Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | April 23, 2021, 10:04 a.m. | April 23, 2021, 10:07 a.m. |
-
-
-
taskkill.exe taskkill /f /im chrome.exe
4232
-
-
xcopy.exe xcopy "C:\Users\test22\AppData\Local\Google\Chrome\User Data" "C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
4980 -
chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\test22\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
7664-
chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xb8,0xbc,0xc0,0x8c,0xc4,0x7fef2d96e00,0x7fef2d96e10,0x7fef2d96e20
7772
-
-
Name | Response | Post-Analysis Lookup |
---|---|---|
www.kenuot.com | 188.225.87.175 | |
www.fddnice.pw | 103.155.92.58 | |
iplogger.org | 88.99.66.31 | |
www.cncode.pw | 144.202.76.47 |
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
UDP 192.168.56.102:57660 -> 164.124.101.2:53 | 2016778 | ET DNS Query to a *.pw domain - Likely Hostile | Potentially Bad Traffic |
UDP 192.168.56.102:50839 -> 164.124.101.2:53 | 2016778 | ET DNS Query to a *.pw domain - Likely Hostile | Potentially Bad Traffic |
TCP 192.168.56.102:49806 -> 88.99.66.31:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 192.168.56.102:49805 -> 144.202.76.47:80 | 2016777 | ET INFO HTTP Request to a *.pw domain | Potentially Bad Traffic |
TCP 192.168.56.102:49815 -> 103.155.92.58:80 | 2016777 | ET INFO HTTP Request to a *.pw domain | Potentially Bad Traffic |
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.102:49806 88.99.66.31:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA | CN=*.iplogger.org | 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
pdb_path | F:\facebook_svn\trunk\database\Release\DiskScan.pdb |
file | C:\Program Files (x86)\Google\Chrome\Application\86.0.4240.111\Locales |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome |
section | .fcdddas |
resource name | ZIP |
suspicious_features | POST method with no referer header | suspicious_request | POST http://www.kenuot.com/Home/Index/lkdinl |
request | GET http://www.cncode.pw/ |
request | GET http://www.fddnice.pw/ |
request | POST http://www.kenuot.com/Home/Index/lkdinl |
request | GET https://iplogger.org/1s4qp7 |
request | POST http://www.kenuot.com/Home/Index/lkdinl |
domain | www.fddnice.pw | description | Palau domain TLD | ||||||
domain | www.cncode.pw | description | Palau domain TLD |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\UrlSoceng.store |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\manifest.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.19.0_0\_locales\pt_PT\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\LOG |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\a4b90990b418581487bb13a2cc67700a3c359804f91bdfb8e377cd0ec80ddc10.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\fil |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\_locales\de |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\fil |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.18.0\_metadata\verified_contents.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.google.com_0.indexeddb.leveldb\LOG.old |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\fil\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\c652a0ec48ceb3fcab170992c43a87413309e80065a26252401ba3362a17c565.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\fi\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\x86_64\pnacl_public_pnacl_json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsRecentClosed\2ddb697a-187a-48b1-a298-fa511059acaa.tmp |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.ldb |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\es_419\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\5ea773f9df56c0e7b536487dd049e0327a919a0c84a112128418759681714558.sth |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\_locales\el\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOCK |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\_locales\ja |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.18.0\manifest.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOCK |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\_locales\fil |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\no |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\it\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ca |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ca |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\_locales\el\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\tr\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\86db32f4-11be-40e4-83e8-b602b85321c3\a461a5be400b28fc_0 |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\cs |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\cs |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\pt_PT\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ru |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_metadata\computed_hashes.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\english_wikipedia.txt |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.19.0_0\_locales\en_GB |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\_metadata\computed_hashes.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.19.0_0\_locales\gu\messages.json |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\_locales\da |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\86.247.200\em004_64.dll |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.19.0_0\_locales\fr |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\pt_PT |
name | ZIP | language | LANG_CHINESE | filetype | Zip archive data, at least v1.0 to extract | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x00148550 | size | 0x000108f5 | ||||||||||||||||||
name | RT_ICON | language | LANG_CHINESE | filetype | dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0 | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x00144180 | size | 0x00004228 | ||||||||||||||||||
name | RT_GROUP_ICON | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x001483a8 | size | 0x00000014 | ||||||||||||||||||
name | RT_VERSION | language | LANG_CHINESE | filetype | PGP symmetric key encrypted data - Plaintext or unencrypted data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x001483c0 | size | 0x0000018c |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\software_reporter_tool.exe |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\jquery-3.3.1.min.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.19.0_0\page_embed_script.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\main.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\mirroring_cast_streaming.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\mirroring_hangouts.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\craw_background.js |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\mode-ecb.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\em001_64.dll |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\jquery-3.3.1.min.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\background_script.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\em003_64.dll |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\main.js |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\content.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\recovery\101.3.34.11\ChromeRecovery.exe |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\mode-ecb.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\aes.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\pad-nopadding.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\PepperFlash\32.0.0.445\pepflashplayer.dll |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\craw_window.js |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\background.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\em000_64.dll |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\pad-nopadding.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\angular.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\common.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\background.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\mirroring_webrtc.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\em005_64.dll |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\edls_64.dll |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\mirroring_common.js |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\aes.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\content.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\em004_64.dll |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\cast_sender.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\feedback_script.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\main.js |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SwReporter\86.247.200\em002_64.dll |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.19.0_0\eventpage_bin_prod.js |
cmdline | cmd.exe /c taskkill /f /im chrome.exe |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\recovery\101.3.34.11\ChromeRecovery.exe |
wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe") |
section | {u'size_of_data': u'0x00015000', u'virtual_address': u'0x00144000', u'entropy': 7.453194181270882, u'name': u'.rsrc', u'virtual_size': u'0x00014fc8'} | entropy | 7.45319418127 | description | A section with a high entropy has been found |
cmdline | taskkill /f /im chrome.exe |
cmdline | cmd.exe /c taskkill /f /im chrome.exe |
host | 172.217.25.14 |
parent_process | chrome.exe | martian_process | "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1056,6265859833129753803,8415791318332031504,131072 --user-data-dir="C:\Users\test22\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1072 /prefetch:2 | ||||||
parent_process | chrome.exe | martian_process | "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xb8,0xbc,0xc0,0x8c,0xc4,0x7fef2d96e00,0x7fef2d96e10,0x7fef2d96e20 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extension Rules\000003.log |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Safe Browsing\UrlCsdWhitelist.store |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\GrShaderCache\GPUCache\data_1 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Cache\data_2 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\68e04385ceb6b243_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Cache\f_000008 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\shared_proto_db\metadata\000003.log |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\86db32f4-11be-40e4-83e8-b602b85321c3\c3d5cfb6a1cf033d_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\GrShaderCache\GPUCache\index |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Local Storage\leveldb\000003.ldb |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Subresource Filter\Indexed Rules\27\9.18.0\Ruleset Data |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\SafetyTips\2496\safety_tips.pb |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\769de8625d12ef97_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\TLSDeprecationConfig\3\tls_deprecation_config.pb |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\86db32f4-11be-40e4-83e8-b602b85321c3\3fa8afa46bc28533_1 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\c5b4e0167b0e167e_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\IndexedDB\https_www.google.com_0.indexeddb.leveldb\MANIFEST-000001 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\data_2 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\ee1fd96d3c7a6bbf_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Sessions\Tabs_13248788850182410 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Module Info Cache |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\FontLookupTableCache\font_unique_name_table.pb |
file | c:\users\test22\appdata\local\temp\cghjgasaaz99\crashpadmetrics.pma |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\index |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\ShaderCache\GPUCache\data_1 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\3f5c8c831020c0ab_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\7b942c6b7304d5b2_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Cache\f_00000b |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\PnaclTranslationCache\index |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\ScriptCache\653e56b4b6556a9e_1 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\index.txt |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\data_3 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\BrowserMetrics\BrowserMetrics-5F9FEA6D-37C.pma |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Sync Data\LevelDB\000003.log |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Sessions\Session_13248789357672558 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\ScriptCache\653e56b4b6556a9e_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\History Provider Cache |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Session Storage\000003.log |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Site Characteristics Database\000003.log |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\ThirdPartyModuleList64\2018.8.8.0\module_list_proto |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Local Storage\leveldb\000010.log |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\CacheStorage\28da9c56fde4021055a681112c092453f74d8dd8\86db32f4-11be-40e4-83e8-b602b85321c3\f91ed68f38846db8_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Safe Browsing\UrlSubresourceFilter.store |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\5991f2397acd26b1_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Safe Browsing\UrlMalBin.store |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Safe Browsing\CertCsdDownloadWhitelist.store |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\bfdbf1921d846a2f_0 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Translate Ranker Model |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Cache\f_000002 |
file | C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\Database\000003.log |
Bkav | W32.AIDetect.malware1 |
Elastic | malicious (high confidence) |
DrWeb | Trojan.Siggen12.40103 |
MicroWorld-eScan | Gen:Variant.Zusy.371633 |
FireEye | Generic.mg.9f2a48592d3ce063 |
CAT-QuickHeal | Trojan.DisbukRI.S19305183 |
McAfee | GenericRXLT-RQ!9F2A48592D3C |
Sangfor | Trojan.Win32.Save.a |
Cybereason | malicious.92d3ce |
BitDefenderTheta | Gen:NN.ZexaF.34678.v10@aCmAWxlj |
Cyren | W32/Socelars.H.gen!Eldorado |
Symantec | ML.Attribute.HighConfidence |
ESET-NOD32 | a variant of Win32/Spy.Socelars.S |
APEX | Malicious |
Avast | Win32:PWSX-gen [Trj] |
ClamAV | Win.Malware.Razy-9789744-0 |
Kaspersky | HEUR:Trojan.Script.Generic |
BitDefender | Gen:Variant.Zusy.371633 |
Ad-Aware | Gen:Variant.Zusy.371633 |
Sophos | Troj/Agent-BGVO |
McAfee-GW-Edition | BehavesLike.Win32.Dropper.th |
Emsisoft | Trojan-Spy.Socelars (A) |
SentinelOne | Static AI - Suspicious PE |
Jiangmin | Trojan.PSW.Disbuk.cj |
Avira | HEUR/AGEN.1124060 |
Gridinsoft | Trojan.Heur!.02012021 |
Microsoft | Trojan:Win32/Emotet!ml |
GData | Gen:Variant.Zusy.371633 |
Cynet | Malicious (score: 100) |
AhnLab-V3 | Trojan/Win32.Disbuk.R372531 |
VBA32 | BScope.Trojan.Agentb |
ALYac | Gen:Variant.Zusy.371633 |
MAX | malware (ai score=82) |
Malwarebytes | Glupteba.Backdoor.Bruteforce.DDS |
Rising | Malware.Heuristic!ET#86% (RDMK:cmRtazoobj1HOeqKadbiAuTplqG0) |
Ikarus | Trojan-Spy.Agent |
Fortinet | W32/Socelars.S!tr.spy |
AVG | Win32:PWSX-gen [Trj] |
CrowdStrike | win/malicious_confidence_60% (D) |