.exe no specs kassa.exe no specs katarnkg.exe no specs kazaabannerkiller.exe no specs keygen(1).exe no specs keygen(2).exe no specs keygen.exe no specs keygen.exe no specs keygen.exe no specs keymaker.exe no specs keymaker.exe no specs loader.exe no specs md5checker.exe no specs nod32-crk.exe no specs nod32.exe no specs nod32ccl.exe no specs nod32l.exe no specs os-adobe_cs2_keygen_tryout_to_full.exe no specs patch.exe no specs patch.exe patch.exe no specs chrome.exe no specs patch.exe patcher.exe no specs patcher.exe ra_kalenderv2.04r2b36patch.exe no specs ra_kalenderv2.04r2b36patch.exe rapidsharehacking.exe no specs sims2.exe no specs pcaui.exe no specs start(1).exe no specs start.exe no specs swishmax.exe no specs tmgmw357.exe no specs trainer.exe no specs war3x-tft-kg.exe no specs windowsxp product key viewer.exe no specs chrome.exe no specs chrome.exe no specs explorer.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2376"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\binaries.7z"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2216"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
1332"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6e51d988,0x6e51d998,0x6e51d9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2500"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1056,18386185435858157118,16887273117254116954,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1048 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2608"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1056,18386185435858157118,16887273117254116954,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1300 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3556"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,18386185435858157118,16887273117254116954,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1904 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
432"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,18386185435858157118,16887273117254116954,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1908 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3644"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,18386185435858157118,16887273117254116954,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
1248"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1056,18386185435858157118,16887273117254116954,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1052 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3488"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,18386185435858157118,16887273117254116954,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
25 427
Read events
25 146
Write events
273
Delete events
8

Modification events

(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2376) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2376) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\binaries.7z
(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
71
Suspicious files
171
Text files
374
Unknown types
30

Dropped files

PID
Process
Filename
Type
2376WinRAR.exeC:\Users\admin\Desktop\Eset_NOD32_Antivirus_Administrator_Edition_v2.50.16_PROPER_READ_NFO_REPACK_by_DVT.zipcompressed
MD5:78DC2863B8D2672472EF6F32B5C50CD2
SHA256:5CE113C90DB5DEDF18F98E775E251BEA0FB41196FA41686606EE8EF18B98D1CF
2376WinRAR.exeC:\Users\admin\Desktop\e-kd1301.zipcompressed
MD5:A2CB04D28649568990A1EDA4BEAFDC15
SHA256:E83150B52B4C3A161C73F429A4654F2DAAD54A9E6CBD08F3970F2CF66411A58C
2376WinRAR.exeC:\Users\admin\Desktop\AVS_Video_Converter_v2.4.1.94.zipcompressed
MD5:9CF9CBAC9D38CD124FF9B6B5D4A1D0A8
SHA256:2ADE117C44B3677BFFA65CE3FA9C4E61574F31560FFB7BFD0266F84E28FC33E3
2376WinRAR.exeC:\Users\admin\Desktop\Colin_McRae_Rally_2005_Crash_Fix_by_IND.zipcompressed
MD5:F2C08121ADF2FD0E6CA12EC38EA4202B
SHA256:608E874B443B2E618BDD26ED642C2C41A8CA06DD5701CD537119B3C4E0FBABDF
2376WinRAR.exeC:\Users\admin\Desktop\CR-NSG15.ZIPcompressed
MD5:E04666CD0F842C65AC7966692F8436C2
SHA256:140A2C0D2BAC8750FEB6C2F96A67935E37EF79A91D9765FF338931938984FD43
2376WinRAR.exeC:\Users\admin\Desktop\DBC_Kali_II_For_Windows_9598NT_Serial.zipcompressed
MD5:319A703CB75A857A493097782D2FD9BC
SHA256:12FD25D93B51D655866FBC03D7D32CFFD89D00133C4C79EB1CB269D579B65397
2376WinRAR.exeC:\Users\admin\Desktop\DBC_Resident_Evil_2_v1.04_Patch.zipcompressed
MD5:319AB81C1498670C20F7FB659AC7DC69
SHA256:404E3F1AB6DF18CFFB8DB5A21A77FF532AEB081F69DDC5615F0F81FA1CC7DB04
2376WinRAR.exeC:\Users\admin\Desktop\GameHouse_Zuma_Deluxe_v1.0.0.1_Trainer_by_FFF.zipcompressed
MD5:FBCE56FEC5EF1FDF1A3BA5CF1985504F
SHA256:FF208989BBEC0F4C685ACEEF446AE727778DB0CCF9D506D51C2EB2C5A9D688CC
2376WinRAR.exeC:\Users\admin\Desktop\i-katc31.zipcompressed
MD5:71039409FCDA489C51B22C80D931E671
SHA256:0D0A3CBB70B9BAEF6EC62FAB5222C6AC120A866DB429118030DA0EF170A367A4
2376WinRAR.exeC:\Users\admin\Desktop\cr-kawa3.zipcompressed
MD5:9DCCFDF05D1DC3AB3AC254334EC96E9F
SHA256:0D6D28087425020ED1CA1CFE6AD1A44EC93F61418C2C75232B4E19C3A1AF4DC7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
73
TCP/UDP connections
47
DNS requests
38
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1796
svchost.exe
HEAD
403
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AIQWwBRSWwfx2JCxD0aw30k_2657/I-4-aBwqaCFG5rMUT0QDpg
US
—
—
whitelisted
1796
svchost.exe
HEAD
200
173.194.137.74:80
http://r5---sn-aigzrn76.gvt1.com/edgedl/release2/chrome_component/AIQWwBRSWwfx2JCxD0aw30k_2657/I-4-aBwqaCFG5rMUT0QDpg?cms_redirect=yes&mh=o2&mip=85.203.34.115&mm=28&mn=sn-aigzrn76&ms=nvh&mt=1625352354&mv=u&mvi=5&pl=24&rmhost=r1---sn-aigzrn76.gvt1.com&shardbypass=yes&smhost=r1---sn-aigzrn7l.gvt1.com
US
—
—
whitelisted
2608
chrome.exe
GET
302
142.250.185.110:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
556 b
whitelisted
1796
svchost.exe
GET
206
173.194.137.74:80
http://r5---sn-aigzrn76.gvt1.com/edgedl/release2/chrome_component/AIQWwBRSWwfx2JCxD0aw30k_2657/I-4-aBwqaCFG5rMUT0QDpg?cms_redirect=yes&mh=o2&mip=85.203.34.115&mm=28&mn=sn-aigzrn76&ms=nvh&mt=1625352354&mv=u&mvi=5&pl=24&rmhost=r1---sn-aigzrn76.gvt1.com&shardbypass=yes&smhost=r1---sn-aigzrn7l.gvt1.com
US
binary
9.62 Kb
whitelisted
1796
svchost.exe
GET
206
173.194.137.74:80
http://r5---sn-aigzrn76.gvt1.com/edgedl/release2/chrome_component/AIQWwBRSWwfx2JCxD0aw30k_2657/I-4-aBwqaCFG5rMUT0QDpg?cms_redirect=yes&mh=o2&mip=85.203.34.115&mm=28&mn=sn-aigzrn76&ms=nvh&mt=1625352354&mv=u&mvi=5&pl=24&rmhost=r1---sn-aigzrn76.gvt1.com&shardbypass=yes&smhost=r1---sn-aigzrn7l.gvt1.com
US
binary
5.77 Kb
whitelisted
1796
svchost.exe
HEAD
403
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AIDSJGrIAR_6GKekQJvhOSI_1.3.36.81/FlU1w6tFdzzsxVNvvqMiCQ
US
—
—
whitelisted
1796
svchost.exe
HEAD
200
173.194.183.102:80
http://r1---sn-aigl6nek.gvt1.com/edgedl/release2/chrome_component/AIDSJGrIAR_6GKekQJvhOSI_1.3.36.81/FlU1w6tFdzzsxVNvvqMiCQ?cms_redirect=yes&mh=Pe&mip=85.203.34.115&mm=28&mn=sn-aigl6nek&ms=nvh&mt=1625352354&mv=u&mvi=1&pl=24&shardbypass=yes
US
—
—
whitelisted
1796
svchost.exe
HEAD
302
142.250.185.110:80
http://redirector.gvt1.com/edgedl/release2/chrome_component/AIQWwBRSWwfx2JCxD0aw30k_2657/I-4-aBwqaCFG5rMUT0QDpg
US
—
—
whitelisted
2608
chrome.exe
GET
200
173.194.5.169:80
http://r3---sn-aigl6n7s.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx?cms_redirect=yes&mh=e_&mip=85.203.34.115&mm=28&mn=sn-aigl6n7s&ms=nvh&mt=1625352354&mv=u&mvi=3&pl=24&shardbypass=yes&smhost=r3---sn-aigl6n7d.gvt1.com
US
crx
242 Kb
whitelisted
1796
svchost.exe
GET
302
142.250.185.110:80
http://redirector.gvt1.com/edgedl/release2/chrome_component/AIDSJGrIAR_6GKekQJvhOSI_1.3.36.81/FlU1w6tFdzzsxVNvvqMiCQ
US
html
475 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2608
chrome.exe
142.250.186.42:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2608
chrome.exe
172.217.18.99:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2608
chrome.exe
142.250.185.99:443
update.googleapis.com
Google Inc.
US
whitelisted
2608
chrome.exe
142.250.184.238:443
clients2.google.com
Google Inc.
US
whitelisted
2608
chrome.exe
142.250.186.100:443
www.google.com
Google Inc.
US
whitelisted
2608
chrome.exe
142.250.185.195:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2608
chrome.exe
142.250.186.110:443
encrypted-tbn0.gstatic.com
Google Inc.
US
whitelisted
2608
chrome.exe
142.250.186.46:443
apis.google.com
Google Inc.
US
whitelisted
2608
chrome.exe
142.250.185.97:443
lh5.googleusercontent.com
Google Inc.
US
whitelisted
2608
chrome.exe
34.104.35.123:80
edgedl.me.gvt1.com
—
US
whitelisted

DNS requests

Domain
IP
Reputation
clients2.google.com
  • 142.250.184.238
whitelisted
accounts.google.com
  • 142.250.185.141
shared
clientservices.googleapis.com
  • 142.250.185.195
whitelisted
www.google.com
  • 142.250.186.100
whitelisted
fonts.googleapis.com
  • 142.250.186.42
whitelisted
www.gstatic.com
  • 142.250.186.163
whitelisted
fonts.gstatic.com
  • 172.217.18.99
whitelisted
encrypted-tbn0.gstatic.com
  • 142.250.186.110
whitelisted
apis.google.com
  • 142.250.186.46
whitelisted
ogs.google.com
  • 216.58.212.174
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
binaries.7z