newrock.exe
| Engine | Download Report | Detection | Info |
|---|---|---|---|
|
|
malicious
|
||
|
|
malicious
Score: 100
|
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
|
| IP | Country | Detection |
|---|---|---|
| 38.6.193.13 | United States |  |
| 212.193.52.24 | Russian Federation | |
| 47.52.205.57 | United States |  |
| Click to see the 3 hidden entries | ||
| 209.87.209.205 | United States | |
| 4.59.181.140 | United States | |
| 192.186.7.211 | United States | |
| Name | IP | Detection |
|---|---|---|
| pz.qishia.com | 38.6.193.13 | |
| host-host-file8.com | 212.193.52.24 | |
| host-file-host6.com | 0.0.0.0 | |
| Click to see the 7 hidden entries | ||
| dh.haol23.me | 47.52.205.57 | |
| zonealarm.com | 209.87.209.205 | |
| multisite3.geo.kaspersky.com | 4.59.181.140 | |
| usa.kaspersky.com | 0.0.0.0 | |
| www.zonealarm.com | 0.0.0.0 | |
| www.kaspersky.com | 0.0.0.0 | |
| api.msn.com | 0.0.0.0 | |
| Name | Detection |
|---|---|
| https://createupdate.orghttp://dg2sz7pxs7llf2t25fsbutlvvrjij4pmojugn75cmxnvoshmju6dzcad.onionhttps:/ | |
| https://createupdate.org | |
| http://dg2sz7pxs7llf2t25fsbutlvvrjij4pmojugn75cmxnvoshmju6dzcad.onionS-1-5-21-2246122658-3693405117- | |
| Click to see the 97 hidden entries | |
| http://dg2sz7pxs7llf2t25fsbutlvvrjij4pmojugn75cmxnvoshmju6dzcad.onion | |
| https://zonealarm.com/SILENT/TOSTACK/NOCANCELgethttps://www.kaspersky.comhttps://malwarebytes.comSaR | |
| https://support.zonealarm.com/hc/en-us/community/topics | |
| https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg | |
| http://schemas.micro | |
| https://www.zonealarm.com/www.zonealarm.com | |
| https://zonealarm.com | |
| https://apis.juhe.cn/ip/Example/query.php | |
| http://www.zonealarm.com/ | |
| https://twitter.com/zonealarm | |
| https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT | |
| https://me.kaspersky.com/?ignoreredirects=true | |
| https://www.kaspersky.com.tr/?ignoreredirects=true | |
| https://api.msn.com/$ | |
| http://www.alexa.com/help/webmasters; | |
| https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg | |
| https://blockchain.infoindex | |
| https://zonealarm.com/ | |
| https://bg.kaspersky.com/ | |
| http://www.google.com/feedfetcher.html)HKLM | |
| https://www.kaspersky.co.jp/ | |
| https://g.live.com/odclientsettings/Prod-C: | |
| http://nsis.sf.net/NSIS_Error | |
| https://www.kaspersky.co.kr/ | |
| http://https://_bad_pdb_file.pdb | |
| https://ukraine.kaspersky.com/ | |
| http://help.yahoo.com/help/us/ysearch/slurp)SonyEricssonK550i/R1JD | |
| https://careers.checkpoint.com/careers | |
| http://misc.yahoo.com.cn/help.html)QueryPerformanceFrequency | |
| https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve | |
| http://192.186.7.211:2001/d | |
| https://d3kwb303vesg1m.cloudfront.net/fm/site-editor/89/890f61288e1ab768e7c0af322ec1f3a2/processed/m | |
| http://www.clocx.net/help.php?lang= | |
| https://www.msn.com/en-us/news/opinion/decline-of-decorum-21-essential-manners-today-s-parents-fail- | |
| http://www.google.com/bot.html)Mozilla/5.0 | |
| http://pz.hnlyzqjlb.com/mm2/up/ | |
| https://apis.map.qq.com/ws/location/v1/ip?key=3BFBZ-ZKD3X-LW54A-ZT76D-E7AHO-4RBD5&output=json | |
| http://pz.qishia.com/mm2/up/?sid=12018&d=d948d0e579c75619c97822d3bc12a3a4ad40f6183fc06618769543168ea | |
| http://pz.qishia.com/mm2/up/modup.php | |
| https://www.kaspersky.rs/ | |
| http://search.msn.com/msnbot.htm)msnbot/1.1 | |
| https://www.msn.com/en-us/news/world/ukraine-live-briefing-biden-does-worry-house-drama-will-impact- | |
| https://d3kwb303vesg1m.cloudfront.net/se/com/content/en-global/images/baseline/buttoned-carousel/hom | |
| https://apis.map.qq.com/ws/location/v1/ip?key=3BFBZ-ZKD3X-LW54A-ZT76D-E7AHO-4RBD5&output=jsonstatusr | |
| https://hu.kaspersky.com/ | |
| http://192.186.7.211:2001/6 | |
| http://www.clocx.net | |
| https://powerpoint.office.comcemberZ | |
| https://createupdate.orgMicrosoft | |
| http://192.186.7.211:2001/ | |
| http://pz.qishia.com/mm/up/ | |
| https://www.kaspersky.com.pl/ | |
| https://www.instagram.com/zonealarm | |
| https://cdn.discordapp.com/attachments/1088058556286251082/1111230812579450950/TsgVtmYNoFT.zipMozill | |
| http://www.avantbrowser.com)MOT-V9mm/ | |
| https://www.kaspersky.com/w | |
| http://www.clocx.netopen | |
| https://zonealarm.com/r | |
| https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppin | |
| https://kaspersky.dz | |
| https://usa.kaspersky.com/G | |
| https://turnitin.com/robot/crawlerinfo.html)cannot | |
| https://www.kaspersky.dk/?ignoreredirects=true | |
| https://d3kwb303vesg1m.cloudfront.net/se/com/content/en-global/images/baseline/body-image/crisis-bg/ | |
| https://www.kaspersky.be/?ignoreredirects=true | |
| https://sgtm.kaspersky.de/gtm.js?id= | |
| https://www.msn.com/en-us/news/politics/california-workers-will-get-five-sick-days-instead-of-three- | |
| https://www.kaspersky.pt/?ignoreredirects=true | |
| https://me-en.kaspersky.com/?ignoreredirects=true | |
| https://api.msn.com:443/v1/news/Feed/Windows? | |
| https://zonealarm.com/G | |
| http://www.zonealarm.com/ntly | |
| https://d3kwb303vesg1m.cloudfront.net/se/com/content/en-global/images/baseline/card-based-buyblock/m | |
| https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings | |
| http://pz.qishia.com/mm3/up/modup.php | |
| https://www.kaspersky.de/?ignoreredirects=true | |
| https://api.msn.com/v1/news/Feed/Windows?activityId=C2BB6DDCE8D847D6B779FE8AEC27D161&timeOut=5000&oc | |
| https://blog.zonealarm.com | |
| http://www.spidersoft.com) | |
| https://zonealarm.coma | |
| http://crl.ver) | |
| https://www.linkedin.com/company/zonealarm-by-check-point-software-technologies | |
| https://www.kaspersky.nl/?ignoreredirects=true | |
| http://www.geocities.co.jp/SiliconValley-Sunnyvale/4137/ | |
| https://www.kaspersky.com.hk/ | |
| https://apis.juhe.cn/ip/Example/query.phpclient | |
| http://www.google.com/bot.html)crypto/ecdh: | |
| https://www.kaspersky.ro/ | |
| https://www.kaspersky.com/content/en-global/images/list-check.svg) | |
| http://www.autoitscript.com/autoit3/J | |
| https://usa.kaspersky.com/ | |
| https://www.av-test.org/en/antivirus/home-windows/windows-10/october-2016/check-point-zonealarm-free | |
| https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi | |
| https://www.youtube.com/zonealarmsecurity | |
| https://www.kaspersky.it/?ignoreredirects=true | |
| https://www.kaspersky.co.in/?ignoreredirects=true | |
| http://www.exabot.com/go/robot)Opera/9.80 | |
| Name | File Type | Hashes | Detection |
|---|---|---|---|
C:\Program Files (x86)\ClocX\ClocX.exe |
PE32 executable (GUI) Intel 80386, for MS Windows | # | |
C:\Program Files (x86)\ClocX\uninst.exe |
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive | # | |
C:\Program Files\Windows Media Player\Media Renderer\Macro.dll |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows | # | |
| Click to see the 9 hidden entries | |||
C:\Users\user\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe |
PE32 executable (GUI) Intel 80386, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\InstallSetup9.exe |
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive | # | |
C:\Users\user\AppData\Local\Temp\etopt.exe |
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive | # | |
C:\Users\user\AppData\Local\Temp\nseC2BB.tmp\INetC.dll |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\nseC2BB.tmp\Math.dll |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\nsgC701.tmp\Checker.dll |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\nsgC701.tmp\Zip.dll |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\toolspub2.exe |
PE32 executable (GUI) Intel 80386, for MS Windows | # | |
C:\Users\user\AppData\Roaming\sfswjif |
PE32 executable (GUI) Intel 80386, for MS Windows | # | |
