Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 25, 2021, 9:52 a.m.	June 25, 2021, 9:55 a.m.

Size	1.4MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`09b950f451b5ea82a536f2b9792f8bf8`
SHA256	`fb4f1f80320365984cc24d8b8afe59f21ada1d07ae9862efb407a3c650bd40a8`
CRC32	`6EEA6A23`
ssdeep	`24576:Hh93Gpb7GggFpiCsNm/xIReKdyIiJxplFRyxaNI9chelnaecXTC6K/8e9mV:D3GpzgDiC/iR5dWXzR1NIGklnanX+6+y`
PDB Path	F:\facebook_svn\trunk\database\Release\DiskScan.pdb
Yara	PE_Header_Zero - PE File Signature Trojan_PWS_Stealer_1_Zero - Trojan.PWS.Stealer Zero OS_Processor_Check_Zero - OS Processor Check Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen IsPE32 - (no description) Credential_User_Data_Check_Zero - Credential User Data Check SQLite_cookies_Check_Zero - SQLite Cookie Check... select

askinstall36.exe "C:\Users\test22\AppData\Local\Temp\askinstall36.exe"
112
- cmd.exe cmd.exe /c taskkill /f /im chrome.exe
  1304
  - taskkill.exe taskkill /f /im chrome.exe
    1976
- xcopy.exe xcopy "C:\Users\test22\AppData\Local\Google\Chrome\User Data" "C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
  1348
- chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\test22\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
  2656
  - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x90,0x94,0x98,0x8c,0x9c,0x7fef3c2f1e8,0x7fef3c2f1f8,0x7fef3c2f208
    560
  - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2420 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6
    260

Name	Response	Post-Analysis Lookup
www.listincode.com	A 144.202.76.47	144.202.76.47
www.iyiqian.com	A 103.155.92.58	103.155.92.58
www.pedreirao.com	A 188.225.87.175	188.225.87.175
iplogger.org	A 88.99.66.31	88.99.66.31

IP Address	Status	Action
103.155.92.58	Active	Moloch
144.202.76.47	Active	Moloch
164.124.101.2	Active	Moloch
188.225.87.175	Active	Moloch
88.99.66.31	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49198 -> 144.202.76.47:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49201 -> 88.99.66.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49198 144.202.76.47:443	C=CN, O=TrustAsia Technologies, Inc., OU=Domain Validated SSL, CN=TrustAsia TLS RSA CA	CN=listincode.com	84:23:95:42:66:09:11:39:0d:e6:22:7f:eb:b3:cc:79:dd:fa:36:ed
TLSv1 192.168.56.101:49201 88.99.66.31:443	C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA	CN=*.iplogger.org	55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW June 25, 2021, 9:51 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW June 25, 2021, 9:51 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (28 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0
IsDebuggerPresent June 25, 2021, 9:52 a.m.			0	0

Command line console output was observed (50 out of 696 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 25, 2021, 9:51 a.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma~RF3a15fe.TMP console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\First Run console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Channel IDs console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Channel IDs-journal console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies-journal console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5F2CDF32-998.pma console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\metadata console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Current Session console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Current Tabs console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Favicons console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Favicons-journal console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\History console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\History-journal console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\in_progress_download_metadata_store console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor-journal console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Origin Bound Certs console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Origin Bound Certs-journal console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Preferences console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db-journal console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\QuotaManager console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\QuotaManager-journal console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Shortcuts console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Shortcuts-journal console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Top Sites console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Top Sites-journal console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Translate Ranker Model console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Visited Links console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0 console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1 console_handle: 0x00000013	1	1
WriteConsoleW June 25, 2021, 9:52 a.m.	buffer: C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2 console_handle: 0x00000013	1	1

This executable has a PDB path (1 event)

pdb_path

F:\facebook_svn\trunk\database\Release\DiskScan.pdb

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\65.0.3325.181\Locales\ko.pak
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.cdjgaqf

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

ZIP

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 25, 2021, 9:52 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 182186256 registers.r15: 182186696 registers.rcx: 1336 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 80057840 registers.rsp: 182185416 registers.r11: 182189952 registers.r8: 1999536524 registers.r9: 0 registers.rdx: 1444 registers.r12: 35310400 registers.rbp: 182185568 registers.rdi: 35239616 registers.rax: 3812864 registers.r13: 182186128	1	0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header

suspicious_request

POST http://www.pedreirao.com/Home/Index/lkdinl

Performs some HTTP requests (4 events)

request	GET http://www.iyiqian.com/
request	POST http://www.pedreirao.com/Home/Index/lkdinl
request	GET https://www.listincode.com/
request	GET https://iplogger.org/1s4qp7

Sends data using the HTTP POST Method (1 event)

request

POST http://www.pedreirao.com/Home/Index/lkdinl

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 25, 2021, 9:52 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:52 a.m.	process_identifier: 560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 25, 2021, 9:52 a.m.	process_identifier: 260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000735bc000 process_handle: 0xffffffffffffffff	1

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process chrome.exe with pid 2656 crashed
__exception__ June 25, 2021, 9:52 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 182186256 registers.r15: 182186696 registers.rcx: 1336 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 80057840 registers.rsp: 182185416 registers.r11: 182189952 registers.r8: 1999536524 registers.r9: 0 registers.rdx: 1444 registers.r12: 35310400 registers.rbp: 182185568 registers.rdi: 35239616 registers.rax: 3812864 registers.r13: 182186128	1	0	0

Steals private information from local Internet browsers (50 out of 1212 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\en_US\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\UrlSoceng.store
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_1\_locales\lv
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\et
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ko
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.2_0\_locales\pt_PT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.2_0\_locales\ru\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\lt\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOCK
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ca\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\et\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7619.603.0.2_0\_locales\ko\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\mode-ecb.js
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_1\_locales\ne
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.2_0\manifest.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_1\_metadata\verified_contents.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\da
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\ro\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\da\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7619.603.0.2_0\_locales\zh_TW\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_1\_locales\zh_TW\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Thumbnails\LOG.old
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Translate Ranker Model
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\fil
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\UrlCsdDownloadWhitelist.store
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\hi\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\fil
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7619.603.0.2_0\_locales\mr\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\_locales\el
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\nl
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\da
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.2_0\_locales\uk\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Storage
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sl
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.old
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_1\_locales\ta
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_1\_locales\te
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.2_0\_locales\tr\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_1\_locales\th
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\28.0.0.137\manifest.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.2_0\_locales\id\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\nl
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\fil\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\hi\messages.json
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\craw_window.css

Foreign language identified in PE resource (4 events)

name

ZIP

language

LANG_CHINESE

filetype

Zip archive data, at least v1.0 to extract

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00156b50

size

0x0000e37c

name

RT_ICON

language

LANG_CHINESE

filetype

dBase III DBT, version number 0, next free block index 40

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00146180

size

0x00010828

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x001569a8

size

0x00000014

name

RT_VERSION

language

LANG_CHINESE

filetype

PGP symmetric key encrypted data - Plaintext or unencrypted data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x001569c0

size

0x0000018c

Creates executable files on the filesystem (32 events)

file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\main.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\jquery-3.3.1.min.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7619.603.0.2_0\angular.js
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\mode-ecb.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7619.603.0.2_0\mirroring_webrtc.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7619.603.0.2_0\mirroring_hangouts.js
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\jquery-3.3.1.min.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7619.603.0.2_0\cast_setup\cast_app.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_1\contentscript_bin_prod.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7619.603.0.2_0\feedback_script.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\main.js
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\content.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7619.603.0.2_0\common.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_1\page_embed_script.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7619.603.0.2_0\cast_setup\cast_app_redirect.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\mode-ecb.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\aes.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\pad-nopadding.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\craw_window.js
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\background.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\PepperFlash\28.0.0.137\pepflashplayer.dll
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\pad-nopadding.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7619.603.0.2_0\mirroring_cast_streaming.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\background.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_1\eventpage_bin_prod.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7619.603.0.2_0\cast_sender.js
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\aes.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\content.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\craw_background.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7619.603.0.2_0\background_script.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\7619.603.0.2_0\mirroring_common.js
file	C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\main.js

Creates a suspicious process (1 event)

cmdline

cmd.exe /c taskkill /f /im chrome.exe

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 25, 2021, 9:52 a.m.	thread_identifier: 2716 thread_handle: 0x000004d4 process_identifier: 1348 current_directory: filepath: track: 1 command_line: xcopy "C:\Users\test22\AppData\Local\Google\Chrome\User Data" "C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\" /s /e /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000544	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0001f200', u'virtual_address': u'0x00146000', u'entropy': 7.015661379074593, u'name': u'.rsrc', u'virtual_size': u'0x0001f050'}

entropy

7.01566137907

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (17 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeTrustedCredManAccessPrivilege	1	1
LookupPrivilegeValueW June 25, 2021, 9:51 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Potentially malicious URLs were found in the process memory dump (50 out of 1147 events)

url	https://clients4.google.com/invalidation/android/request/
url	http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
url	http://services.ukrposhta.com/postindex_new/
url	http://dts.search-results.com/sr?lng=
url	http://inposdom.gob.do/codigo-postal/
url	http://creativecommons.org/ns
url	http://www.postur.fo/
url	https://qc.search.yahoo.com/search?ei=
url	https://cacert.omniroot.com/baltimoreroot.crt09
url	https://codereview.chromium.org/25305002).
url	https://search.yahoo.com/search?ei=
url	http://t1.symcb.com/ThawtePCA.crl0/
url	http://crbug.com/31395.
url	https://support.google.com/chrome/answer/165139
url	https://ct.googleapis.com/aviator/
url	https://datasaver.googleapis.com/v1/clientConfigs
url	http://crl.starfieldtech.com/sfroot-g2.crl0L
url	https://ct.startssl.com/
url	https://suggest.yandex.com.tr/suggest-ff.cgi?part=
url	https://de.search.yahoo.com/favicon.ico
url	https://github.com/GoogleChrome/Lighthouse/issues
url	http://www.searchnu.com/favicon.ico
url	https://support.google.com/installer/?product=
url	http://msdn.microsoft.com/en-us/library/ms792901.aspx
url	https://www.najdi.si/search.jsp?q=
url	http://x.ss2.us/x.cer0
url	http://crl.geotrust.com/crls/gtglobal.crl04
url	https://accounts.google.com/ServiceLogin
url	https://accounts.google.com/OAuthLogin
url	https://c.android.clients.google.com/
url	https://search.goo.ne.jp/sgt.jsp?MT=
url	https://www.google.com/tools/feedback/chrome/__submit
url	https://chrome.google.com/webstore/category/collection/dark_themes
url	http://check.googlezip.net/generate_204
url	http://ocsp.starfieldtech.com/08
url	http://www.guernseypost.com/postcode_finder/
url	http://crl.certum.pl/ca.crl0h
url	http://ator
url	https://suggest.yandex.by/suggest-ff.cgi?part=
url	http://feed.snap.do/?q=
url	https://sp.uk.ask.com/sh/i/a16/favicon/favicon.ico
url	http://www.language
url	https://support.google.com/chrome/
url	http://developer.chrome.com/apps/declare_permissions.html
url	https://ct.googleapis.com/rocketeer/
url	https://www.globalsign.com/repository/03
url	http://www.startssl.com/sfsca.crl0
url	http://UA-Compatible
url	https://se.search.yahoo.com/search?ei=
url	http://EVSecure-ocsp.geotrust.com0

Yara rule detected in process memory (50 out of 1122 events)

description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Virtual currency	rule	Virtual_currency_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Steal credential	rule	local_credential_Steal
description	Take ScreenShot	rule	ScreenShot
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Possibly employs anti-virtualization techniques	rule	vmdetect
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	Perform crypto currency mining	rule	BitCoin
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Virtual currency	rule	Virtual_currency_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Steal credential	rule	local_credential_Steal
description	Take ScreenShot	rule	ScreenShot
description	File Downloader	rule	Network_Downloader

Queries for potentially installed applications (8 events)

Time & API	Arguments	Status	Return
RegOpenKeyExW June 25, 2021, 9:51 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adblocker base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adblocker		2
RegOpenKeyExW June 25, 2021, 9:51 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome		2
RegOpenKeyExW June 25, 2021, 9:51 a.m.	regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome		2
RegOpenKeyExW June 25, 2021, 9:51 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1	0
RegOpenKeyExW June 25, 2021, 9:51 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000004c0 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1	0
RegOpenKeyExW June 25, 2021, 9:52 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome		2
RegOpenKeyExW June 25, 2021, 9:52 a.m.	regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome		2
RegOpenKeyExW June 25, 2021, 9:52 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000004d4 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1	0

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess June 25, 2021, 9:53 a.m.	status_code: 0xc0000005 process_identifier: 2656 process_handle: 0x000000000000009c		0	0
NtTerminateProcess June 25, 2021, 9:53 a.m.	status_code: 0xc0000005 process_identifier: 2656 process_handle: 0x000000000000009c	1	0	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	taskkill /f /im chrome.exe
cmdline	cmd.exe /c taskkill /f /im chrome.exe

One or more non-whitelisted processes were created (3 events)

parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1208,14136021394864005808,12591226849946384395,131072 --user-data-dir="C:\Users\test22\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=KAAAAAAAAAAABwAAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x80ee --gpu-device-id=0xbeef --gpu-driver-vendor=Microsoft --gpu-driver-version=6.1.7600.16385 --gpu-driver-date=6-21-2006 --user-data-dir="C:\Users\test22\AppData\Local\Temp\cghjgasaaz99" --service-request-channel-token=6D7FEC69FADC95634C408D7858AF174A --mojo-platform-channel-handle=1224 --ignored=" --type=renderer " /prefetch:2
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2420 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\test22\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x90,0x94,0x98,0x8c,0x9c,0x7fef3c2f1e8,0x7fef3c2f1f8,0x7fef3c2f208

Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic) (1 event)

url	http://127.0.0.1

Resumed a suspended thread in a remote process potentially indicative of process injection (34 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 560 resumed a thread in remote process 2656
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0
NtResumeThread June 25, 2021, 9:52 a.m.	thread_handle: 0x0000000000000158 suspend_count: 2 process_identifier: 2656	1	0	0

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.371633
CAT-QuickHeal	Trojan.DisbukRI.S19305183
ALYac	Gen:Variant.Zusy.371633
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Spyware ( 005484541 )
Alibaba	TrojanSpy:Win32/Socelars.3ed3ad85
K7GW	Spyware ( 005484541 )
Cybereason	malicious.451b5e
Arcabit	Trojan.Zusy.D5ABB1
Cyren	W32/Trojan.HDBB-2842
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Spy.Socelars.S
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Malware.Razy-9789744-0
Kaspersky	HEUR:Trojan.Script.Generic
BitDefender	Gen:Variant.Zusy.371633
Paloalto	generic.ml
Ad-Aware	Gen:Variant.Zusy.371633
Sophos	Mal/Generic-R + Troj/Agent-BGVO
Comodo	TrojWare.Win32.Agent.ngyuq@0
DrWeb	Trojan.Siggen13.57604
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0PFL21
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
FireEye	Generic.mg.09b950f451b5ea82
Emsisoft	Trojan-Spy.Socelars (A)
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1124060
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Generic.ASMalwS.338DF03
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Agent.oa!s1
Microsoft	Trojan:Win32/Vigorf.A
GData	Gen:Variant.Zusy.371633
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Disbuk.R372531
McAfee	GenericRXLT-RQ!09B950F451B5
VBA32	BScope.Trojan.Agentb
Malwarebytes	Glupteba.Backdoor.Bruteforce.DDS
TrendMicro-HouseCall	TROJ_GEN.R002C0PFL21
Rising	Stealer.FBAdsCard!1.CE03 (CLASSIC)
Yandex	TrojanSpy.Socelars!vEQLT7CRLo4
Fortinet	W32/Socelars.S!tr.spy
BitDefenderTheta	Gen:NN.ZexaF.34758.y10@aulQs@lj
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/Genetic.gen

askinstall36.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All