Chrome – Utility: Network Service Copying data to 52.85.43.0/24

Written by paris on May 7, 2020. Posted in Research

A SIEM Alert noticed lots of traffic transferring from a computer to IP’s in this range 52.85.43.0/24 ( amazon cloudfront)

Tracing down the app on the computer using Netstat showed this was Chrome.exe

Tracing down the task manager inside of Chrome showed it was this process

Utility: Network Service Looks to be one of the process’ the chrome browser sends and receives network traffic through , But I can’t tell you exactly what , but it is needed !

GD Star Rating
loading...

GD Star Rating
loading...

Tags: 52.85.43.0/24, CHrome, Utility: Network Service

Trackback from your site.

Categories

Latest Comments

TheRealpvs thanks a mil for this
Convert Netgear WNDAP360 to standalone from Managed · October 6, 2020
Paris Wells I am copying both This line copies off.ini copy off.ini c:\Windows\System32\off.ini These lines copies BSPECIAL.DLL to two location copy BSPECIAL.DLL c:\Windows\System32\BSPECIAL.DLL copy...
Copy file to workstations with Windows Intune · September 9, 2020
CM Hi, thank you for the guide but I don't think I fully understand the process. Which file are you copying to the machines here? off.ini? BSPECIAL.DLL?
Copy file to workstations with Windows Intune · September 9, 2020
Paris Wells .exe on the end doesn't do anything , send the log file in the contact form https://pariswells.com/blog/contact
Copy file to workstations with Windows Intune · July 4, 2020
Kike Aramburu i ran the msiexec with the log option. Is there a way that I could get it to you? It is a very long one. Also, just for testing, I decided to run the a different command at the beginning,...
Copy file to workstations with Windows Intune · June 29, 2020

Comments Rating

Links