File name:

CryptoTabSetup_5BLNzIP.exe

Full analysis: https://app.any.run/tasks/2a5ba671-1fce-417a-aa4a-cabaf5f11d56
Verdict: Malicious activity
Analysis date: April 23, 2019, 18:52:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C335E3FD6218D622BDAD4F9B1FA3BAC6

SHA1:

E06CE4C13E3ABA92CFC007CDC928A7F020082496

SHA256:

3C63D911E4F911F2BA6F411E93BA850091AAC9C6C4C962EEE914358AC1AC8E0C

SSDEEP:

24576:31llZmeB0lj3wVOtpjxC+8biFk9ePHSQNzpPWdtJWgO0lS3r33jyNRD4:FllZmeB0egt98rayQNFPWjJW3RbcJ4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • CryptoTabUpdate.exe (PID: 1104)
      • CryptoTabUpdate.exe (PID: 2728)
      • CryptoTabUpdate.exe (PID: 3700)
      • CryptoTabUpdate.exe (PID: 3912)
      • CryptoTabUpdate.exe (PID: 3064)
      • CryptoTabUpdate.exe (PID: 2304)
      • CryptoTabUpdate.exe (PID: 1680)
      • CryptoTabUpdate.exe (PID: 328)

    • Application was dropped or rewritten from another process

      • CryptoTabUpdate.exe (PID: 3912)
      • CryptoTabUpdate.exe (PID: 2728)
      • CryptoTabUpdate.exe (PID: 3064)
      • CryptoTabUpdate.exe (PID: 3700)
      • CryptoTabUpdate.exe (PID: 328)
      • CryptoTabUpdate.exe (PID: 1104)
      • setup.exe (PID: 2392)
      • setup.exe (PID: 2124)
      • CryptoTabCrashHandler.exe (PID: 2704)
      • CryptoTabUpdate.exe (PID: 1680)
      • CryptoTabUpdate.exe (PID: 2304)
      • browser.exe (PID: 1584)
      • browser.exe (PID: 1836)
      • browser.exe (PID: 1476)
      • browser.exe (PID: 3364)
      • browser.exe (PID: 2192)
      • browser.exe (PID: 2068)
      • browser.exe (PID: 2972)
      • browser.exe (PID: 1936)
      • browser.exe (PID: 2140)
      • browser.exe (PID: 2880)
      • browser.exe (PID: 3920)
      • browser.exe (PID: 2088)
      • browser.exe (PID: 2432)
      • browser.exe (PID: 3396)
      • browser.exe (PID: 2692)
      • browser.exe (PID: 1828)
      • browser.exe (PID: 3612)
      • browser.exe (PID: 2700)
      • browser.exe (PID: 3904)
      • browser.exe (PID: 2072)
      • browser.exe (PID: 3456)
      • browser.exe (PID: 3696)
      • browser.exe (PID: 4064)
      • chrmstp.exe (PID: 2316)
      • chrmstp.exe (PID: 2628)
      • browser.exe (PID: 3688)
      • browser.exe (PID: 552)
      • browser.exe (PID: 2708)
      • browser.exe (PID: 2604)
      • browser.exe (PID: 3444)
      • browser.exe (PID: 2116)
      • browser.exe (PID: 1700)

    • Loads the Task Scheduler COM API

      • CryptoTabUpdate.exe (PID: 3912)

    • Changes the autorun value in the registry

      • setup.exe (PID: 2392)

    • Changes settings of System certificates

      • CryptoTabUpdate.exe (PID: 3064)
      • browser.exe (PID: 1584)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • CryptoTabSetup_5BLNzIP.exe (PID: 3852)
      • CryptoTabUpdate.exe (PID: 3912)
      • CryptoTabUpdateSetup.exe (PID: 772)
      • mini_installer2_1_6_86.exe (PID: 3104)
      • setup.exe (PID: 2392)

    • Disables SEHOP

      • CryptoTabUpdate.exe (PID: 3912)

    • Starts itself from another location

      • CryptoTabUpdate.exe (PID: 3912)

    • Creates COM task schedule object

      • CryptoTabUpdate.exe (PID: 3912)
      • CryptoTabUpdate.exe (PID: 3700)

    • Creates files in the program directory

      • CryptoTabUpdate.exe (PID: 3912)
      • CryptoTabUpdateSetup.exe (PID: 772)
      • CryptoTabUpdate.exe (PID: 2304)
      • setup.exe (PID: 2392)

    • Creates files in the user directory

      • setup.exe (PID: 2392)

    • Adds / modifies Windows certificates

      • CryptoTabUpdate.exe (PID: 3064)

    • Creates a software uninstall entry

      • setup.exe (PID: 2392)

    • Modifies the open verb of a shell class

      • setup.exe (PID: 2392)

    • Application launched itself

      • CryptoTabUpdate.exe (PID: 2304)
      • browser.exe (PID: 1584)
      • browser.exe (PID: 1476)
      • chrmstp.exe (PID: 2316)

  • INFO

    • Reads settings of System Certificates

      • browser.exe (PID: 1584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:04:17 14:15:25+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 139264
InitializedDataSize: 1283584
UninitializedDataSize: -
EntryPoint: 0xf6ea
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.3.99.31
ProductVersionNumber: 1.3.99.31
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: CRYPTOCOMPANY OU
FileDescription: CryptoTab Update Setup
FileVersion: 1.3.99.31
InternalName: CryptoTab Update Setup
LegalCopyright: Copyright 2018 CRYPTOCOMPANY OU
OriginalFileName: CryptoTabUpdateSetup.exe
ProductName: CryptoTab Update
ProductVersion: 1.3.99.31
LanguageId: en
PrivateBuild: -

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 17-Apr-2019 12:15:25
Detected languages:
  • Arabic - Saudi Arabia
  • Bulgarian - Bulgaria
  • Catalan - Spain
  • Chinese - PRC
  • Chinese - Taiwan
  • Croatian - Croatia
  • Czech - Czech Republic
  • Danish - Denmark
  • Dutch - Netherlands
  • English - United Kingdom
  • English - United States
  • Estonian - Estonia
  • Farsi - Iran
  • Finnish - Finland
  • French - France
  • German - Germany
  • Greek - Greece
  • Gujarati - India
  • Hebrew - Israel
  • Hindi - India
  • Hungarian - Hungary
  • Icelandic - Iceland
  • Indonesian - Indonesia (Bahasa)
  • Italian - Italy
  • Japanese - Japan
  • Kannada - India (Kannada script)
  • Korean - Korea
  • Latvian - Latvia
  • Lithuanian - Lithuania
  • Malay - Malaysia
  • Marathi - India
  • Norwegian - Norway (Bokmal)
  • Polish - Poland
  • Portuguese - Brazil
  • Portuguese - Portugal
  • Romanian - Romania
  • Russian - Russia
  • Serbian - Serbia (Cyrillic)
  • Slovak - Slovakia
  • Slovenian - Slovenia
  • Spanish - Mexico
  • Spanish - Spain (International sort)
  • Swahili - Kenya
  • Swedish - Sweden
  • Tamil - India
  • Telugu - India (Telugu script)
  • Thai - Thailand
  • Turkish - Turkey
  • Ukrainian - Ukraine
  • Urdu - Pakistan
  • Vietnamese - Viet Nam
Debug artifacts:
  • mi_exe_stub.pdb
CompanyName: CRYPTOCOMPANY OU
FileDescription: CryptoTab Update Setup
FileVersion: 1.3.99.31
InternalName: CryptoTab Update Setup
LegalCopyright: Copyright 2018 CRYPTOCOMPANY OU
OriginalFilename: CryptoTabUpdateSetup.exe
ProductName: CryptoTab Update
ProductVersion: 1.3.99.31
LanguageId: en
PrivateBuild: -

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 17-Apr-2019 12:15:25
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00021E1D
0x00022000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.65987
.rdata
0x00023000
0x0000EA3C
0x0000EC00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.65476
.data
0x00032000
0x0000254C
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.58118
.gfids
0x00035000
0x0000014C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.70705
.rsrc
0x00036000
0x00127794
0x00127800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.97883
.reloc
0x0015E000
0x00002250
0x00002400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.52868

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.24273
1196
Latin 1 / Western European
UNKNOWN
RT_MANIFEST
2
3.39591
5160
Latin 1 / Western European
English - United States
RT_ICON
3
3.09921
11560
Latin 1 / Western European
English - United States
RT_ICON
4
7.96819
14145
Latin 1 / Western European
English - United States
RT_ICON
101
2.49052
62
Latin 1 / Western European
English - United States
RT_GROUP_ICON
102
7.99987
1153997
Latin 1 / Western European
UNKNOWN
B
1321
3.75362
446
Latin 1 / Western European
Serbian - Serbia (Cyrillic)
RT_STRING

Imports

ADVAPI32.dll
KERNEL32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
80
Monitored processes
46
Malicious processes
14
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start cryptotabsetup_5blnzip.exe cryptotabupdate.exe no specs cryptotabupdatesetup.exe cryptotabupdate.exe cryptotabupdate.exe no specs cryptotabupdate.exe no specs cryptotabupdate.exe cryptotabupdate.exe no specs cryptotabupdate.exe mini_installer2_1_6_86.exe setup.exe setup.exe no specs cryptotabcrashhandler.exe no specs cryptotabupdate.exe browser.exe browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs chrmstp.exe no specs chrmstp.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs browser.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
328"C:\Program Files\CryptoCompany\Update\CryptoTabUpdate.exe" /handoff "appguid={F6D86D47-6571-4577-B35B-64318B8D2258}&appname=CryptoTabBrowser&usagestats=1&ap=release&needsadmin=prefers" /installsource taggedmi /sessionid "{5540D40B-63EF-42D3-99CC-51A3E68F336B}"C:\Program Files\CryptoCompany\Update\CryptoTabUpdate.exe—CryptoTabUpdate.exe
User:
admin
Company:
CRYPTOCOMPANY OU
Integrity Level:
HIGH
Description:
CryptoTab Update
Exit code:
0
Version:
1.3.99.31
Modules
Images
c:\program files\cryptocompany\update\cryptotabupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
552"C:\Program Files\CryptoTab Browser\Application\browser.exe" --type=utility --field-trial-handle=952,7975348520619257036,3986339688248699126,131072 --lang=en-US --service-sandbox-type=utility --service-request-channel-token=9032699911827870208 --mojo-platform-channel-handle=4640 --ignored=" --type=renderer " /prefetch:8C:\Program Files\CryptoTab Browser\Application\browser.exe—browser.exe
User:
admin
Company:
The Chromium and CryptoTab Browser Authors
Integrity Level:
LOW
Description:
CryptoTab Browser
Exit code:
0
Version:
73.0.3683.103
Modules
Images
c:\program files\cryptotab browser\application\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\cryptotab browser\application\73.0.3683.103\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
772"C:\Users\admin\AppData\Local\Temp\GUM1DF5.tmp\CryptoTabUpdateSetup.exe" /installsource taggedmi /install "appguid={F6D86D47-6571-4577-B35B-64318B8D2258}&appname=CryptoTabBrowser&usagestats=1&ap=release&needsadmin=prefers" /installelevated /nomitagC:\Users\admin\AppData\Local\Temp\GUM1DF5.tmp\CryptoTabUpdateSetup.exe
CryptoTabUpdate.exe
User:
admin
Company:
CRYPTOCOMPANY OU
Integrity Level:
HIGH
Description:
CryptoTab Update Setup
Exit code:
0
Version:
1.3.99.31
Modules
Images
c:\users\admin\appdata\local\temp\gum1df5.tmp\cryptotabupdatesetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1104C:\Users\admin\AppData\Local\Temp\GUM1DF5.tmp\CryptoTabUpdate.exe /installsource taggedmi /install "appguid={F6D86D47-6571-4577-B35B-64318B8D2258}&appname=CryptoTabBrowser&usagestats=1&ap=release&needsadmin=prefers"C:\Users\admin\AppData\Local\Temp\GUM1DF5.tmp\CryptoTabUpdate.exe—CryptoTabSetup_5BLNzIP.exe
User:
admin
Company:
CRYPTOCOMPANY OU
Integrity Level:
MEDIUM
Description:
CryptoTab Update
Exit code:
0
Version:
1.3.99.31
Modules
Images
c:\users\admin\appdata\local\temp\gum1df5.tmp\cryptotabupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1476"C:\Program Files\CryptoTab Browser\Application\browser.exe" C:\Program Files\CryptoTab Browser\Application\browser.exe—explorer.exe
User:
admin
Company:
The Chromium and CryptoTab Browser Authors
Integrity Level:
MEDIUM
Description:
CryptoTab Browser
Exit code:
3221225547
Version:
73.0.3683.103
Modules
Images
c:\program files\cryptotab browser\application\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\cryptotab browser\application\73.0.3683.103\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1584"C:\Program Files\CryptoTab Browser\Application\browser.exe" C:\Program Files\CryptoTab Browser\Application\browser.exe
CryptoTabUpdate.exe
User:
admin
Company:
The Chromium and CryptoTab Browser Authors
Integrity Level:
MEDIUM
Description:
CryptoTab Browser
Exit code:
0
Version:
73.0.3683.103
Modules
Images
c:\program files\cryptotab browser\application\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\cryptotab browser\application\73.0.3683.103\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1680"C:\Program Files\CryptoCompany\Update\CryptoTabUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuOTkuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy45OS4zMSIgcmVmPSI1QkxOeklQIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezU1NDBENDBCLTYzRUYtNDJEMy05OUNDLTUxQTNFNjhGMzM2Qn0iIHVzZXJpZD0iezc0NEU5OTFELUNCRDItNDBFOC1BM0EyLTA5QjhBRkRBMjBDRn0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9IntGRjJDOTY5Qi0xMjgxLTRDREItODJERS1BQTI4NUExQzlCRUR9IiBkZWR1cD0iY3IiPjxodyBwaHlzbWVtb3J5PSIzIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4wIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing4NiIvPjxhcHAgYXBwaWQ9IntGNkQ4NkQ0Ny02NTcxLTQ1NzctQjM1Qi02NDMxOEI4RDIyNTh9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIyLjEuNi4wIiBhcD0icmVsZWFzZSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHBzOi8vY2RuLmNyeXB0b2Jyb3dzZXIudG9kYXkvc3RhdGljL21lZGlhL2J1aWxkL0NyeXB0b1RhYkJyb3dzZXIvYmV0YS93aW4vMjIwMzMxODYxNjA2NC9taW5pX2luc3RhbGxlcjJfMV82Xzg2LmV4ZSIgZG93bmxvYWRlZD0iNTE0NTQ1MDQiIHRvdGFsPSI1MTQ1NDUwNCIgZG93bmxvYWRfdGltZV9tcz0iMzE1MTUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIyODkwIiBkb3dubG9hZF90aW1lX21zPSIzMjAxNiIgZG93bmxvYWRlZD0iNTE0NTQ1MDQiIHRvdGFsPSI1MTQ1NDUwNCIgaW5zdGFsbF90aW1lX21zPSI5MDc5Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Program Files\CryptoCompany\Update\CryptoTabUpdate.exe
CryptoTabUpdate.exe
User:
admin
Company:
CRYPTOCOMPANY OU
Integrity Level:
HIGH
Description:
CryptoTab Update
Exit code:
0
Version:
1.3.99.31
Modules
Images
c:\program files\cryptocompany\update\cryptotabupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
1700"C:\Program Files\CryptoTab Browser\Application\browser.exe" --type=utility --field-trial-handle=952,7975348520619257036,3986339688248699126,131072 --lang=en-US --service-sandbox-type=utility --service-request-channel-token=13509685845913923763 --mojo-platform-channel-handle=5032 --ignored=" --type=renderer " /prefetch:8C:\Program Files\CryptoTab Browser\Application\browser.exe—browser.exe
User:
admin
Company:
The Chromium and CryptoTab Browser Authors
Integrity Level:
LOW
Description:
CryptoTab Browser
Exit code:
0
Version:
73.0.3683.103
Modules
Images
c:\program files\cryptotab browser\application\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\cryptotab browser\application\73.0.3683.103\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1828"C:\Program Files\CryptoTab Browser\Application\browser.exe" --type=renderer --field-trial-handle=952,7975348520619257036,3986339688248699126,131072 --disable-gpu-compositing --service-pipe-token=11456167832696545208 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11456167832696545208 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1C:\Program Files\CryptoTab Browser\Application\browser.exe—browser.exe
User:
admin
Company:
The Chromium and CryptoTab Browser Authors
Integrity Level:
LOW
Description:
CryptoTab Browser
Exit code:
0
Version:
73.0.3683.103
Modules
Images
c:\program files\cryptotab browser\application\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\cryptotab browser\application\73.0.3683.103\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1836"C:\Program Files\CryptoTab Browser\Application\browser.exe" --type=gpu-process --field-trial-handle=924,13467557838931338507,15606743957930606445,131072 --gpu-preferences=KAAAAAAAAACAAwCAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=11831337420998115006 --mojo-platform-channel-handle=940 --ignored=" --type=renderer " /prefetch:2C:\Program Files\CryptoTab Browser\Application\browser.exe—browser.exe
User:
admin
Company:
The Chromium and CryptoTab Browser Authors
Integrity Level:
LOW
Description:
CryptoTab Browser
Exit code:
0
Version:
73.0.3683.103
Modules
Images
c:\program files\cryptotab browser\application\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\cryptotab browser\application\73.0.3683.103\chrome_elf.dll
c:\windows\system32\version.dll
Total events
3 548
Read events
1 519
Write events
2 014
Delete events
15

Modification events

(PID) Process:(3852) CryptoTabSetup_5BLNzIP.exeKey:HKEY_CURRENT_USER\Software\CryptoTab Browser
Operation:writeName:referer
Value:
5BLNzIP
(PID) Process:(3912) CryptoTabUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\CryptoCompany\Update\ClientState\{F6D86D47-6571-4577-B35B-64318B8D2258}
Operation:writeName:usagestats
Value:
1
(PID) Process:(2728) CryptoTabUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\CryptoCompany\Update
Operation:writeName:uid
Value:
{744E991D-CBD2-40E8-A3A2-09B8AFDA20CF}
(PID) Process:(2728) CryptoTabUpdate.exeKey:HKEY_CURRENT_USER\Software\CryptoTab Browser
Operation:writeName:uid
Value:
{744E991D-CBD2-40E8-A3A2-09B8AFDA20CF}
(PID) Process:(2728) CryptoTabUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\CryptoCompany\Update
Operation:writeName:uid-create-time
Value:
1556045563
(PID) Process:(2728) CryptoTabUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\CryptoCompany\Update
Operation:writeName:uid-num-rotations
Value:
1
(PID) Process:(2728) CryptoTabUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\CryptoCompany\Update\uid
Operation:writeName:UlQASgSv
Value:
(PID) Process:(2728) CryptoTabUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EEE1F8FA-C20A-4405-BAE3-1D8ADBD48B34}
Operation:writeName:
Value:
ServiceModule
(PID) Process:(2728) CryptoTabUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\CryptoTabUpdate.exe
Operation:writeName:AppID
Value:
{EEE1F8FA-C20A-4405-BAE3-1D8ADBD48B34}
(PID) Process:(2728) CryptoTabUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{EEE1F8FA-C20A-4405-BAE3-1D8ADBD48B34}
Operation:writeName:LocalService
Value:
cryptobrowser
Executable files
221
Suspicious files
50
Text files
494
Unknown types
10

Dropped files

PID
Process
Filename
Type
3852CryptoTabSetup_5BLNzIP.exeC:\Users\admin\AppData\Local\Temp\GUM1DF5.tmp\CryptoTabUpdate.exeexecutable
MD5:6346CBB8A24B3DC8393E27181AFD8C09
SHA256:E448E471C3AE25BA09EC58E97031F9E5BEEBB6F4DBC2D0067F99E37A4A59F04D
3852CryptoTabSetup_5BLNzIP.exeC:\Users\admin\AppData\Local\Temp\GUM1DF5.tmp\npCryptoTabUpdate3.dllexecutable
MD5:CA08A4C56CCDBF4B3EA23AA8DD76BB6E
SHA256:521789FCF4C376F9E4F956BE13D7046257E95202E463D007551CB35A9936AC3D
3852CryptoTabSetup_5BLNzIP.exeC:\Users\admin\AppData\Local\Temp\GUM1DF5.tmp\CryptoTabUpdateHelper.msiexecutable
MD5:646671B5840B214E79BAC5A3D103C1AF
SHA256:A175C29C116C7814A22DDA2FC542D2A0E1B0CA43C0B95AA56B37AECE4C18C20F
3852CryptoTabSetup_5BLNzIP.exeC:\Users\admin\AppData\Local\Temp\GUM1DF5.tmp\CryptoTabUpdateOnDemand.exeexecutable
MD5:DBB427983F95C4BDA31A44F3B414FDF1
SHA256:3CB68CF5F78F875EBC80F3BE237E9A16EE0F91A57B6FE88EDF1C181F677FFA3A
3852CryptoTabSetup_5BLNzIP.exeC:\Users\admin\AppData\Local\Temp\GUM1DF5.tmp\CryptoTabUpdateWebPlugin.exeexecutable
MD5:7513F13A202D0CCF712CD581B5B49242
SHA256:26357591FE4A52BC14DDE19A786781E5205CE0F2BA0DFAF481F778668A541D6C
3852CryptoTabSetup_5BLNzIP.exeC:\Users\admin\AppData\Local\Temp\GUM1DF5.tmp\psuser_64.dllexecutable
MD5:9A739BD13C08F4ECC4C614E3A4C93EC2
SHA256:156DA27CA8F4A4CBD7A914D283CB44A1BC2B6C9B415AC58C51B7DA942D661511
3852CryptoTabSetup_5BLNzIP.exeC:\Users\admin\AppData\Local\Temp\GUM1DF5.tmp\goopdateres_am.dllexecutable
MD5:D268C7686367FFD208E1A354D0897747
SHA256:484B45C99D0886A5B43D589F4679F22F8268922BE7A5A50882B833211A2CE913
3852CryptoTabSetup_5BLNzIP.exeC:\Users\admin\AppData\Local\Temp\GUM1DF5.tmp\CryptoTabUpdateBroker.exeexecutable
MD5:10C55051EBB21196C6E87F08D05DC06C
SHA256:991F501A8BD1DE504479373E5D7A1B0AD969197CB74F9AE0B1C682C171F225D5
3852CryptoTabSetup_5BLNzIP.exeC:\Users\admin\AppData\Local\Temp\GUM1DF5.tmp\CryptoTabUpdateComRegisterShell64.exeexecutable
MD5:0E53896700B17EBED358BD3C57A90B8C
SHA256:354B6EB9A5225DA140F0A2EAB22BB2CB0F2C5B7A274642687A9BF36BE8928144
3852CryptoTabSetup_5BLNzIP.exeC:\Users\admin\AppData\Local\Temp\GUM1DF5.tmp\psuser.dllexecutable
MD5:68A883B107D4AD82911D39BC22E77EE7
SHA256:87134A6719B39EAA33F5DDEC0D3C98A001D508A6616493EF672E89A6CEDE5838
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
28
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1584
browser.exe
GET
200
104.111.245.93:80
http://cert.int-x3.letsencrypt.org/
NL
der
1.15 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3064
CryptoTabUpdate.exe
190.2.148.55:443
download.cryptobrowser.today
Scarlet B.V.
CW
malicious
2304
CryptoTabUpdate.exe
190.2.148.55:443
download.cryptobrowser.today
Scarlet B.V.
CW
malicious
—
—
104.25.211.116:443
cdn.cryptobrowser.today
Cloudflare Inc
US
shared
1680
CryptoTabUpdate.exe
190.2.148.55:443
download.cryptobrowser.today
Scarlet B.V.
CW
malicious
1584
browser.exe
216.58.206.10:443
www.googleapis.com
Google Inc.
US
whitelisted
1584
browser.exe
172.217.22.13:443
accounts.google.com
Google Inc.
US
whitelisted
1584
browser.exe
172.217.16.163:443
www.gstatic.com
Google Inc.
US
whitelisted
1584
browser.exe
190.2.136.200:443
cryptobrowser.site
Scarlet B.V.
CW
suspicious
—
—
190.2.136.200:443
cryptobrowser.site
Scarlet B.V.
CW
suspicious
1584
browser.exe
190.2.136.9:443
cryptotab.net
Scarlet B.V.
CW
unknown

DNS requests

Domain
IP
Reputation
download.cryptobrowser.today
  • 190.2.148.55
malicious
cdn.cryptobrowser.today
  • 104.25.211.116
  • 104.25.212.116
suspicious
www.googleapis.com
  • 216.58.206.10
  • 172.217.16.138
  • 172.217.22.74
  • 172.217.22.106
  • 216.58.210.10
  • 172.217.18.106
  • 172.217.23.170
  • 216.58.205.234
  • 172.217.21.234
whitelisted
accounts.google.com
  • 172.217.22.13
shared
www.gstatic.com
  • 172.217.16.163
whitelisted
cryptobrowser.site
  • 190.2.136.200
whitelisted
www.google-analytics.com
  • 216.58.206.14
whitelisted
handy-tab.com
  • 89.39.104.171
whitelisted
cryptotab.net
  • 190.2.136.9
whitelisted
www.googletagmanager.com
  • 172.217.18.104
whitelisted

Threats

PID
Process
Class
Message
1584
browser.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
Process
Message
browser.exe
CryptobrowserForceSyncFunction::Run
browser.exe
CryptobrowserForceSyncFunction::HasProfileSyncService ok
browser.exe
CryptobrowserForceSyncFunction::Run StartSyncingWithServer
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CryptoTabSetup_5BLNzIP.exe