Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | April 1, 2021, 9:18 a.m. | April 1, 2021, 9:35 a.m. |
-
-
-
taskkill.exe taskkill /f /im chrome.exe
5656
-
-
xcopy.exe xcopy "C:\Users\test22\AppData\Local\Google\Chrome\User Data" "C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
8548 -
chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\test22\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
2120-
chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xb8,0xbc,0xc0,0x8c,0xc4,0x7fef2d96e00,0x7fef2d96e10,0x7fef2d96e20
3360
-
-
Name | Response | Post-Analysis Lookup |
---|---|---|
www.fjzbqb.com | 188.225.87.175 | |
www.fddnice.pw | 103.155.92.58 | |
iplogger.org | 88.99.66.31 | |
www.cncode.pw | 144.202.76.47 |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
pdb_path | F:\facebook_svn\trunk\database\Release\DiskScan.pdb |
file | C:\Program Files (x86)\Google\Chrome\Application\86.0.4240.111\Locales |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome |
section | .zzdsgsa |
resource name | ZIP |
suspicious_features | POST method with no referer header | suspicious_request | POST http://www.fjzbqb.com/Home/Index/lkdinl |
request | GET http://www.cncode.pw/ |
request | GET http://www.fddnice.pw/ |
request | POST http://www.fjzbqb.com/Home/Index/lkdinl |
request | GET https://iplogger.org/1Pdet7 |
request | POST http://www.fjzbqb.com/Home/Index/lkdinl |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\UrlSoceng.store |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\manifest.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.19.0_0\_locales\pt_PT\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\LOG |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\a4b90990b418581487bb13a2cc67700a3c359804f91bdfb8e377cd0ec80ddc10.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\fil |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\_locales\de |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\fil |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.18.0\_metadata\verified_contents.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.google.com_0.indexeddb.leveldb\LOG.old |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\fil\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\c652a0ec48ceb3fcab170992c43a87413309e80065a26252401ba3362a17c565.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\fi\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\x86_64\pnacl_public_pnacl_json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsRecentClosed\2ddb697a-187a-48b1-a298-fa511059acaa.tmp |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.ldb |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\es_419\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\5ea773f9df56c0e7b536487dd049e0327a919a0c84a112128418759681714558.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\_locales\el\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOCK |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\_locales\ja |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.18.0\manifest.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOCK |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\_locales\fil |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\no |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\it\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ca |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ca |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\_locales\el\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\tr\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\86db32f4-11be-40e4-83e8-b602b85321c3\a461a5be400b28fc_0 |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\cs |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\cs |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\pt_PT\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ru |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_metadata\computed_hashes.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\english_wikipedia.txt |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.19.0_0\_locales\en_GB |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\_metadata\computed_hashes.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.19.0_0\_locales\gu\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\_locales\da |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\86.247.200\em004_64.dll |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.19.0_0\_locales\fr |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\pt_PT |
name | ZIP | language | LANG_CHINESE | filetype | Zip archive data, at least v1.0 to extract | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x00154b50 | size | 0x000108f5 | ||||||||||||||||||
name | RT_ICON | language | LANG_CHINESE | filetype | dBase III DBT, version number 0, next free block index 40 | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x00144180 | size | 0x00010828 | ||||||||||||||||||
name | RT_GROUP_ICON | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x001549a8 | size | 0x00000014 | ||||||||||||||||||
name | RT_VERSION | language | LANG_CHINESE | filetype | PGP symmetric key encrypted data - Plaintext or unencrypted data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x001549c0 | size | 0x0000018c |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\software_reporter_tool.exe |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\jquery-3.3.1.min.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.19.0_0\page_embed_script.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\main.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\mirroring_cast_streaming.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\mirroring_hangouts.js |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\mode-ecb.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\em001_64.dll |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\jquery-3.3.1.min.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\background_script.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\em003_64.dll |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\feedback_script.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\main.js |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\content.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\recovery\101.3.34.11\ChromeRecovery.exe |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\mode-ecb.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\aes.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\pad-nopadding.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\PepperFlash\32.0.0.445\pepflashplayer.dll |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\craw_window.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\angular.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\em000_64.dll |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\pad-nopadding.js |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\background.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\common.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\background.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\mirroring_webrtc.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\em005_64.dll |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\edls_64.dll |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\mirroring_common.js |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\aes.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\content.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\craw_background.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\cast_sender.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.19.0_0\eventpage_bin_prod.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\main.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\em002_64.dll |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\em004_64.dll |
cmdline | cmd.exe /c taskkill /f /im chrome.exe |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\recovery\101.3.34.11\ChromeRecovery.exe |
wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe") |
cmdline | taskkill /f /im chrome.exe |
cmdline | cmd.exe /c taskkill /f /im chrome.exe |
host | 172.217.25.14 | |||
host | 59.18.44.14 |
parent_process | chrome.exe | martian_process | "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1032,15067711088465271947,3312906077643457401,131072 --user-data-dir="C:\Users\test22\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1052 /prefetch:2 | ||||||
parent_process | chrome.exe | martian_process | "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xb8,0xbc,0xc0,0x8c,0xc4,0x7fef2d96e00,0x7fef2d96e10,0x7fef2d96e20 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extension Rules\000003.log |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Safe Browsing\UrlCsdWhitelist.store |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\GrShaderCache\GPUCache\data_1 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Cache\data_2 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\68e04385ceb6b243_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Cache\f_000008 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\shared_proto_db\metadata\000003.log |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\86db32f4-11be-40e4-83e8-b602b85321c3\c3d5cfb6a1cf033d_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\GrShaderCache\GPUCache\index |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Local Storage\leveldb\000003.ldb |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Subresource Filter\Indexed Rules\27\9.18.0\Ruleset Data |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SafetyTips\2496\safety_tips.pb |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\769de8625d12ef97_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\TLSDeprecationConfig\3\tls_deprecation_config.pb |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\86db32f4-11be-40e4-83e8-b602b85321c3\3fa8afa46bc28533_1 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\c5b4e0167b0e167e_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\IndexedDB\https_www.google.com_0.indexeddb.leveldb\MANIFEST-000001 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\data_2 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\ee1fd96d3c7a6bbf_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Sessions\Tabs_13248788850182410 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Module Info Cache |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\FontLookupTableCache\font_unique_name_table.pb |
file | c:\users\test22\appdata\local\temp\cghjgasaaz99\crashpadmetrics.pma |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\index |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\ShaderCache\GPUCache\data_1 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\3f5c8c831020c0ab_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\7b942c6b7304d5b2_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Cache\f_00000b |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\PnaclTranslationCache\index |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\ScriptCache\653e56b4b6556a9e_1 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\index.txt |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\data_3 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\BrowserMetrics\BrowserMetrics-5F9FEA6D-37C.pma |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Sync Data\LevelDB\000003.log |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Sessions\Session_13248789357672558 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\ScriptCache\653e56b4b6556a9e_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\History Provider Cache |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Session Storage\000003.log |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Site Characteristics Database\000003.log |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\ThirdPartyModuleList64\2018.8.8.0\module_list_proto |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Local Storage\leveldb\000010.log |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\86db32f4-11be-40e4-83e8-b602b85321c3\f91ed68f38846db8_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Safe Browsing\UrlSubresourceFilter.store |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\5991f2397acd26b1_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Safe Browsing\UrlMalBin.store |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Safe Browsing\CertCsdDownloadWhitelist.store |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\bfdbf1921d846a2f_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Translate Ranker Model |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Cache\f_000002 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\Database\000003.log |
Bkav | W32.AIDetect.malware2 |
Elastic | malicious (high confidence) |
MicroWorld-eScan | Gen:Variant.Zusy.371633 |
CAT-QuickHeal | Trojan.DisbukRI.S19305183 |
ALYac | Gen:Variant.Zusy.371633 |
Sangfor | Trojan.Win32.Save.a |
BitDefender | Gen:Variant.Zusy.371633 |
CrowdStrike | win/malicious_confidence_60% (D) |
BitDefenderTheta | Gen:NN.ZexaF.34662.y10@aqLIfbdj |
Cyren | W32/Socelars.G.gen!Eldorado |
Symantec | ML.Attribute.HighConfidence |
ESET-NOD32 | a variant of Win32/Spy.Socelars.S |
APEX | Malicious |
ClamAV | Win.Malware.Razy-9789744-0 |
Kaspersky | HEUR:Trojan-PSW.Win32.Disbuk.gen |
Avast | Win32:PWSX-gen [Trj] |
Rising | Malware.Heuristic!ET#88% (RDMK:cmRtazoti8TH9iH11nyg+1Cfh2dq) |
Ad-Aware | Gen:Variant.Zusy.371633 |
Emsisoft | Trojan-Spy.Socelars (A) |
F-Secure | Heuristic.HEUR/AGEN.1124060 |
DrWeb | Trojan.Siggen12.40103 |
McAfee-GW-Edition | BehavesLike.Win32.Emotet.th |
FireEye | Generic.mg.5daa2140732ce865 |
Sophos | Generic ML PUA (PUA) |
Ikarus | Trojan-Spy.Agent |
Avira | HEUR/AGEN.1124060 |
Microsoft | Trojan:Win32/Glupteba!ml |
ZoneAlarm | HEUR:Trojan-PSW.Win32.Disbuk.gen |
GData | Gen:Variant.Zusy.371633 |
Cynet | Malicious (score: 100) |
AhnLab-V3 | Trojan/Win32.Disbuk.R372531 |
McAfee | GenericRXLT-RQ!5DAA2140732C |
MAX | malware (ai score=82) |
VBA32 | BScope.Trojan.Agentb |
Malwarebytes | Glupteba.Backdoor.Bruteforce.DDS |
SentinelOne | Static AI - Suspicious PE |
Fortinet | W32/Socelars.S!tr.spy |
AVG | Win32:PWSX-gen [Trj] |
Cybereason | malicious.0732ce |
Panda | Trj/Genetic.gen |
Qihoo-360 | HEUR/QVM20.1.4587.Malware.Gen |