Weird behavior: AMTSO cloudcar.exe and Chrome

[FleischmannTV 9]

Greetings.

 

I know I have already asked this in a somebody else's topic, but since this topic has already been marked as answered I think it would be best to talk about this in a separate topic.

 

The reason I am writing this is because I have witnessed weird behavior of ESET in regards to AMTSO's cloudcar.exe file when I try to download it with Google Chrome.

 

If I download it with right-click \ save-as, it is detected, no problem. If I initiate the download with left-click, it is not detected. Once on the disk, I guess it won't be detected anymore because LiveGrid only works during download, am I correct? Weirdly, sometimes ESET was able to detect cloudcar.exe upon a left-click download as well, though I am not able to reproduce the latter consistently. 

[Marcos 5,074]

We'd need to get a Procmon log from such situation for analysis. Possible explanations:

- the file has already been cached somehow and was not downloaded completely from the web

- the file was downloaded in parts and not as one piece.

[FleischmannTV 9]

It probably has something to do with caching. When I delete the cache in Chrome, detection upon left-click is working as well.