File name:

coccoc_en.exe

Full analysis: https://app.any.run/tasks/be2447ee-d2c0-411c-828c-814ceca78efe
Verdict: Malicious activity
Analysis date: December 03, 2020, 21:05:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2B6FCE993E6DCACB5579295723024820

SHA1:

A9CF4F63AC941D93D78CAD0F55A60397018A4787

SHA256:

4BB7BEE16935F2134559F46DC3FFAED1DFE85F2C305369198D66ED4C2B4332A1

SSDEEP:

12288:xUxXu8p5XAzn7B7AGytKCyKY7amZIvfZXB3l339bmd5/gMv+tP+c:xUxt5Qd7AGytKnKY7a+whXB1O5vmP+c

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • coccoc_en.exe (PID: 2180)
      • CocCocUpdate.exe (PID: 1424)
      • 85.0.4183.146_coccocsetup.exe (PID: 3184)

    • Actions looks like stealing of personal data

      • CocCocUpdate.exe (PID: 1424)
      • CocCocUpdate.exe (PID: 2444)
      • CocCocUpdate.exe (PID: 1840)
      • setup.exe (PID: 664)
      • 85.0.4183.146_coccocsetup.exe (PID: 3184)
      • setup.exe (PID: 3892)
      • CocCocUpdate.exe (PID: 2096)
      • setup.exe (PID: 2976)
      • CocCocCrashHandler.exe (PID: 3432)
      • browser.exe (PID: 3060)
      • setup.exe (PID: 3672)
      • browser.exe (PID: 3768)
      • browser.exe (PID: 4084)
      • CocCocUpdate.exe (PID: 2912)
      • browser.exe (PID: 3408)
      • browser.exe (PID: 2440)
      • browser.exe (PID: 3916)
      • browser.exe (PID: 2512)
      • browser.exe (PID: 1144)
      • browser.exe (PID: 3932)
      • browser.exe (PID: 2348)
      • browser.exe (PID: 2216)
      • browser.exe (PID: 2764)
      • browser.exe (PID: 3568)
      • browser.exe (PID: 2508)
      • browser.exe (PID: 2760)
      • browser.exe (PID: 1708)
      • browser.exe (PID: 3904)
      • browser.exe (PID: 908)
      • browser.exe (PID: 2176)
      • browser.exe (PID: 2060)
      • browser.exe (PID: 3584)
      • browser.exe (PID: 2848)
      • browser.exe (PID: 672)
      • browser.exe (PID: 3388)
      • browser.exe (PID: 2244)
      • browser.exe (PID: 3856)
      • browser.exe (PID: 2376)
      • browser.exe (PID: 292)
      • browser.exe (PID: 3616)
      • browser.exe (PID: 896)
      • browser.exe (PID: 3224)
      • browser.exe (PID: 2212)
      • browser.exe (PID: 1980)
      • browser.exe (PID: 404)
      • browser.exe (PID: 3420)
      • browser.exe (PID: 2768)
      • browser.exe (PID: 2520)
      • browser.exe (PID: 3924)
      • browser.exe (PID: 2452)
      • browser.exe (PID: 3764)
      • browser.exe (PID: 4068)
      • browser.exe (PID: 2684)
      • browser.exe (PID: 2140)
      • browser.exe (PID: 1732)
      • browser.exe (PID: 1080)
      • browser.exe (PID: 3480)
      • browser.exe (PID: 3864)
      • browser.exe (PID: 3992)
      • browser.exe (PID: 4052)
      • browser.exe (PID: 336)
      • browser.exe (PID: 3992)
      • browser.exe (PID: 2384)
      • browser.exe (PID: 556)
      • browser.exe (PID: 2900)
      • browser.exe (PID: 2712)
      • browser.exe (PID: 2896)
      • browser.exe (PID: 3928)
      • browser.exe (PID: 2164)
      • browser.exe (PID: 2304)
      • browser.exe (PID: 1732)
      • browser.exe (PID: 2700)
      • browser.exe (PID: 1340)
      • browser.exe (PID: 1888)
      • browser.exe (PID: 3776)
      • browser.exe (PID: 1920)
      • browser.exe (PID: 2856)
      • browser.exe (PID: 2448)
      • browser.exe (PID: 2816)
      • browser.exe (PID: 2380)
      • browser.exe (PID: 3520)
      • browser.exe (PID: 2932)
      • browser.exe (PID: 2800)
      • browser.exe (PID: 2500)
      • browser.exe (PID: 2452)
      • browser.exe (PID: 2668)
      • browser.exe (PID: 3712)
      • browser.exe (PID: 2864)
      • browser.exe (PID: 3772)
      • browser.exe (PID: 3744)
      • browser.exe (PID: 2804)
      • browser.exe (PID: 3592)
      • browser.exe (PID: 4012)
      • browser.exe (PID: 3032)
      • browser.exe (PID: 3504)
      • browser.exe (PID: 2068)
      • browser.exe (PID: 3800)
      • browser.exe (PID: 2280)
      • browser.exe (PID: 3544)
      • browser.exe (PID: 1792)
      • browser.exe (PID: 3116)
      • browser.exe (PID: 2992)
      • browser.exe (PID: 1020)
      • browser.exe (PID: 3756)
      • browser.exe (PID: 2128)
      • browser.exe (PID: 3972)
      • browser.exe (PID: 4004)
      • browser.exe (PID: 4016)
      • browser.exe (PID: 2816)
      • browser.exe (PID: 3868)
      • browser.exe (PID: 3628)
      • browser.exe (PID: 3940)
      • browser.exe (PID: 980)
      • browser.exe (PID: 3272)
      • browser.exe (PID: 892)
      • browser.exe (PID: 2064)
      • browser.exe (PID: 3664)
      • browser.exe (PID: 2864)
      • CocCocUpdate.exe (PID: 1520)
      • CocCocUpdate.exe (PID: 3784)
      • CocCocUpdate.exe (PID: 2780)
      • CocCocCrashHandler.exe (PID: 2080)
      • browser.exe (PID: 3348)

    • Changes the autorun value in the registry

      • CocCocUpdate.exe (PID: 1424)

    • Application was dropped or rewritten from another process

      • CocCocUpdate.exe (PID: 1424)
      • CocCocUpdate.exe (PID: 2444)
      • CocCocUpdate.exe (PID: 1840)
      • CocCocUpdate.exe (PID: 2096)
      • setup.exe (PID: 3892)
      • setup.exe (PID: 664)
      • setup.exe (PID: 2976)
      • setup.exe (PID: 3672)
      • CocCocCrashHandler.exe (PID: 3432)
      • CocCocUpdate.exe (PID: 2912)
      • browser.exe (PID: 2520)
      • browser.exe (PID: 3060)
      • browser.exe (PID: 3768)
      • browser.exe (PID: 3408)
      • browser.exe (PID: 3916)
      • browser.exe (PID: 2440)
      • browser.exe (PID: 4084)
      • browser.exe (PID: 2512)
      • browser.exe (PID: 1144)
      • browser.exe (PID: 2216)
      • browser.exe (PID: 2348)
      • browser.exe (PID: 2508)
      • browser.exe (PID: 3932)
      • browser.exe (PID: 2764)
      • browser.exe (PID: 3568)
      • browser.exe (PID: 2760)
      • browser.exe (PID: 1708)
      • browser.exe (PID: 3904)
      • browser.exe (PID: 2176)
      • browser.exe (PID: 908)
      • browser.exe (PID: 2060)
      • browser.exe (PID: 3584)
      • browser.exe (PID: 2848)
      • browser.exe (PID: 672)
      • browser.exe (PID: 292)
      • browser.exe (PID: 2376)
      • browser.exe (PID: 3856)
      • browser.exe (PID: 2244)
      • browser.exe (PID: 3616)
      • browser.exe (PID: 1980)
      • browser.exe (PID: 3388)
      • browser.exe (PID: 896)
      • browser.exe (PID: 3420)
      • browser.exe (PID: 3224)
      • browser.exe (PID: 404)
      • browser.exe (PID: 2768)
      • browser.exe (PID: 2212)
      • browser.exe (PID: 3924)
      • browser.exe (PID: 2452)
      • browser.exe (PID: 3764)
      • browser.exe (PID: 4068)
      • browser.exe (PID: 3480)
      • browser.exe (PID: 3864)
      • browser.exe (PID: 2140)
      • browser.exe (PID: 1080)
      • browser.exe (PID: 1732)
      • browser.exe (PID: 3992)
      • browser.exe (PID: 2684)
      • browser.exe (PID: 4052)
      • browser.exe (PID: 336)
      • browser.exe (PID: 3992)
      • browser.exe (PID: 2896)
      • browser.exe (PID: 2384)
      • browser.exe (PID: 2900)
      • browser.exe (PID: 2164)
      • browser.exe (PID: 1888)
      • browser.exe (PID: 2712)
      • browser.exe (PID: 3928)
      • browser.exe (PID: 556)
      • browser.exe (PID: 2304)
      • browser.exe (PID: 3776)
      • browser.exe (PID: 1732)
      • browser.exe (PID: 1340)
      • browser.exe (PID: 2700)
      • browser.exe (PID: 3520)
      • browser.exe (PID: 2448)
      • browser.exe (PID: 2856)
      • browser.exe (PID: 2816)
      • browser.exe (PID: 2380)
      • browser.exe (PID: 1920)
      • browser.exe (PID: 2668)
      • browser.exe (PID: 3712)
      • browser.exe (PID: 2932)
      • browser.exe (PID: 2800)
      • browser.exe (PID: 2452)
      • browser.exe (PID: 2500)
      • browser.exe (PID: 3744)
      • browser.exe (PID: 2804)
      • browser.exe (PID: 4012)
      • browser.exe (PID: 3592)
      • browser.exe (PID: 2864)
      • browser.exe (PID: 3772)
      • browser.exe (PID: 3504)
      • browser.exe (PID: 3800)
      • browser.exe (PID: 2280)
      • browser.exe (PID: 3544)
      • browser.exe (PID: 1020)
      • browser.exe (PID: 3032)
      • browser.exe (PID: 2068)
      • browser.exe (PID: 3756)
      • browser.exe (PID: 3116)
      • browser.exe (PID: 1792)
      • browser.exe (PID: 2992)
      • browser.exe (PID: 2128)
      • browser.exe (PID: 3972)
      • browser.exe (PID: 4016)
      • browser.exe (PID: 3868)
      • browser.exe (PID: 2816)
      • browser.exe (PID: 4004)
      • browser.exe (PID: 3628)
      • browser.exe (PID: 2064)
      • browser.exe (PID: 3664)
      • browser.exe (PID: 2864)
      • browser.exe (PID: 3272)
      • browser.exe (PID: 980)
      • browser.exe (PID: 892)
      • browser.exe (PID: 3940)
      • CocCocUpdate.exe (PID: 1520)
      • CocCocUpdate.exe (PID: 2780)
      • CocCocCrashHandler.exe (PID: 2080)
      • CocCocUpdate.exe (PID: 3784)
      • browser.exe (PID: 3348)

    • Loads dropped or rewritten executable

      • CocCocUpdate.exe (PID: 2444)
      • CocCocUpdate.exe (PID: 1424)
      • CocCocUpdate.exe (PID: 1840)
      • CocCocUpdate.exe (PID: 2096)
      • browser.exe (PID: 3060)
      • browser.exe (PID: 2520)
      • CocCocUpdate.exe (PID: 2912)
      • browser.exe (PID: 3768)
      • browser.exe (PID: 4084)
      • browser.exe (PID: 3916)
      • browser.exe (PID: 3408)
      • browser.exe (PID: 2440)
      • browser.exe (PID: 2512)
      • browser.exe (PID: 1144)
      • browser.exe (PID: 2216)
      • browser.exe (PID: 3932)
      • browser.exe (PID: 2348)
      • browser.exe (PID: 2760)
      • browser.exe (PID: 2508)
      • browser.exe (PID: 908)
      • browser.exe (PID: 3568)
      • browser.exe (PID: 2764)
      • browser.exe (PID: 1708)
      • browser.exe (PID: 3904)
      • browser.exe (PID: 2848)
      • browser.exe (PID: 2060)
      • browser.exe (PID: 3584)
      • browser.exe (PID: 672)
      • browser.exe (PID: 292)
      • browser.exe (PID: 2376)
      • browser.exe (PID: 3388)
      • browser.exe (PID: 3856)
      • browser.exe (PID: 2244)
      • browser.exe (PID: 3616)
      • browser.exe (PID: 2212)
      • browser.exe (PID: 896)
      • browser.exe (PID: 3224)
      • browser.exe (PID: 3420)
      • browser.exe (PID: 404)
      • browser.exe (PID: 1980)
      • browser.exe (PID: 3924)
      • browser.exe (PID: 4068)
      • browser.exe (PID: 2452)
      • browser.exe (PID: 3764)
      • browser.exe (PID: 2768)
      • browser.exe (PID: 2684)
      • browser.exe (PID: 3864)
      • browser.exe (PID: 2140)
      • browser.exe (PID: 1732)
      • browser.exe (PID: 1080)
      • browser.exe (PID: 3480)
      • browser.exe (PID: 4052)
      • browser.exe (PID: 336)
      • browser.exe (PID: 2176)
      • browser.exe (PID: 2896)
      • browser.exe (PID: 3992)
      • browser.exe (PID: 3992)
      • browser.exe (PID: 3928)
      • browser.exe (PID: 556)
      • browser.exe (PID: 2900)
      • browser.exe (PID: 2164)
      • browser.exe (PID: 2712)
      • browser.exe (PID: 2384)
      • browser.exe (PID: 3776)
      • browser.exe (PID: 1732)
      • browser.exe (PID: 2700)
      • browser.exe (PID: 1340)
      • browser.exe (PID: 1888)
      • browser.exe (PID: 2304)
      • browser.exe (PID: 1920)
      • browser.exe (PID: 2448)
      • browser.exe (PID: 3520)
      • browser.exe (PID: 2856)
      • browser.exe (PID: 2816)
      • browser.exe (PID: 2380)
      • browser.exe (PID: 2452)
      • browser.exe (PID: 2668)
      • browser.exe (PID: 3712)
      • browser.exe (PID: 2800)
      • browser.exe (PID: 2932)
      • browser.exe (PID: 2500)
      • browser.exe (PID: 3772)
      • browser.exe (PID: 3744)
      • browser.exe (PID: 2804)
      • browser.exe (PID: 3592)
      • browser.exe (PID: 4012)
      • browser.exe (PID: 2864)
      • browser.exe (PID: 3800)
      • browser.exe (PID: 3504)
      • browser.exe (PID: 2068)
      • browser.exe (PID: 2280)
      • browser.exe (PID: 3544)
      • browser.exe (PID: 3032)
      • browser.exe (PID: 3756)
      • browser.exe (PID: 3116)
      • browser.exe (PID: 1792)
      • browser.exe (PID: 2992)
      • browser.exe (PID: 3868)
      • browser.exe (PID: 1020)
      • browser.exe (PID: 2128)
      • browser.exe (PID: 4016)
      • browser.exe (PID: 2816)
      • browser.exe (PID: 4004)
      • browser.exe (PID: 3628)
      • browser.exe (PID: 2064)
      • browser.exe (PID: 3972)
      • browser.exe (PID: 3940)
      • browser.exe (PID: 3664)
      • browser.exe (PID: 3272)
      • browser.exe (PID: 2864)
      • browser.exe (PID: 980)
      • browser.exe (PID: 892)
      • CocCocUpdate.exe (PID: 3784)
      • CocCocUpdate.exe (PID: 1520)
      • CocCocUpdate.exe (PID: 2780)
      • browser.exe (PID: 3348)

    • Loads the Task Scheduler DLL interface

      • CocCocUpdate.exe (PID: 1424)
      • CocCocUpdate.exe (PID: 3784)

    • Loads the Task Scheduler COM API

      • CocCocUpdate.exe (PID: 1424)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • coccoc_en.exe (PID: 2180)
      • CocCocUpdate.exe (PID: 1424)
      • 85.0.4183.146_coccocsetup.exe (PID: 3184)
      • setup.exe (PID: 3892)

    • Creates files in the user directory

      • CocCocUpdate.exe (PID: 1424)
      • setup.exe (PID: 3892)
      • browser.exe (PID: 2520)

    • Drops a file that was compiled in debug mode

      • coccoc_en.exe (PID: 2180)
      • CocCocUpdate.exe (PID: 1424)
      • 85.0.4183.146_coccocsetup.exe (PID: 3184)
      • setup.exe (PID: 3892)

    • Creates COM task schedule object

      • CocCocUpdate.exe (PID: 2444)

    • Starts itself from another location

      • CocCocUpdate.exe (PID: 1424)
      • setup.exe (PID: 3892)

    • Creates files in the Windows directory

      • CocCocUpdate.exe (PID: 1424)

    • Application launched itself

      • setup.exe (PID: 3892)
      • setup.exe (PID: 3672)
      • CocCocUpdate.exe (PID: 2096)
      • browser.exe (PID: 2520)
      • CocCocUpdate.exe (PID: 3784)

    • Creates a software uninstall entry

      • setup.exe (PID: 3892)

    • Drops a file with a compile date too recent

      • setup.exe (PID: 3892)
      • 85.0.4183.146_coccocsetup.exe (PID: 3184)

    • Drops a file with too old compile date

      • setup.exe (PID: 3892)

    • Modifies the open verb of a shell class

      • setup.exe (PID: 3672)
      • setup.exe (PID: 3892)

    • Executed via Task Scheduler

      • CocCocUpdate.exe (PID: 1520)
      • CocCocUpdate.exe (PID: 3784)

  • INFO

    • Reads the hosts file

      • browser.exe (PID: 2520)
      • browser.exe (PID: 3916)

    • Reads settings of System Certificates

      • browser.exe (PID: 3916)

    • Dropped object may contain Bitcoin addresses

      • browser.exe (PID: 4068)
      • browser.exe (PID: 2500)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:03:27 10:52:15+01:00
PEType: PE32
LinkerVersion: 14
CodeSize: 91648
InitializedDataSize: 572416
UninitializedDataSize: -
EntryPoint: 0x5819
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 2.5.15.117
ProductVersionNumber: 2.5.15.117
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Coc Coc Co., Ltd.
FileDescription: CocCoc Update Setup
FileVersion: 2.5.15.117
InternalName: CocCoc Update Setup
LegalCopyright: Copyright 2012 Google Inc.
OriginalFileName: CocCocUpdateSetup.exe
ProductName: CocCoc Update
ProductVersion: 2.5.15.117
LanguageId: en

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 27-Mar-2020 09:52:15
Detected languages:
  • English - United States
  • Vietnamese - Viet Nam
Debug artifacts:
  • mi_exe_stub.pdb
CompanyName: Coc Coc Co., Ltd.
FileDescription: CocCoc Update Setup
FileVersion: 2.5.15.117
InternalName: CocCoc Update Setup
LegalCopyright: Copyright 2012 Google Inc.
OriginalFilename: CocCocUpdateSetup.exe
ProductName: CocCoc Update
ProductVersion: 2.5.15.117
LanguageId: en

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 27-Mar-2020 09:52:15
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00016521
0x00016600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.64637
.rdata
0x00018000
0x00006ECA
0x00007000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.24492
.data
0x0001F000
0x00001424
0x00000A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.37747
.gfids
0x00021000
0x0000010C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.40885
.rsrc
0x00022000
0x00082CF4
0x00082E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.99043
.reloc
0x000A5000
0x00001180
0x00001200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.52843

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.16024
919
Latin 1 / Western European
UNKNOWN
RT_MANIFEST
2
4.13669
1384
Latin 1 / Western European
English - United States
RT_ICON
3
3.91985
744
Latin 1 / Western European
English - United States
RT_ICON
4
4.83772
2216
Latin 1 / Western European
English - United States
RT_ICON
5
3.68656
1640
Latin 1 / Western European
English - United States
RT_ICON
6
4.50268
3752
Latin 1 / Western European
English - United States
RT_ICON
101
2.86669
90
Latin 1 / Western European
English - United States
RT_GROUP_ICON
102
7.99967
522058
Latin 1 / Western European
UNKNOWN
B
1321
3.6945
610
Latin 1 / Western European
Vietnamese - Viet Nam
RT_STRING

Imports

KERNEL32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
124
Malicious processes
124
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start coccoc_en.exe coccocupdate.exe coccocupdate.exe coccocupdate.exe coccocupdate.exe 85.0.4183.146_coccocsetup.exe setup.exe setup.exe setup.exe setup.exe coccoccrashhandler.exe browser.exe browser.exe coccocupdate.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe coccocupdate.exe coccocupdate.exe coccocupdate.exe coccoccrashhandler.exe browser.exe

Process information

PID
CMD
Path
Indicators
Parent process
292"C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,13974240105578870032,11730763363503941404,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=5336 /prefetch:8C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe
browser.exe
User:
admin
Company:
Coc Coc Co., Ltd.
Integrity Level:
LOW
Description:
CocCoc
Exit code:
0
Version:
85.0.4183.146
Modules
Images
c:\users\admin\appdata\local\coccoc\browser\application\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\coccoc\browser\application\85.0.4183.146\browser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
336"C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,13974240105578870032,11730763363503941404,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=7716 /prefetch:8C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe
browser.exe
User:
admin
Company:
Coc Coc Co., Ltd.
Integrity Level:
LOW
Description:
CocCoc
Exit code:
0
Version:
85.0.4183.146
Modules
Images
c:\users\admin\appdata\local\coccoc\browser\application\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\coccoc\browser\application\85.0.4183.146\browser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
404"C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,13974240105578870032,11730763363503941404,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3356 /prefetch:8C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe
browser.exe
User:
admin
Company:
Coc Coc Co., Ltd.
Integrity Level:
LOW
Description:
CocCoc
Exit code:
0
Version:
85.0.4183.146
Modules
Images
c:\users\admin\appdata\local\coccoc\browser\application\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\coccoc\browser\application\85.0.4183.146\browser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
556"C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1028,13974240105578870032,11730763363503941404,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3164 /prefetch:8C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe
browser.exe
User:
admin
Company:
Coc Coc Co., Ltd.
Integrity Level:
LOW
Description:
CocCoc
Exit code:
0
Version:
85.0.4183.146
Modules
Images
c:\users\admin\appdata\local\coccoc\browser\application\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\coccoc\browser\application\85.0.4183.146\browser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
664C:\Users\admin\AppData\Local\Temp\CR_83491.tmp\setup.exe --type=crashpad-handler /prefetch:7 --no-upload-gzip --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\CocCoc\Browser\User Data\Crashpad" --url=http://cr.browser.coccoc.com/cr/report --annotation=channel= --annotation=plat=Win32 "--annotation=prod=Coc Coc" --annotation=ver=85.0.4183.146 --initial-client-data=0x194,0x198,0x19c,0x168,0x1a0,0x57b020,0x57b030,0x57b03cC:\Users\admin\AppData\Local\Temp\CR_83491.tmp\setup.exe
setup.exe
User:
admin
Company:
Coc Coc Co., Ltd.
Integrity Level:
MEDIUM
Description:
Coc Coc Installer
Exit code:
0
Version:
85.0.4183.146
Modules
Images
c:\users\admin\appdata\local\temp\cr_83491.tmp\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
672"C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe" --type=renderer --field-trial-handle=1028,13974240105578870032,11730763363503941404,131072 --disable-gpu-compositing --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe
browser.exe
User:
admin
Company:
Coc Coc Co., Ltd.
Integrity Level:
LOW
Description:
CocCoc
Exit code:
0
Version:
85.0.4183.146
Modules
Images
c:\users\admin\appdata\local\coccoc\browser\application\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\coccoc\browser\application\85.0.4183.146\browser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
892"C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1028,13974240105578870032,11730763363503941404,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=5788 /prefetch:8C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe
browser.exe
User:
admin
Company:
Coc Coc Co., Ltd.
Integrity Level:
LOW
Description:
CocCoc
Exit code:
0
Version:
85.0.4183.146
Modules
Images
c:\users\admin\appdata\local\coccoc\browser\application\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\coccoc\browser\application\85.0.4183.146\browser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
896"C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe" --type=renderer --field-trial-handle=1028,13974240105578870032,11730763363503941404,131072 --disable-gpu-compositing --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe
browser.exe
User:
admin
Company:
Coc Coc Co., Ltd.
Integrity Level:
LOW
Description:
CocCoc
Exit code:
0
Version:
85.0.4183.146
Modules
Images
c:\users\admin\appdata\local\coccoc\browser\application\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\coccoc\browser\application\85.0.4183.146\browser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
908"C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,13974240105578870032,11730763363503941404,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2732 /prefetch:8C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe
browser.exe
User:
admin
Company:
Coc Coc Co., Ltd.
Integrity Level:
LOW
Description:
CocCoc
Exit code:
0
Version:
85.0.4183.146
Modules
Images
c:\users\admin\appdata\local\coccoc\browser\application\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\coccoc\browser\application\85.0.4183.146\browser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
980"C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe" --type=renderer --field-trial-handle=1028,13974240105578870032,11730763363503941404,131072 --disable-gpu-compositing --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1C:\Users\admin\AppData\Local\CocCoc\Browser\Application\browser.exe
browser.exe
User:
admin
Company:
Coc Coc Co., Ltd.
Integrity Level:
LOW
Description:
CocCoc
Exit code:
0
Version:
85.0.4183.146
Modules
Images
c:\users\admin\appdata\local\coccoc\browser\application\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\coccoc\browser\application\85.0.4183.146\browser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
5 207
Read events
2 340
Write events
2 846
Delete events
21

Modification events

(PID) Process:(1424) CocCocUpdate.exeKey:HKEY_CURRENT_USER\Software\CocCoc\Update
Operation:writeName:path
Value:
C:\Users\admin\AppData\Local\CocCoc\Update\CocCocUpdate.exe
(PID) Process:(1424) CocCocUpdate.exeKey:HKEY_CURRENT_USER\Software\CocCoc\Update
Operation:writeName:UninstallCmdLine
Value:
"C:\Users\admin\AppData\Local\CocCoc\Update\CocCocUpdate.exe" /uninstall
(PID) Process:(1424) CocCocUpdate.exeKey:HKEY_CURRENT_USER\Software\CocCoc\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}
Operation:writeName:pv
Value:
2.5.15.117
(PID) Process:(1424) CocCocUpdate.exeKey:HKEY_CURRENT_USER\Software\CocCoc\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}
Operation:writeName:name
Value:
Cốc Cốc Update
(PID) Process:(1424) CocCocUpdate.exeKey:HKEY_CURRENT_USER\Software\CocCoc\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
Operation:writeName:pv
Value:
2.5.15.117
(PID) Process:(1424) CocCocUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:CocCoc Update
Value:
"C:\Users\admin\AppData\Local\CocCoc\Update\CocCocUpdate.exe" /c
(PID) Process:(2444) CocCocUpdate.exeKey:HKEY_CLASSES_ROOT\CLSID\{0A039001-050F-4ADA-AD8B-F2E5C9615B45}\InprocServer32
Operation:writeName:(default)
Value:
C:\Users\admin\AppData\Local\CocCoc\Update\2.5.15.117\psuser.dll
(PID) Process:(2444) CocCocUpdate.exeKey:HKEY_CLASSES_ROOT\CLSID\{0A039001-050F-4ADA-AD8B-F2E5C9615B45}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(2444) CocCocUpdate.exeKey:HKEY_CLASSES_ROOT\CLSID\{F1078DF2-14DE-4AB7-8CAA-A3832BFBB39E}\InprocHandler32
Operation:writeName:(default)
Value:
C:\Users\admin\AppData\Local\CocCoc\Update\2.5.15.117\psuser.dll
(PID) Process:(2444) CocCocUpdate.exeKey:HKEY_CLASSES_ROOT\CLSID\{F1078DF2-14DE-4AB7-8CAA-A3832BFBB39E}\InprocHandler32
Operation:writeName:ThreadingModel
Value:
Both
Executable files
38
Suspicious files
135
Text files
1 227
Unknown types
60

Dropped files

PID
Process
Filename
Type
2180coccoc_en.exeC:\Users\admin\AppData\Local\Temp\GUM3FC2.tmp\CocCocCrashHandler.exeexecutable
MD5:—
SHA256:—
2180coccoc_en.exeC:\Users\admin\AppData\Local\Temp\GUM3FC2.tmp\CocCocUpdate.exeexecutable
MD5:—
SHA256:—
2180coccoc_en.exeC:\Users\admin\AppData\Local\Temp\GUM3FC2.tmp\coccocpdateres_vi.dllexecutable
MD5:—
SHA256:—
2180coccoc_en.exeC:\Users\admin\AppData\Local\Temp\GUM3FC2.tmp\CocCocUpdateSetup.exeexecutable
MD5:—
SHA256:—
2180coccoc_en.exeC:\Users\admin\AppData\Local\Temp\GUM3FC2.tmp\psuser.dllexecutable
MD5:—
SHA256:—
1424CocCocUpdate.exeC:\Users\admin\AppData\Roaming\CocCoc\uidtext
MD5:—
SHA256:—
1424CocCocUpdate.exeC:\Users\admin\AppData\Local\CocCoc\Update\2.5.15.117\CocCocUpdate.exeexecutable
MD5:—
SHA256:—
2180coccoc_en.exeC:\Users\admin\AppData\Local\Temp\GUM3FC2.tmp\coccocpdate.dllexecutable
MD5:—
SHA256:—
1424CocCocUpdate.exeC:\Users\admin\AppData\Local\CocCoc\Update\2.5.15.117\coccocpdate.dllexecutable
MD5:—
SHA256:—
2096CocCocUpdate.exeC:\Users\admin\AppData\Local\CocCoc\Update\Download\{C0CC0CBB-47DD-46FF-A04D-7011A06486E1}\85.0.4183.146\85.0.4183.146_coccocsetup.exe —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
46
TCP/UDP connections
164
DNS requests
116
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
302
142.250.74.206:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvN2MwQUFWdmlaX0VYMlk3YWlITHpVbV9MZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx
US
—
—
whitelisted
3916
browser.exe
GET
301
125.212.247.82:80
http://24h.com.vn/favicon.ico
VN
—
—
whitelisted
—
—
HEAD
200
173.194.129.233:80
http://r4---sn-q0c7rn76.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvN2MwQUFWdmlaX0VYMlk3YWlITHpVbV9MZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx?cms_redirect=yes&mh=cF&mip=185.192.16.5&mm=28&mn=sn-q0c7rn76&ms=nvh&mt=1607028980&mv=m&mvi=4&pl=24&shardbypass=yes
US
—
—
whitelisted
3916
browser.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEChOOcFLOG2InHKZ5YzQWlc%3D
US
der
727 b
whitelisted
2912
CocCocUpdate.exe
POST
200
123.30.175.98:80
http://browser.coccoc.com/service/update2
VN
xml
210 b
malicious
2096
CocCocUpdate.exe
POST
200
123.30.175.98:80
http://browser.coccoc.com/service/update2?cup2key=5:635437282&cup2hreq=80a64484bb367d6d86ff8c21977d7f6c997ecf3947873ee0226656953c845840
VN
xml
813 b
malicious
3916
browser.exe
GET
200
151.139.128.14:80
http://crl.comodoca.com/AAACertificateServices.crl
US
der
506 b
whitelisted
—
—
GET
302
142.250.74.206:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvN2MwQUFWdmlaX0VYMlk3YWlITHpVbV9MZw/0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx
US
html
523 b
whitelisted
3916
browser.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS83pEmglYTXfyF78OS%2BRiTRWadkgQULGn%2FgMmHkK404bTnTJOFmUDpp7ICECk%2Baa7DrIG9rq59LAqCuao%3D
US
der
471 b
whitelisted
3916
browser.exe
GET
200
123.30.175.11:80
http://service.corom.vn/service/update2/crx?os=win&arch=x86&os_arch=x86&nacl_arch=x86-32&prod=chromiumcrx&prodchannel=&prodversion=85.0.4183.146&lang=en-US&acceptformat=crx3&x=id%3Dgfgbmghkdjckppeomloefmbphdfmokgd%26v%3D1.3.9%26installsource%3Dnotfromwebstore%26installedby%3Dexternal%26uc
VN
xml
214 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1840
CocCocUpdate.exe
123.30.175.98:80
browser.coccoc.com
VNPT Corp
VN
unknown
2096
CocCocUpdate.exe
123.30.175.98:80
browser.coccoc.com
VNPT Corp
VN
unknown
—
—
123.30.175.23:443
download.coccoc.com
VNPT Corp
VN
suspicious
2912
CocCocUpdate.exe
123.30.175.98:80
browser.coccoc.com
VNPT Corp
VN
unknown
3916
browser.exe
123.30.175.98:443
browser.coccoc.com
VNPT Corp
VN
unknown
3916
browser.exe
64.233.165.139:443
clients2.google.com
Google Inc.
US
whitelisted
3916
browser.exe
142.250.74.206:443
redirector.gvt1.com
Google Inc.
US
whitelisted
3916
browser.exe
172.217.18.3:443
ssl.gstatic.com
Google Inc.
US
whitelisted
4084
browser.exe
185.157.221.247:25401
dht.libtorrent.org
—
SE
suspicious
—
—
93.39.140.205:16661
—
Fastweb
IT
unknown

DNS requests

Domain
IP
Reputation
browser.coccoc.com
  • 123.30.175.98
malicious
download.coccoc.com
  • 123.30.175.23
  • 123.30.175.16
suspicious
coccoc.com
  • 123.30.175.29
whitelisted
clients2.google.com
  • 64.233.165.139
  • 64.233.165.101
  • 64.233.165.102
  • 64.233.165.113
  • 64.233.165.100
  • 64.233.165.138
whitelisted
redirector.gvt1.com
  • 142.250.74.206
whitelisted
ssl.gstatic.com
  • 172.217.18.3
whitelisted
accounts.coccoc.com
  • —
unknown
dht.libtorrent.org
  • 185.157.221.247
suspicious
r3---sn-q0c7rn76.gvt1.com
  • 173.194.129.232
whitelisted
cdn2.cache.vn
  • 123.30.168.3
suspicious

Threats

PID
Process
Class
Message
1840
CocCocUpdate.exe
Not Suspicious Traffic
ET POLICY COCCOC Browser (VN) Installed
2096
CocCocUpdate.exe
Not Suspicious Traffic
ET POLICY COCCOC Browser (VN) Installed
2912
CocCocUpdate.exe
Not Suspicious Traffic
ET POLICY COCCOC Browser (VN) Installed
—
—
Potential Corporate Privacy Violation
ET P2P BitTorrent DHT ping request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
coccoc_en.exe