Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 20, 2021, 9:12 a.m.	Oct. 20, 2021, 9:18 a.m.

Size	1.4MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`80dfcce79746fa5f6d6586963f2d0ea6`
SHA256	`cdc00a4d60058abdd666ddb7a283bf5eb57a668c08656e757f0faa5bf7d5007b`
CRC32	`FB4852A9`
ssdeep	`24576:wxpXPaR2J33o3S7P5zuHHOF2ahfehMHsGKzOYf8EEvX3yZ1rsa:Qpy+VDa8rtPvX3yZ9s`
PDB Path	F:\facebook_svn\trunk\database\Release\DiskScan.pdb
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen Malicious_Library_Zero - Malicious_Library Credential_User_Data_Check_Zero - Credential User Data Check SQLite_cookies_Check_Zero - SQLite Cookie Check... select UPX_Zero - UPX packed file Trojan_PWS_Stealer_1_Zero - Trojan.PWS.Stealer Zero

askinstall59.exe "C:\Users\test22\AppData\Local\Temp\askinstall59.exe"
2620
- cmd.exe cmd.exe /c taskkill /f /im chrome.exe
  1636
  - taskkill.exe taskkill /f /im chrome.exe
    2208
- chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
  2532
  - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xb0,0xb4,0xb8,0x84,0xbc,0x7fef1b16e00,0x7fef1b16e10,0x7fef1b16e20
    532

Name	Response	Post-Analysis Lookup
www.listincode.com	A 144.202.76.47	144.202.76.47
www.iyiqian.com	A 103.155.92.58	103.155.92.58
iplogger.org	A 88.99.66.31	88.99.66.31

IP Address	Status	Action
103.155.92.58	Active	Moloch
144.202.76.47	Active	Moloch
164.124.101.2	Active	Moloch
88.99.66.31	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49166 -> 88.99.66.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49164 -> 144.202.76.47:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49166 88.99.66.31:443	C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA	CN=*.iplogger.org	55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb
TLSv1 192.168.56.102:49164 144.202.76.47:443	C=CN, O=TrustAsia Technologies, Inc., OU=Domain Validated SSL, CN=TrustAsia TLS RSA CA	CN=listincode.com	84:23:95:42:66:09:11:39:0d:e6:22:7f:eb:b3:cc:79:dd:fa:36:ed

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Oct. 20, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Oct. 20, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (36 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 20, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:14 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Oct. 20, 2021, 9:12 a.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Oct. 20, 2021, 9:12 a.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

F:\facebook_svn\trunk\database\Release\DiskScan.pdb

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\86.0.4240.111\resources\web_store\_metadata\computed_hashes.json
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.iasfafg

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

ZIP

Performs some HTTP requests (2 events)

request	GET https://www.listincode.com/
request	GET https://iplogger.org/1GWfv7

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 20, 2021, 9:12 a.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefb037000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2021, 9:12 a.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef6d79000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 20, 2021, 9:12 a.m.	process_identifier: 532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefb037000 process_handle: 0xffffffffffffffff	1

Steals private information from local Internet browsers (50 out of 84 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOCK
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\aes.js
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\icon.png
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Last Version
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\History
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\content.js
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB__tmp_for_rebuild
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Visited Links
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Preferences
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Media History-wal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\History-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb__tmp_for_rebuild
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Bookmarks
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\pad-nopadding.js
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data-wal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Application Cache\Cache
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\README
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database__tmp_for_rebuild
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\File System\primary.origin
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.old
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\History-wal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb

Foreign language identified in PE resource (4 events)

name

ZIP

language

LANG_CHINESE

filetype

Zip archive data, at least v1.0 to extract

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00162b50

size

0x0000c3cc

name

RT_ICON

language

LANG_CHINESE

filetype

dBase III DBT, version number 0, next free block index 40

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00152180

size

0x00010828

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x001629a8

size

0x00000014

name

RT_VERSION

language

LANG_CHINESE

filetype

PGP symmetric key encrypted data - Plaintext or unencrypted data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x001629c0

size

0x0000018c

Creates executable files on the filesystem (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\pad-nopadding.js
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\aes.js
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\jquery-3.3.1.min.js
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\content.js
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\mode-ecb.js
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\background.js

Creates a suspicious process (1 event)

cmdline

cmd.exe /c taskkill /f /im chrome.exe

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0001d200', u'virtual_address': u'0x00152000', u'entropy': 6.844743738672484, u'name': u'.rsrc', u'virtual_size': u'0x0001d0a0'}

entropy

6.84474373867

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (17 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeTcbPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeSecurityPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeBackupPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeRestorePrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeTrustedCredManAccessPrivilege	1	1
LookupPrivilegeValueW Oct. 20, 2021, 9:12 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Queries for potentially installed applications (8 events)

Time & API	Arguments	Status	Return
RegOpenKeyExW Oct. 20, 2021, 9:12 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adblocker base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adblocker		2
RegOpenKeyExW Oct. 20, 2021, 9:12 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome		2
RegOpenKeyExW Oct. 20, 2021, 9:12 a.m.	regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome		2
RegOpenKeyExW Oct. 20, 2021, 9:12 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000004cc options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1	0
RegOpenKeyExW Oct. 20, 2021, 9:12 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000004cc options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1	0
RegOpenKeyExW Oct. 20, 2021, 9:12 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome		2
RegOpenKeyExW Oct. 20, 2021, 9:12 a.m.	regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome		2
RegOpenKeyExW Oct. 20, 2021, 9:12 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x00000540 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	taskkill /f /im chrome.exe
cmdline	cmd.exe /c taskkill /f /im chrome.exe

One or more non-whitelisted processes were created (1 event)

parent_process

chrome.exe

martian_process

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xb0,0xb4,0xb8,0x84,0xbc,0x7fef1b16e00,0x7fef1b16e10,0x7fef1b16e20

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W32.DisbRecoKAB.Trojan
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.371633
FireEye	Generic.mg.80dfcce79746fa5f
McAfee	GenericRXAA-AA!80DFCCE79746
Cylance	Unsafe
Zillya	Backdoor.Agent.Win32.82381
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Spyware ( 005484541 )
K7GW	Spyware ( 005484541 )
Cybereason	malicious.79746f
BitDefenderTheta	Gen:NN.ZexaF.34218.B10@aWxOSdmj
Cyren	W32/Socelars.K.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Spy.Socelars.S
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Razy-9789744-0
Kaspersky	HEUR:Backdoor.Win32.Agent.gen
BitDefender	Gen:Variant.Zusy.371633
SUPERAntiSpyware	Trojan.Agent/Gen-SpySocelars
Avast	Win32:PWSX-gen [Trj]
Rising	Stealer.FBAdsCard!1.CE03 (CLASSIC)
Ad-Aware	Gen:Variant.Zusy.371633
Sophos	Mal/Generic-R + Troj/Agent-BGVO
DrWeb	Trojan.Siggen15.15860
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Emsisoft	Trojan-Spy.Socelars (A)
SentinelOne	Static AI - Malicious PE
GData	Gen:Variant.Zusy.371633
Jiangmin	Trojan.PSW.Disbuk.dj
Avira	HEUR/AGEN.1124060
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.34A5AAB
Gridinsoft	Trojan.Win32.Agent.oa!s1
Microsoft	Trojan:Win32/Tnega!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Infostealer/Win.Socelars.R372531
VBA32	BScope.Trojan.Agentb
ALYac	Gen:Variant.Zusy.371633
TACHYON	Backdoor/W32.Agent.1495552.D
Malwarebytes	Glupteba.Backdoor.Bruteforce.DDS
TrendMicro-HouseCall	TROJ_GEN.R002C0RJJ21
Tencent	Malware.Win32.Gencirc.10cf4ac5
Fortinet	W32/Socelars.S!tr.spy
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (W)

askinstall59.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All