URL:

https://coccoc.com/

Full analysis: https://app.any.run/tasks/c4dfc358-5356-4b74-a841-70480b826ca3
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: September 03, 2025, 17:36:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
anti-evasion
github
evasion
Indicators:
MD5:

EBE64CAACC41D338B00630A4760BF061

SHA1:

50F070253815F4CBD2D2EE98237E650DD7314310

SHA256:

E2F8A34EF9F19E4DDCE87274CCF5F448A854D3D061C19852FD312016892E7FC9

SSDEEP:

3:N8XRJGK3n:2bGG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • CocCocUpdate.exe (PID: 5476)
      • csrss.exe (PID: 608)
      • CocCocUpdate.exe (PID: 2848)
      • CocCocUpdate.exe (PID: 6180)
      • CocCocUpdate.exe (PID: 7792)
      • CocCocUpdate.exe (PID: 3940)
      • CocCocUpdate.exe (PID: 2188)
      • csrss.exe (PID: 524)
      • CocCocUpdate.exe (PID: 1352)
      • setup.exe (PID: 6860)
      • 139.0.7258.158_coccocsetup.exe (PID: 7644)
      • setup.exe (PID: 7212)
      • setup.exe (PID: 7388)
      • setup.exe (PID: 8104)
      • setup.exe (PID: 8080)
      • setup.exe (PID: 8048)
      • CocCocCrashHandler.exe (PID: 5300)
      • CocCocCrashHandler64.exe (PID: 8016)
      • CocCocUpdate.exe (PID: 7768)
      • CocCocUpdate.exe (PID: 7844)
      • browser.exe (PID: 7588)
      • browser.exe (PID: 7228)
      • CocCocUpdateSetup.exe (PID: 1160)
      • browser.exe (PID: 4936)
      • browser.exe (PID: 2076)
      • elevation_service.exe (PID: 3112)
      • browser.exe (PID: 1336)
      • browser.exe (PID: 7696)
      • browser.exe (PID: 7260)
      • browser.exe (PID: 6348)
      • browser.exe (PID: 2596)
      • browser.exe (PID: 6220)
      • browser.exe (PID: 3820)
      • browser.exe (PID: 3092)
      • browser.exe (PID: 2320)
      • browser.exe (PID: 8160)
      • browser.exe (PID: 4832)
      • browser.exe (PID: 6812)
      • browser.exe (PID: 7464)
      • browser.exe (PID: 2664)
      • browser.exe (PID: 7980)
      • browser.exe (PID: 7920)
      • browser.exe (PID: 7692)
      • browser.exe (PID: 4664)
      • browser.exe (PID: 8068)
      • browser.exe (PID: 7444)
      • browser.exe (PID: 7528)
      • browser.exe (PID: 7312)
      • browser.exe (PID: 6308)
      • browser.exe (PID: 4724)
      • browser.exe (PID: 6600)
      • chrmstp.exe (PID: 4680)
      • chrmstp.exe (PID: 1128)
      • chrmstp.exe (PID: 8180)
      • chrmstp.exe (PID: 1936)
      • browser.exe (PID: 7244)
      • browser.exe (PID: 3844)
      • browser.exe (PID: 3112)
      • browser.exe (PID: 5456)
      • browser.exe (PID: 8084)
      • browser.exe (PID: 8088)
      • browser.exe (PID: 7384)
      • browser.exe (PID: 7700)
      • browser.exe (PID: 7800)
      • browser.exe (PID: 7336)
      • browser.exe (PID: 6016)
      • browser.exe (PID: 7040)
      • browser.exe (PID: 7420)
      • browser.exe (PID: 5548)
      • browser.exe (PID: 4228)
      • browser.exe (PID: 6288)
      • browser.exe (PID: 6332)
      • browser.exe (PID: 4264)
      • browser.exe (PID: 4788)
      • browser.exe (PID: 8120)
      • browser.exe (PID: 8116)
      • browser.exe (PID: 3488)
      • browser.exe (PID: 5528)
      • browser.exe (PID: 5400)
      • browser.exe (PID: 3624)
      • browser.exe (PID: 7780)
      • browser.exe (PID: 1936)
      • browser.exe (PID: 8136)
      • browser.exe (PID: 4680)
      • browser.exe (PID: 7568)
      • browser.exe (PID: 592)
      • browser.exe (PID: 7636)
      • browser.exe (PID: 3704)
      • browser.exe (PID: 6900)
      • browser.exe (PID: 7680)
      • browser.exe (PID: 7352)
      • browser.exe (PID: 6688)
      • browser.exe (PID: 7104)
      • browser.exe (PID: 5400)
      • browser.exe (PID: 7700)
      • browser.exe (PID: 6720)
      • browser.exe (PID: 7540)
      • browser.exe (PID: 6788)
      • browser.exe (PID: 6544)
      • browser.exe (PID: 7712)
      • browser.exe (PID: 2508)
      • browser.exe (PID: 1704)
      • browser.exe (PID: 5220)
      • browser.exe (PID: 3476)

    • Changes the autorun value in the registry

      • setup.exe (PID: 6860)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • mshta.exe (PID: 8116)
      • mshta.exe (PID: 7700)
      • mshta.exe (PID: 7528)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • CocCocSetup.exe (PID: 1712)
      • CocCocUpdateSetup.exe (PID: 1160)
      • CocCocUpdate.exe (PID: 6180)
      • 139.0.7258.158_coccocsetup.exe (PID: 7644)
      • setup.exe (PID: 6860)

    • Reads security settings of Internet Explorer

      • CocCocUpdate.exe (PID: 5476)
      • CocCocUpdate.exe (PID: 6180)
      • setup.exe (PID: 6860)
      • browser.exe (PID: 7588)
      • chrmstp.exe (PID: 1936)
      • browser.exe (PID: 3112)
      • browser.exe (PID: 5456)
      • browser.exe (PID: 7384)
      • browser.exe (PID: 7800)
      • browser.exe (PID: 7336)
      • browser.exe (PID: 6016)
      • browser.exe (PID: 6288)
      • browser.exe (PID: 4228)

    • Starts itself from another location

      • CocCocUpdate.exe (PID: 6180)
      • setup.exe (PID: 6860)

    • Creates/Modifies COM task schedule object

      • CocCocUpdateComRegisterShell64.exe (PID: 5528)
      • CocCocUpdate.exe (PID: 2848)
      • CocCocUpdateComRegisterShell64.exe (PID: 8168)
      • CocCocUpdateComRegisterShell64.exe (PID: 4692)

    • Disables SEHOP

      • CocCocUpdate.exe (PID: 6180)

    • Executes as Windows Service

      • CocCocUpdate.exe (PID: 1352)
      • elevation_service.exe (PID: 3112)

    • There is functionality for taking screenshot (YARA)

      • CocCocUpdate.exe (PID: 5476)
      • CocCocUpdate.exe (PID: 6180)
      • CocCocUpdate.exe (PID: 2188)
      • CocCocUpdate.exe (PID: 1352)

    • Application launched itself

      • setup.exe (PID: 6860)
      • setup.exe (PID: 7388)
      • setup.exe (PID: 8080)
      • CocCocUpdate.exe (PID: 1352)
      • browser.exe (PID: 7588)
      • chrmstp.exe (PID: 4680)
      • chrmstp.exe (PID: 1936)

    • Searches for installed software

      • setup.exe (PID: 6860)
      • setup.exe (PID: 7388)
      • setup.exe (PID: 8080)
      • chrmstp.exe (PID: 4680)
      • chrmstp.exe (PID: 1936)
      • browser.exe (PID: 7588)

    • Creates a software uninstall entry

      • setup.exe (PID: 6860)

    • Reads the date of Windows installation

      • setup.exe (PID: 6860)
      • chrmstp.exe (PID: 1936)

    • The process checks if it is being run in the virtual environment

      • browser.exe (PID: 7588)

    • Connects to unusual port

      • browser.exe (PID: 4936)

    • Checks for external IP

      • browser.exe (PID: 4936)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 5620)
      • firefox.exe (PID: 6948)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 6948)

    • Checks supported languages

      • CocCocSetup.exe (PID: 1712)
      • CocCocUpdate.exe (PID: 5476)
      • CocCocUpdateSetup.exe (PID: 1160)
      • CocCocUpdate.exe (PID: 6180)
      • CocCocUpdate.exe (PID: 7792)
      • CocCocUpdate.exe (PID: 2848)
      • CocCocUpdateComRegisterShell64.exe (PID: 5528)
      • CocCocUpdateComRegisterShell64.exe (PID: 8168)
      • CocCocUpdateComRegisterShell64.exe (PID: 4692)
      • CocCocUpdate.exe (PID: 3940)
      • CocCocUpdate.exe (PID: 2188)
      • CocCocUpdate.exe (PID: 1352)
      • 139.0.7258.158_coccocsetup.exe (PID: 7644)
      • setup.exe (PID: 6860)
      • setup.exe (PID: 7212)
      • setup.exe (PID: 7388)
      • setup.exe (PID: 8104)
      • setup.exe (PID: 8080)
      • setup.exe (PID: 8048)
      • CocCocUpdate.exe (PID: 7768)
      • CocCocCrashHandler.exe (PID: 5300)
      • CocCocCrashHandler64.exe (PID: 8016)
      • CocCocUpdateOnDemand.exe (PID: 7772)
      • CocCocUpdate.exe (PID: 7844)
      • browser.exe (PID: 7588)
      • browser.exe (PID: 7260)
      • browser.exe (PID: 4936)
      • browser.exe (PID: 7228)
      • browser.exe (PID: 1336)
      • browser.exe (PID: 2320)
      • browser.exe (PID: 7696)
      • browser.exe (PID: 2596)
      • browser.exe (PID: 2076)
      • browser.exe (PID: 6348)
      • browser.exe (PID: 6220)
      • browser.exe (PID: 3820)
      • browser.exe (PID: 8160)
      • elevation_service.exe (PID: 3112)
      • browser.exe (PID: 3092)
      • browser.exe (PID: 6812)
      • browser.exe (PID: 4832)
      • browser.exe (PID: 7464)
      • browser.exe (PID: 2664)
      • browser.exe (PID: 7980)
      • browser.exe (PID: 7920)
      • browser.exe (PID: 7692)
      • browser.exe (PID: 4664)
      • browser.exe (PID: 7444)
      • browser.exe (PID: 8068)
      • browser.exe (PID: 7528)
      • browser.exe (PID: 7312)
      • browser.exe (PID: 6308)
      • browser.exe (PID: 4724)
      • browser.exe (PID: 6600)
      • chrmstp.exe (PID: 4680)
      • chrmstp.exe (PID: 1128)
      • chrmstp.exe (PID: 1936)
      • chrmstp.exe (PID: 8180)
      • browser.exe (PID: 7244)
      • browser.exe (PID: 3844)
      • browser.exe (PID: 3112)
      • browser.exe (PID: 5456)
      • browser.exe (PID: 8084)
      • browser.exe (PID: 8088)
      • browser.exe (PID: 7384)
      • browser.exe (PID: 7700)
      • browser.exe (PID: 7800)
      • browser.exe (PID: 7420)
      • browser.exe (PID: 7336)
      • browser.exe (PID: 6016)
      • browser.exe (PID: 7040)
      • browser.exe (PID: 4264)
      • browser.exe (PID: 5548)
      • browser.exe (PID: 6288)
      • browser.exe (PID: 4228)
      • browser.exe (PID: 6332)
      • browser.exe (PID: 3476)
      • browser.exe (PID: 4788)
      • browser.exe (PID: 5400)
      • browser.exe (PID: 8120)
      • browser.exe (PID: 3488)
      • browser.exe (PID: 8116)
      • browser.exe (PID: 5528)
      • browser.exe (PID: 7568)
      • browser.exe (PID: 3624)
      • browser.exe (PID: 7780)
      • browser.exe (PID: 8136)
      • browser.exe (PID: 1936)
      • browser.exe (PID: 4680)
      • browser.exe (PID: 592)
      • browser.exe (PID: 3704)
      • browser.exe (PID: 7636)
      • browser.exe (PID: 6900)
      • browser.exe (PID: 7680)
      • browser.exe (PID: 7104)
      • browser.exe (PID: 6688)
      • browser.exe (PID: 5400)
      • browser.exe (PID: 7700)
      • browser.exe (PID: 6720)
      • browser.exe (PID: 7352)
      • browser.exe (PID: 7540)
      • browser.exe (PID: 6788)
      • browser.exe (PID: 6544)
      • browser.exe (PID: 7712)
      • browser.exe (PID: 1704)
      • browser.exe (PID: 2508)
      • browser.exe (PID: 5220)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 6948)

    • The sample compiled with english language support

      • firefox.exe (PID: 6948)
      • CocCocSetup.exe (PID: 1712)
      • CocCocUpdate.exe (PID: 6180)
      • CocCocUpdateSetup.exe (PID: 1160)
      • 139.0.7258.158_coccocsetup.exe (PID: 7644)
      • setup.exe (PID: 6860)

    • Launching a file from the Downloads directory

      • firefox.exe (PID: 6948)

    • Create files in a temporary directory

      • CocCocSetup.exe (PID: 1712)
      • setup.exe (PID: 6860)
      • browser.exe (PID: 7588)

    • Reads the computer name

      • CocCocUpdate.exe (PID: 5476)
      • CocCocUpdate.exe (PID: 6180)
      • CocCocUpdate.exe (PID: 7792)
      • CocCocUpdate.exe (PID: 2848)
      • CocCocUpdate.exe (PID: 2188)
      • CocCocUpdate.exe (PID: 3940)
      • CocCocUpdate.exe (PID: 1352)
      • 139.0.7258.158_coccocsetup.exe (PID: 7644)
      • setup.exe (PID: 6860)
      • setup.exe (PID: 7388)
      • setup.exe (PID: 8080)
      • CocCocCrashHandler.exe (PID: 5300)
      • CocCocCrashHandler64.exe (PID: 8016)
      • CocCocUpdate.exe (PID: 7844)
      • CocCocUpdate.exe (PID: 7768)
      • browser.exe (PID: 7588)
      • browser.exe (PID: 7228)
      • browser.exe (PID: 4936)
      • elevation_service.exe (PID: 3112)
      • browser.exe (PID: 6600)
      • chrmstp.exe (PID: 4680)
      • chrmstp.exe (PID: 1936)
      • browser.exe (PID: 3112)
      • browser.exe (PID: 5456)
      • browser.exe (PID: 7384)
      • browser.exe (PID: 7800)
      • browser.exe (PID: 7336)
      • browser.exe (PID: 6016)
      • browser.exe (PID: 6288)
      • browser.exe (PID: 4228)
      • browser.exe (PID: 3476)
      • browser.exe (PID: 5400)
      • browser.exe (PID: 7712)
      • browser.exe (PID: 2508)

    • Creates files or folders in the user directory

      • CocCocUpdate.exe (PID: 5476)
      • setup.exe (PID: 7388)
      • browser.exe (PID: 7260)
      • browser.exe (PID: 7588)
      • browser.exe (PID: 4936)
      • chrmstp.exe (PID: 1936)
      • browser.exe (PID: 3112)
      • browser.exe (PID: 5456)
      • browser.exe (PID: 7384)
      • browser.exe (PID: 7336)
      • browser.exe (PID: 6016)
      • browser.exe (PID: 7800)
      • browser.exe (PID: 4228)
      • browser.exe (PID: 6288)
      • browser.exe (PID: 7712)
      • browser.exe (PID: 2508)

    • Creates files in the program directory

      • CocCocUpdate.exe (PID: 5476)
      • CocCocUpdateSetup.exe (PID: 1160)
      • CocCocUpdate.exe (PID: 6180)
      • CocCocUpdate.exe (PID: 1352)
      • setup.exe (PID: 6860)
      • 139.0.7258.158_coccocsetup.exe (PID: 7644)
      • setup.exe (PID: 7388)
      • setup.exe (PID: 8080)

    • Process checks computer location settings

      • CocCocUpdate.exe (PID: 5476)
      • CocCocUpdate.exe (PID: 6180)
      • setup.exe (PID: 6860)
      • browser.exe (PID: 7588)
      • browser.exe (PID: 2076)
      • browser.exe (PID: 7696)
      • browser.exe (PID: 7464)
      • browser.exe (PID: 2664)
      • browser.exe (PID: 7920)
      • browser.exe (PID: 7692)
      • browser.exe (PID: 7312)
      • browser.exe (PID: 7528)
      • browser.exe (PID: 4724)
      • browser.exe (PID: 6308)
      • browser.exe (PID: 8120)
      • browser.exe (PID: 3488)
      • browser.exe (PID: 7568)
      • browser.exe (PID: 3624)
      • browser.exe (PID: 7780)
      • browser.exe (PID: 8136)
      • browser.exe (PID: 4680)
      • browser.exe (PID: 5528)
      • browser.exe (PID: 1936)
      • browser.exe (PID: 592)
      • browser.exe (PID: 3704)
      • browser.exe (PID: 7636)
      • browser.exe (PID: 6900)
      • browser.exe (PID: 7680)
      • browser.exe (PID: 7540)
      • browser.exe (PID: 6688)
      • browser.exe (PID: 7104)
      • browser.exe (PID: 5400)
      • browser.exe (PID: 7700)
      • browser.exe (PID: 6720)
      • browser.exe (PID: 1704)

    • Checks proxy server information

      • CocCocUpdate.exe (PID: 3940)
      • CocCocUpdate.exe (PID: 2188)
      • CocCocUpdate.exe (PID: 7768)
      • browser.exe (PID: 7588)
      • browser.exe (PID: 5456)
      • browser.exe (PID: 3112)
      • browser.exe (PID: 7384)
      • browser.exe (PID: 7800)
      • browser.exe (PID: 7336)
      • browser.exe (PID: 6016)
      • browser.exe (PID: 4228)
      • browser.exe (PID: 6288)
      • slui.exe (PID: 7512)

    • Reads the software policy settings

      • CocCocUpdate.exe (PID: 2188)
      • setup.exe (PID: 6860)
      • slui.exe (PID: 7512)

    • Launching a file from a Registry key

      • setup.exe (PID: 6860)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 7884)
      • mshta.exe (PID: 8116)
      • mshta.exe (PID: 7700)
      • mshta.exe (PID: 7528)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 6860)
      • browser.exe (PID: 7588)
      • browser.exe (PID: 7712)
      • browser.exe (PID: 2508)

    • Reads CPU info

      • browser.exe (PID: 7588)

    • Reads Environment values

      • browser.exe (PID: 2508)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
278
Monitored processes
130
Malicious processes
105
Suspicious processes
5

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs coccocsetup.exe coccocupdate.exe coccocupdatesetup.exe coccocupdate.exe coccocupdate.exe coccocupdate.exe coccocupdatecomregistershell64.exe no specs coccocupdatecomregistershell64.exe no specs coccocupdatecomregistershell64.exe no specs coccocupdate.exe coccocupdate.exe firefox.exe no specs coccocupdate.exe slui.exe 139.0.7258.158_coccocsetup.exe setup.exe setup.exe setup.exe setup.exe setup.exe setup.exe mshta.exe no specs mshta.exe no specs mshta.exe no specs mshta.exe no specs coccoccrashhandler.exe coccoccrashhandler64.exe coccocupdate.exe coccocupdateondemand.exe no specs coccocupdate.exe browser.exe browser.exe browser.exe browser.exe elevation_service.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe chrmstp.exe chrmstp.exe chrmstp.exe chrmstp.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe browser.exe csrss.exe csrss.exe

Process information

PID
CMD
Path
Indicators
Parent process
524%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\Windows\System32\csrss.exe
—
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Client Server Runtime Process
Version:
10.0.19041.1 (WinBuild.160101.0800)
536"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5684 -prefsLen 39191 -prefMapHandle 5652 -prefMapSize 272997 -jsInitHandle 5656 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 5728 -initialChannelId {07713c42-fb1c-446b-b3ad-5f5f51f69365} -parentPid 6948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\bcrypt.dll
592"C:\Program Files\CocCoc\Browser\Application\browser.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=vi --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=7116,i,8204292590277481878,3894470303317912978,2097152 --field-trial-handle=2068,i,15256678244369185655,11089588152628113547,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1C:\Program Files\CocCoc\Browser\Application\browser.exe
browser.exe
User:
admin
Company:
Coc Coc Company Limited
Integrity Level:
LOW
Description:
CocCoc
Exit code:
0
Version:
139.0.7258.158
Modules
Images
c:\program files\coccoc\browser\application\browser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\coccoc\browser\application\139.0.7258.158\browser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
608%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\Windows\System32\csrss.exe
—
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Client Server Runtime Process
Version:
10.0.19041.1 (WinBuild.160101.0800)
1128"C:\Program Files\CocCoc\Browser\Application\139.0.7258.158\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --no-upload-gzip --monitor-self-annotation=ptype=crashpad-handler --database=C:\WINDOWS\TEMP\Crashpad --url=https://browser-crashes.coccoc.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=CocCoc --annotation=ver=139.0.7258.158 --initial-client-data=0x2a0,0x2a4,0x2a8,0x254,0x2ac,0x7ff7b5835e78,0x7ff7b5835e84,0x7ff7b5835e90C:\Program Files\CocCoc\Browser\Application\139.0.7258.158\Installer\chrmstp.exe
chrmstp.exe
User:
admin
Company:
Coc Coc Company Limited
Integrity Level:
MEDIUM
Description:
CocCoc Installer
Exit code:
0
Version:
139.0.7258.158
Modules
Images
c:\program files\coccoc\browser\application\139.0.7258.158\installer\chrmstp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shell32.dll
1160"C:\Users\admin\AppData\Local\Temp\GUM358D.tmp\CocCocUpdateSetup.exe" /installsource taggedmi /install "appguid={C0CC0CBB-47DD-46FF-A04D-7011A06486E1}&appname=C%E1%BB%91c%20C%E1%BB%91c&needsadmin=prefers&usagestats=1&lang=vi&client={XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}&brand=XXXX&ap=arch_x64" /installelevated /nomitagC:\Users\admin\AppData\Local\Temp\GUM358D.tmp\CocCocUpdateSetup.exe
CocCocUpdate.exe
User:
admin
Company:
Coc Coc Co., Ltd.
Integrity Level:
HIGH
Description:
CocCoc Update Setup
Exit code:
0
Version:
2.9.3.27
Modules
Images
c:\users\admin\appdata\local\temp\gum358d.tmp\coccocupdatesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
1336"C:\Program Files\CocCoc\Browser\Application\browser.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=vi --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=2996,i,3417801657162806900,13437934833832894193,2097152 --field-trial-handle=2068,i,15256678244369185655,11089588152628113547,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:1C:\Program Files\CocCoc\Browser\Application\browser.exe
browser.exe
User:
admin
Company:
Coc Coc Company Limited
Integrity Level:
LOW
Description:
CocCoc
Exit code:
0
Version:
139.0.7258.158
Modules
Images
c:\program files\coccoc\browser\application\browser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\coccoc\browser\application\139.0.7258.158\browser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
1352"C:\Program Files (x86)\CocCoc\Update\CocCocUpdate.exe" /svcC:\Program Files (x86)\CocCoc\Update\CocCocUpdate.exe
services.exe
User:
SYSTEM
Company:
Coc Coc Co., Ltd.
Integrity Level:
SYSTEM
Description:
CocCoc Update
Exit code:
0
Version:
2.9.3.27
Modules
Images
c:\program files (x86)\coccoc\update\coccocupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1704"C:\Program Files\CocCoc\Browser\Application\browser.exe" --type=renderer --instant-process --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=vi --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=7100,i,16588806246665924119,15714954870707759731,2097152 --field-trial-handle=2068,i,15256678244369185655,11089588152628113547,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1C:\Program Files\CocCoc\Browser\Application\browser.exe
browser.exe
User:
admin
Company:
Coc Coc Company Limited
Integrity Level:
LOW
Description:
CocCoc
Exit code:
0
Version:
139.0.7258.158
Modules
Images
c:\program files\coccoc\browser\application\browser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\coccoc\browser\application\139.0.7258.158\browser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1712"C:\Users\admin\Downloads\CocCocSetup.exe" C:\Users\admin\Downloads\CocCocSetup.exe
firefox.exe
User:
admin
Company:
Coc Coc Co., Ltd.
Integrity Level:
MEDIUM
Description:
CocCoc Update Setup
Exit code:
0
Version:
2.9.3.27
Modules
Images
c:\users\admin\downloads\coccocsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
Total events
43 776
Read events
42 151
Write events
1 491
Delete events
134

Modification events

(PID) Process:(6948) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(6948) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(6180) CocCocUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CocCoc\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
Operation:writeName:usagestats
Value:
1
(PID) Process:(6180) CocCocUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CocCoc\Update\ClientState\{C0CC0CBB-47DD-46FF-A04D-7011A06486E1}
Operation:writeName:usagestats
Value:
1
(PID) Process:(6180) CocCocUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CocCoc\Update
Operation:writeName:IsMSIHelperRegistered
Value:
0
(PID) Process:(5528) CocCocUpdateComRegisterShell64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBFA21E1-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(5528) CocCocUpdateComRegisterShell64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2560148E-7680-4457-999A-188115E23484}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(5528) CocCocUpdateComRegisterShell64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B024AFC-D81A-4A60-97F0-B8366FC5CFD8}\InprocHandler32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(5528) CocCocUpdateComRegisterShell64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E5B932C8-7775-4E83-A8EF-6E6E446C03EE}\InProcServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(8168) CocCocUpdateComRegisterShell64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBFA21E1-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32
Operation:delete keyName:(default)
Value:
Executable files
76
Suspicious files
1 207
Text files
592
Unknown types
0

Dropped files

PID
Process
Filename
Type
6948firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
6948firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
6948firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:3134ED3F12E4F4F8643DB90043B0FD7B
SHA256:26E4F122034D7A03F6DA0E707799B09CBEEBDAF8D7A3133A1F7BD894AC72EEA1
6948firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6948firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\protections.sqlite-journalbinary
MD5:E90F8FDFA4F988157DBD62974EEFDF2D
SHA256:F9CC14B037D6242B9A68085BB2D0286E9CA7F7B0D3651DB45A742EC4C29EFD8F
6948firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\safebrowsing-updating\ads-track-digest256.sbstore —
MD5:—
SHA256:—
6948firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6948firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.binbinary
MD5:E3FC1A783723F57DD176551BA95A2197
SHA256:5961DB5898EF50EFAEB4C9D59D2033EA908DD47362214D5DD1CCBD4BAFC11F76
6948firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-walbinary
MD5:6D235779DFDB3232C18074D199DFC74B
SHA256:2C4E44FEC3F3C73AA2D22E62835BDA2899D2EFEC71F0D59B34C02F7F0F5E3560
6948firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\safebrowsing-updating\analytics-track-digest256.sbstore —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
37
TCP/UDP connections
286
DNS requests
413
Threats
168

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6948
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
US
text
90 b
whitelisted
6948
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
US
text
8 b
whitelisted
6948
firefox.exe
POST
200
142.250.184.227:80
http://o.pki.goog/we2
US
binary
281 b
whitelisted
6948
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
US
text
8 b
whitelisted
6948
firefox.exe
POST
200
142.250.184.227:80
http://o.pki.goog/s/wr3/vbw
US
binary
472 b
whitelisted
6948
firefox.exe
POST
200
104.18.21.226:80
http://ocsp.globalsign.com/gsgccr6alphasslca2023
unknown
binary
1.42 Kb
whitelisted
6948
firefox.exe
POST
200
104.18.21.226:80
http://ocsp.globalsign.com/gsgccr6alphasslca2023
unknown
binary
1.42 Kb
whitelisted
6948
firefox.exe
POST
200
142.250.184.227:80
http://o.pki.goog/s/wr3/W6c
US
binary
471 b
whitelisted
6948
firefox.exe
POST
200
142.250.184.227:80
http://o.pki.goog/we2
US
binary
279 b
whitelisted
6948
firefox.exe
POST
200
142.250.184.227:80
http://o.pki.goog/we2
US
binary
279 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7124
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6948
firefox.exe
34.160.144.191:443
content-signature-2.cdn.mozilla.net
GOOGLE
US
whitelisted
6948
firefox.exe
123.30.175.29:443
coccoc.com
VNPT Corp
VN
whitelisted
6948
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
6948
firefox.exe
34.36.137.203:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
unknown
6948
firefox.exe
151.101.1.91:443
firefox.settings.services.mozilla.com
FASTLY
US
whitelisted
6948
firefox.exe
142.250.184.227:80
o.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.78
  • 142.250.185.142
whitelisted
content-signature-2.cdn.mozilla.net
  • 34.160.144.191
whitelisted
content-signature-chains.prod.autograph.services.mozaws.net
  • 34.160.144.191
  • 2600:1901:0:92a9::
whitelisted
coccoc.com
  • 123.30.175.29
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.36.137.203
whitelisted
spocs.getpocket.com
  • 34.36.137.203
whitelisted
mc.prod.ads.prod.webservices.mozgcp.net
  • 34.36.137.203
unknown

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
3940
CocCocUpdate.exe
Not Suspicious Traffic
ET INFO COCCOC Browser (VN) Installed
1352
CocCocUpdate.exe
Not Suspicious Traffic
ET INFO COCCOC Browser (VN) Installed
7768
CocCocUpdate.exe
Not Suspicious Traffic
ET INFO COCCOC Browser (VN) Installed
4936
browser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
4936
browser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
4936
browser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
4936
browser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
4936
browser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
4936
browser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://coccoc.com/