0744fc49542e9f49bede4f3d77af6948de840427eee8605f550728f3ea73ae1c

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7v20201028
submitted
13-01-2021 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
Size

87KB
MD5

2697ee202d509638e865095955f0556c
SHA1

a4715014bcbb7407dec8e988f20359b528c2b22d
SHA256

0744fc49542e9f49bede4f3d77af6948de840427eee8605f550728f3ea73ae1c
SHA512

715de4c0916d6e391fa15dbe8c60344e0f981c7f8abf2216aa28c37925bf28f7079808ef350d8deec5b46f2f5a86a46c11cac141f068d40ec966e85e3f41d874

Score

10^/10

discovery persistence upx

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Executes dropped EXE 28 IoCs

Processes:

setup_9gj6v36a-0F.exesetup.exesetup.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exe

pid	process
1012	setup_9gj6v36a-0F.exe
512	setup.exe
2016	setup.exe
340	webnavigatorbrowser.exe
1876	webnavigatorbrowser.exe
1492	webnavigatorbrowser.exe
588	webnavigatorbrowser.exe
2032	webnavigatorbrowser.exe
1636	webnavigatorbrowser.exe
632	webnavigatorbrowser.exe
1020	webnavigatorbrowser.exe
1780	webnavigatorbrowser.exe
2556	webnavigatorbrowser.exe
2648	webnavigatorbrowser.exe
2696	webnavigatorbrowser.exe
2744	webnavigatorbrowser.exe
2792	webnavigatorbrowser.exe
2804	webnavigatorbrowser.exe
2820	webnavigatorbrowser.exe
2900	webnavigatorbrowser.exe
2952	webnavigatorbrowser.exe
3000	webnavigatorbrowser.exe
3048	webnavigatorbrowser.exe
2300	webnavigatorbrowser.exe
2368	webnavigatorbrowser.exe
2456	webnavigatorbrowser.exe
2528	webnavigatorbrowser.exe
1492	webnavigatorbrowser.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll	upx

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

webnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exewebnavigatorbrowser.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\International\Geo\Nation	webnavigatorbrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\International\Geo\Nation	webnavigatorbrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\International\Geo\Nation	webnavigatorbrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\International\Geo\Nation	webnavigatorbrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\International\Geo\Nation	webnavigatorbrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\International\Geo\Nation	webnavigatorbrowser.exe

Loads dropped DLL 152 IoCs

Processes:

Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exesetup_9gj6v36a-0F.exe

pid	process
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe
1012	setup_9gj6v36a-0F.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\WebNavigator\setup_9gj6v36a-0F.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\WebNavigator\setup_9gj6v36a-0F.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\WebNavigator\setup_9gj6v36a-0F.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\WebNavigator\setup_9gj6v36a-0F.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\WebNavigator\setup_9gj6v36a-0F.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\WebNavigator\setup_9gj6v36a-0F.exe	nsis_installer_2

Modifies registry class 87 IoCs

Processes:

setup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\CLSID\{9CD78CBC-FD21-4FFF-B452-9D792A58B7C4}	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU\shell\open	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.html\OpenWithProgids	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pdf\OpenWithProgids	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.shtml	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\http\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\OpenWithProgIds\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pdf	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\.html\ = "WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\.shtml\ = "WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\.xht	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\.xhtml	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\ftp\shell\open\command\ = "\"C:\\Users\\Admin\\WebNavigatorBrowser\\webnavigatorbrowser.exe\" --single-argument %1"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\http\shell\open	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\http\shell\open\command\ = "\"C:\\Users\\Admin\\WebNavigatorBrowser\\webnavigatorbrowser.exe\" --single-argument %1"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\http\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\https\shell\open\command\ = "\"C:\\Users\\Admin\\WebNavigatorBrowser\\webnavigatorbrowser.exe\" --single-argument %1"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\https\shell\ = "open"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU\Application\ApplicationCompany = "Better Cloud Solutions Ltd"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xht\OpenWithProgIds\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.webp\OpenWithProgids\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\ftp\shell\open\command	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\ftp\shell\open\ddeexec\	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xhtml	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\.xhtml\ = "WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\ftp\shell	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\http\DefaultIcon\ = "C:\\Users\\Admin\\WebNavigatorBrowser\\webnavigatorbrowser.exe,0"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\http\shell\ = "open"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU\ = "WebNavigatorBrowser HTML Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU\Application\ApplicationDescription = "Access the Internet"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\https\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU\DefaultIcon\ = "C:\\Users\\Admin\\WebNavigatorBrowser\\webnavigatorbrowser.exe,0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU\Application\AppUserModelId = "WebNavigatorBrowser.UENN6VEYKQOUGISAG33ZS7LFRU"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.shtml\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\.shtml	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\https\shell	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xht	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\ftp	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\ftp\URL Protocol	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\ftp\DefaultIcon	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\https\shell\open	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\CLSID\{9CD78CBC-FD21-4FFF-B452-9D792A58B7C4}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU\Application\ApplicationIcon = "C:\\Users\\Admin\\WebNavigatorBrowser\\webnavigatorbrowser.exe,0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithProgIds\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\https\DefaultIcon\ = "C:\\Users\\Admin\\WebNavigatorBrowser\\webnavigatorbrowser.exe,0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\https\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\CLSID\{9CD78CBC-FD21-4FFF-B452-9D792A58B7C4}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\WebNavigatorBrowser\\2.5.0.0\\notification_helper.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.htm	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.shtml\OpenWithProgids\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.svg\OpenWithProgIds\WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xht\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\http	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\http\URL Protocol	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\https\URL Protocol	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\https\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.html	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.webp\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\.htm\ = "WebNavHTML.UENN6VEYKQOUGISAG33ZS7LFRU"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\ftp\DefaultIcon\ = "C:\\Users\\Admin\\WebNavigatorBrowser\\webnavigatorbrowser.exe,0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\ftp\shell\open	setup.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

setup.exewebnavigatorbrowser.exe

pid process

512 setup.exe
512 setup.exe
512 setup.exe
512 setup.exe
340 webnavigatorbrowser.exe
340 webnavigatorbrowser.exe

pid	process
512	setup.exe
512	setup.exe
512	setup.exe
512	setup.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe

Suspicious use of FindShellTrayWindow 38 IoCs

Processes:

webnavigatorbrowser.exe

pid	process
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe

Suspicious use of SendNotifyMessage 35 IoCs

Processes:

webnavigatorbrowser.exe

pid	process
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe
340	webnavigatorbrowser.exe

Suspicious use of WriteProcessMemory 928 IoCs

Processes:

Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exesetup_9gj6v36a-0F.exesetup.exewebnavigatorbrowser.exe

description	pid	process	target process
PID 1676 wrote to memory of 1012	1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe	setup_9gj6v36a-0F.exe
PID 1676 wrote to memory of 1012	1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe	setup_9gj6v36a-0F.exe
PID 1676 wrote to memory of 1012	1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe	setup_9gj6v36a-0F.exe
PID 1676 wrote to memory of 1012	1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe	setup_9gj6v36a-0F.exe
PID 1676 wrote to memory of 1012	1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe	setup_9gj6v36a-0F.exe
PID 1676 wrote to memory of 1012	1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe	setup_9gj6v36a-0F.exe
PID 1676 wrote to memory of 1012	1676	Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe	setup_9gj6v36a-0F.exe
PID 1012 wrote to memory of 512	1012	setup_9gj6v36a-0F.exe	setup.exe
PID 1012 wrote to memory of 512	1012	setup_9gj6v36a-0F.exe	setup.exe
PID 1012 wrote to memory of 512	1012	setup_9gj6v36a-0F.exe	setup.exe
PID 1012 wrote to memory of 512	1012	setup_9gj6v36a-0F.exe	setup.exe
PID 1012 wrote to memory of 512	1012	setup_9gj6v36a-0F.exe	setup.exe
PID 1012 wrote to memory of 512	1012	setup_9gj6v36a-0F.exe	setup.exe
PID 1012 wrote to memory of 512	1012	setup_9gj6v36a-0F.exe	setup.exe
PID 512 wrote to memory of 2016	512	setup.exe	setup.exe
PID 512 wrote to memory of 2016	512	setup.exe	setup.exe
PID 512 wrote to memory of 2016	512	setup.exe	setup.exe
PID 512 wrote to memory of 2016	512	setup.exe	setup.exe
PID 512 wrote to memory of 2016	512	setup.exe	setup.exe
PID 512 wrote to memory of 2016	512	setup.exe	setup.exe
PID 512 wrote to memory of 2016	512	setup.exe	setup.exe
PID 512 wrote to memory of 340	512	setup.exe	webnavigatorbrowser.exe
PID 512 wrote to memory of 340	512	setup.exe	webnavigatorbrowser.exe
PID 512 wrote to memory of 340	512	setup.exe	webnavigatorbrowser.exe
PID 512 wrote to memory of 340	512	setup.exe	webnavigatorbrowser.exe
PID 512 wrote to memory of 340	512	setup.exe	webnavigatorbrowser.exe
PID 512 wrote to memory of 340	512	setup.exe	webnavigatorbrowser.exe
PID 512 wrote to memory of 340	512	setup.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1876	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1876	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1876	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1876	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1876	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1876	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1876	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe
PID 340 wrote to memory of 1492	340	webnavigatorbrowser.exe	webnavigatorbrowser.exe

C:\Users\Admin\AppData\Local\Temp\Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe
"C:\Users\Admin\AppData\Local\Temp\Click HERE to start the File Launcher by WebNavigator Installer_9gj6v36a_.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\WebNavigator\setup_9gj6v36a-0F.exe
  "C:\Users\Admin\AppData\Local\Temp\WebNavigator\setup_9gj6v36a-0F.exe" /DWID=9gj6v36a-0F /S /R
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Users\Admin\AppData\Local\Temp\nssDF29.tmp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\nssDF29.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\nssDF29.tmp\webnavigatorbrowser.packed.7z" --wid=9gj6v36a --make-chrome-default
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:512
  - - C:\Users\Admin\AppData\Local\Temp\nssDF29.tmp\setup.exe
      C:\Users\Admin\AppData\Local\Temp\nssDF29.tmp\setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\WebNavigatorBrowser\User Data\Crashpad" --annotation=plat=Win32 --annotation=prod=WebNavigatorBrowser --annotation=ver=2.5.0.0 --initial-client-data=0x198,0x19c,0x1a0,0x16c,0x1a4,0xd8e618,0xd8e628,0xd8e634
      4⤵
      Executes dropped EXE
      PID:2016
  - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
      "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --install-type=1
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:340
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\WebNavigatorBrowser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\WebNavigatorBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\WebNavigatorBrowser\User Data" --annotation=plat=Win32 --annotation=prod=WebNavigatorBrowser --annotation=ver=2.5.0.0 --initial-client-data=0x140,0x144,0x148,0x114,0x14c,0x738f59f8,0x738f5a08,0x738f5a14
        5⤵
        Executes dropped EXE
        
        PID:1876
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=gpu-process --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1108 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:1492
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1344 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:588
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1792 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2032
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:1
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:1636
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=renderer --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2224 /prefetch:1
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:1020
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=renderer --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2188 /prefetch:1
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:632
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:1780
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=gpu-process --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1100 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:2556
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4188 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2648
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4024 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2696
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4332 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2744
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3924 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2792
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3820 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2820
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3800 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2804
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3740 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2900
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3808 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2952
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3720 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:3000
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3744 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:3048
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=renderer --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:2300
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=renderer --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:2368
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3964 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2456
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3896 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:2528
    - - C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe
        
        "C:\Users\Admin\WebNavigatorBrowser\webnavigatorbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=936 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WebNavigator\setup_9gj6v36a-0F.exe

MD5
c23c8ee9b9215bdf2d89d3f3d7e66481

SHA1
0ddb5bd78884a3fd9ce9dd0dc88790ae2c499cfe

SHA256
bbff0d61cbc6257f3335f770c29a7e55c79e42fa54d554cab3262e584683107a

SHA512
0e659402960bdff61f5ba38cd8f5342a2c732733c473a829d1ba50d43b5eee130be534b377cd910a488017586d020b28db7c74d72677b23fe0dc17ea3e99e403

Download Submit
C:\Users\Admin\AppData\Local\Temp\WebNavigator\setup_9gj6v36a-0F.exe

MD5
c23c8ee9b9215bdf2d89d3f3d7e66481

SHA1
0ddb5bd78884a3fd9ce9dd0dc88790ae2c499cfe

SHA256
bbff0d61cbc6257f3335f770c29a7e55c79e42fa54d554cab3262e584683107a

SHA512
0e659402960bdff61f5ba38cd8f5342a2c732733c473a829d1ba50d43b5eee130be534b377cd910a488017586d020b28db7c74d72677b23fe0dc17ea3e99e403

Download Submit
\Users\Admin\AppData\Local\Temp\WebNavigator\setup_9gj6v36a-0F.exe

MD5
c23c8ee9b9215bdf2d89d3f3d7e66481

SHA1
0ddb5bd78884a3fd9ce9dd0dc88790ae2c499cfe

SHA256
bbff0d61cbc6257f3335f770c29a7e55c79e42fa54d554cab3262e584683107a

SHA512
0e659402960bdff61f5ba38cd8f5342a2c732733c473a829d1ba50d43b5eee130be534b377cd910a488017586d020b28db7c74d72677b23fe0dc17ea3e99e403

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\System.dll

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\inetc.dll

MD5
d7a3fa6a6c738b4a3c40d5602af20b08

SHA1
34fc75d97f640609cb6cadb001da2cb2c0b3538a

SHA256
67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

SHA512
75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsDialogs.dll

MD5
ab101f38562c8545a641e95172c354b4

SHA1
ec47ac5449f6ee4b14f6dd7ddde841a3e723e567

SHA256
3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea

SHA512
72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsi7273.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\System.dll

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsDialogs.dll

MD5
ab101f38562c8545a641e95172c354b4

SHA1
ec47ac5449f6ee4b14f6dd7ddde841a3e723e567

SHA256
3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea

SHA512
72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nssDF29.tmp\nsResize.dll

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
memory/340-70-0x0000000000000000-mapping.dmp

Download
memory/512-68-0x0000000000000000-mapping.dmp

Download
memory/588-75-0x0000000000000000-mapping.dmp

Download
memory/632-152-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-119-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-160-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-159-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-94-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-95-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-96-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-97-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-85-0x0000000000000000-mapping.dmp

Download
memory/632-98-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-99-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-153-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-100-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-151-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-150-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-149-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-148-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-147-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-144-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-143-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-146-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-145-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-142-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-141-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-140-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-139-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-138-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-137-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-136-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-135-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-134-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-133-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-132-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-131-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-130-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-129-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-128-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-127-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-126-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-125-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-124-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-122-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-123-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-121-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-120-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-101-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-118-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-117-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-116-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-115-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-114-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-113-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-112-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-111-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-110-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-109-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-108-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-107-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-106-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-105-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-103-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-102-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/632-104-0x00000000005F0000-0x00000000005F009C-memory.dmp

Filesize
156B

Download
memory/940-33-0x000007FEF7080000-0x000007FEF72FA000-memory.dmp

Filesize
2.5MB

Download
memory/1012-35-0x0000000000000000-mapping.dmp

Download
memory/1020-89-0x0000000000000000-mapping.dmp

Download
memory/1492-201-0x0000000000000000-mapping.dmp

Download
memory/1492-72-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/1492-73-0x0000000000000000-mapping.dmp

Download
memory/1636-155-0x0000000000170000-0x000000000017009C-memory.dmp

Filesize
156B

Download
memory/1636-81-0x0000000000000000-mapping.dmp

Download
memory/1780-91-0x0000000000000000-mapping.dmp

Download
memory/1876-71-0x0000000000000000-mapping.dmp

Download
memory/2016-69-0x0000000000000000-mapping.dmp

Download
memory/2032-77-0x0000000000000000-mapping.dmp

Download
memory/2300-191-0x0000000000000000-mapping.dmp

Download
memory/2368-195-0x0000000000000000-mapping.dmp

Download
memory/2456-197-0x0000000000000000-mapping.dmp

Download
memory/2528-199-0x0000000000000000-mapping.dmp

Download
memory/2556-157-0x0000000000000000-mapping.dmp

Download
memory/2648-162-0x0000000000000000-mapping.dmp

Download
memory/2696-165-0x0000000000000000-mapping.dmp

Download
memory/2744-168-0x0000000000000000-mapping.dmp

Download
memory/2792-170-0x0000000000000000-mapping.dmp

Download
memory/2804-172-0x0000000000000000-mapping.dmp

Download
memory/2820-175-0x0000000000000000-mapping.dmp

Download
memory/2900-178-0x0000000000000000-mapping.dmp

Download
memory/2952-181-0x0000000000000000-mapping.dmp

Download
memory/3000-184-0x0000000000000000-mapping.dmp

Download
memory/3048-187-0x0000000000000000-mapping.dmp

Download