URL:

http://download.webnavigator.co

Full analysis: https://app.any.run/tasks/31715d6b-0405-431c-be55-234e9fa4b3e8
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 02, 2020, 21:15:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

2C33757FA35410631656F26C9D4012D6

SHA1:

A766167B5B783E58D025745CBACBA58103552224

SHA256:

9032EB5BA648DB70C2A0E10991CA4F26FFFA7ABA13077DB17204FB0EF032F81B

SSDEEP:

3:N1KaKEl0iKn:Ca5vK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Click HERE to start the WebNavigator Browser Installer_zcbvgk13_.exe (PID: 2816)
      • setup.exe (PID: 1804)
      • setup.exe (PID: 1924)
      • setup.exe (PID: 3236)
      • webnavigatorbrowser.exe (PID: 2100)
      • setup.exe (PID: 3128)
      • webnavigatorbrowser.exe (PID: 3344)
      • webnavigatorbrowser.exe (PID: 2492)
      • webnavigatorbrowser.exe (PID: 2348)
      • webnavigatorbrowser.exe (PID: 3444)
      • webnavigatorbrowser.exe (PID: 2652)
      • webnavigatorbrowser.exe (PID: 1040)
      • webnavigatorbrowser.exe (PID: 2372)
      • webnavigatorbrowser.exe (PID: 3564)
      • webnavigatorbrowser.exe (PID: 3868)
      • webnavigatorbrowser.exe (PID: 2212)
      • webnavigatorbrowser.exe (PID: 3240)
      • webnavigatorbrowser.exe (PID: 2676)
      • webnavigatorbrowser.exe (PID: 1564)
      • webnavigatorbrowser.exe (PID: 4016)
      • webnavigatorbrowser.exe (PID: 2760)
      • webnavigatorbrowser.exe (PID: 2552)
      • webnavigatorbrowser.exe (PID: 1888)
      • webnavigatorbrowser.exe (PID: 3092)
      • webnavigatorbrowser.exe (PID: 3716)
      • webnavigatorbrowser.exe (PID: 2120)
      • webnavigatorbrowser.exe (PID: 1212)

    • Loads dropped or rewritten executable

      • Click HERE to start the WebNavigator Browser Installer_zcbvgk13_.exe (PID: 2816)
      • setup_zcbvgk13-0F.exe (PID: 3028)
      • webnavigatorbrowser.exe (PID: 3344)
      • webnavigatorbrowser.exe (PID: 2100)
      • webnavigatorbrowser.exe (PID: 2492)
      • webnavigatorbrowser.exe (PID: 2348)
      • webnavigatorbrowser.exe (PID: 3444)
      • webnavigatorbrowser.exe (PID: 2652)
      • webnavigatorbrowser.exe (PID: 1040)
      • webnavigatorbrowser.exe (PID: 3564)
      • webnavigatorbrowser.exe (PID: 2372)
      • webnavigatorbrowser.exe (PID: 3868)
      • webnavigatorbrowser.exe (PID: 1212)
      • webnavigatorbrowser.exe (PID: 2760)
      • webnavigatorbrowser.exe (PID: 2676)
      • webnavigatorbrowser.exe (PID: 3240)
      • webnavigatorbrowser.exe (PID: 2212)
      • webnavigatorbrowser.exe (PID: 4016)
      • webnavigatorbrowser.exe (PID: 1564)
      • webnavigatorbrowser.exe (PID: 1888)
      • webnavigatorbrowser.exe (PID: 2552)
      • webnavigatorbrowser.exe (PID: 3092)
      • webnavigatorbrowser.exe (PID: 2120)
      • webnavigatorbrowser.exe (PID: 3716)

    • Actions looks like stealing of personal data

      • setup.exe (PID: 1804)
      • setup_zcbvgk13-0F.exe (PID: 3028)
      • setup.exe (PID: 3236)

    • Loads the Task Scheduler COM API

      • setup.exe (PID: 1804)
      • webnavigatorbrowser.exe (PID: 3344)
      • webnavigatorbrowser.exe (PID: 1564)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 1028)
      • chrome.exe (PID: 1312)
      • Click HERE to start the WebNavigator Browser Installer_zcbvgk13_.exe (PID: 2816)
      • setup_zcbvgk13-0F.exe (PID: 3028)
      • setup.exe (PID: 1804)

    • Reads Internet Cache Settings

      • setup_zcbvgk13-0F.exe (PID: 3028)
      • Click HERE to start the WebNavigator Browser Installer_zcbvgk13_.exe (PID: 2816)
      • setup.exe (PID: 1804)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1028)

    • Application launched itself

      • setup.exe (PID: 1804)
      • setup.exe (PID: 3236)
      • webnavigatorbrowser.exe (PID: 3344)

    • Creates a software uninstall entry

      • setup.exe (PID: 1804)

    • Creates files in the user directory

      • setup.exe (PID: 1804)

    • Starts itself from another location

      • setup.exe (PID: 1804)

    • Modifies the open verb of a shell class

      • setup.exe (PID: 3236)
      • setup.exe (PID: 1804)

    • Reads the cookies of Google Chrome

      • webnavigatorbrowser.exe (PID: 2652)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 1028)

    • Reads the hosts file

      • chrome.exe (PID: 1028)
      • chrome.exe (PID: 1312)
      • webnavigatorbrowser.exe (PID: 3344)
      • webnavigatorbrowser.exe (PID: 2348)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 1028)

    • Dropped object may contain Bitcoin addresses

      • setup.exe (PID: 1804)

    • Reads settings of System Certificates

      • webnavigatorbrowser.exe (PID: 2348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
99
Monitored processes
59
Malicious processes
8
Suspicious processes
11

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs click here to start the webnavigator browser installer_zcbvgk13_.exe chrome.exe no specs chrome.exe no specs setup_zcbvgk13-0f.exe setup.exe setup.exe no specs setup.exe setup.exe no specs webnavigatorbrowser.exe webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs webnavigatorbrowser.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
564"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1020,2569051402317870404,6370796269537392350,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=2637376518628256870 --mojo-platform-channel-handle=3988 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
636"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1020,2569051402317870404,6370796269537392350,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=14087975120345655690 --mojo-platform-channel-handle=1028 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1028"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://download.webnavigator.co"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1040"C:\Users\admin\AppData\Local\WebNavigatorBrowser\Application\webnavigatorbrowser.exe" --type=renderer --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2020 /prefetch:1C:\Users\admin\AppData\Local\WebNavigatorBrowser\Application\webnavigatorbrowser.exe—webnavigatorbrowser.exe
User:
admin
Company:
Better Cloud Solutions
Integrity Level:
LOW
Description:
WebNavigatorBrowser
Exit code:
0
Version:
2.3.0.13
Modules
Images
c:\users\admin\appdata\local\webnavigatorbrowser\application\webnavigatorbrowser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\webnavigatorbrowser\application\2.3.0.13\webnavigatorbrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1212"C:\Users\admin\AppData\Local\WebNavigatorBrowser\Application\webnavigatorbrowser.exe" --type=renderer --lang=en-US --instant-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1C:\Users\admin\AppData\Local\WebNavigatorBrowser\Application\webnavigatorbrowser.exe—webnavigatorbrowser.exe
User:
admin
Company:
Better Cloud Solutions
Integrity Level:
LOW
Description:
WebNavigatorBrowser
Exit code:
0
Version:
2.3.0.13
Modules
Images
c:\users\admin\appdata\local\webnavigatorbrowser\application\webnavigatorbrowser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\webnavigatorbrowser\application\2.3.0.13\webnavigatorbrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1312"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1020,2569051402317870404,6370796269537392350,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=1359182781623409619 --mojo-platform-channel-handle=1624 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1352"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1020,2569051402317870404,6370796269537392350,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=14168786215761107823 --mojo-platform-channel-handle=3004 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1356"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1020,2569051402317870404,6370796269537392350,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=15616805397322984658 --mojo-platform-channel-handle=4172 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1564"C:\Users\admin\AppData\Local\WebNavigatorBrowser\Application\webnavigatorbrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3748 /prefetch:8C:\Users\admin\AppData\Local\WebNavigatorBrowser\Application\webnavigatorbrowser.exe—webnavigatorbrowser.exe
User:
admin
Company:
Better Cloud Solutions
Integrity Level:
MEDIUM
Description:
WebNavigatorBrowser
Exit code:
0
Version:
2.3.0.13
Modules
Images
c:\users\admin\appdata\local\webnavigatorbrowser\application\webnavigatorbrowser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\webnavigatorbrowser\application\2.3.0.13\webnavigatorbrowser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1708"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1020,2569051402317870404,6370796269537392350,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=1117983590749398673 --mojo-platform-channel-handle=4048 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
3 659
Read events
3 274
Write events
373
Delete events
12

Modification events

(PID) Process:(2612) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:1028-13248825358617250
Value:
259
(PID) Process:(1028) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1028) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1028) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(1028) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(1028) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1028) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(1028) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(1028) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3252-13245750958665039
Value:
0
(PID) Process:(1028) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
26
Suspicious files
96
Text files
331
Unknown types
78

Dropped files

PID
Process
Filename
Type
1028chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FA0770F-404.pma —
MD5:—
SHA256:—
1028chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\dfdf45e6-4bb7-4b0d-8356-5dcdce28de1a.tmp —
MD5:—
SHA256:—
1028chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp —
MD5:—
SHA256:—
1028chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old —
MD5:—
SHA256:—
1028chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENTtext
MD5:—
SHA256:—
1028chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT~RF150b15.TMPtext
MD5:—
SHA256:—
1028chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
1028chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:—
SHA256:—
1028chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
1028chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF150c8c.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
56
TCP/UDP connections
101
DNS requests
53
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1312
chrome.exe
GET
200
3.131.126.214:80
http://www.webnavigator.co/css/style.css?v=008
US
text
14.3 Kb
suspicious
1312
chrome.exe
GET
200
173.194.150.201:80
http://r3---sn-5goeen7k.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvZDM4QUFXaVZ5bThYeHlpdXd5bzU1RzRQUQ/8220.313.1.2_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mh=i8&mip=196.244.192.38&mm=28&mn=sn-5goeen7k&ms=nvh&mt=1604351614&mv=m&mvi=3&pl=24&shardbypass=yes
US
crx
839 Kb
whitelisted
1312
chrome.exe
GET
200
3.131.126.214:80
http://www.webnavigator.co/
US
html
2.53 Kb
suspicious
1312
chrome.exe
GET
302
172.217.16.206:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvZDM4QUFXaVZ5bThYeHlpdXd5bzU1RzRQUQ/8220.313.1.2_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
525 b
whitelisted
1312
chrome.exe
GET
200
3.131.126.214:80
http://www.webnavigator.co/css/vstyle.css?v=004
US
text
3.71 Kb
suspicious
1312
chrome.exe
GET
200
3.23.12.39:80
http://hh.webnavigator.co/hh/edgium/test/green_arrow_v5.png
US
image
4.14 Kb
suspicious
1312
chrome.exe
GET
200
3.23.12.39:80
http://hh.webnavigator.co/sbedgium?source=undefined-lp0-obgc-wbn-bb8-ab13-stb2-w32-wte-brwsr&ap=0&appName=WebExplorer%20Browser&implementation_id=wbx_
US
html
1.74 Kb
suspicious
1312
chrome.exe
GET
200
3.131.126.214:80
http://www.webnavigator.co/js/init.js?userclass=20201102&v=0.75
US
text
23.2 Kb
suspicious
1312
chrome.exe
GET
200
3.131.126.214:80
http://www.webnavigator.co/img/onboarding_step_2_exe.png
US
image
3.56 Kb
suspicious
1312
chrome.exe
GET
200
3.23.12.39:80
http://hh.webnavigator.co/hh/edgium/test/greenpsd.png
US
image
11.4 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
172.217.16.206:80
redirector.gvt1.com
Google Inc.
US
whitelisted
1312
chrome.exe
216.58.205.227:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
1312
chrome.exe
3.23.12.39:80
download.webnavigator.co
—
US
suspicious
1312
chrome.exe
172.217.16.164:443
www.google.com
Google Inc.
US
whitelisted
1312
chrome.exe
216.58.212.141:443
accounts.google.com
Google Inc.
US
whitelisted
—
—
173.194.150.201:80
r3---sn-5goeen7k.gvt1.com
Google Inc.
US
whitelisted
1312
chrome.exe
172.217.18.14:443
consent.google.com
Google Inc.
US
whitelisted
1312
chrome.exe
172.217.23.3:443
ssl.gstatic.com
Google Inc.
US
whitelisted
1312
chrome.exe
172.217.16.174:443
consent.google.fi
Google Inc.
US
whitelisted
1312
chrome.exe
172.217.23.131:443
www.gstatic.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
download.webnavigator.co
  • 3.23.12.39
  • 3.131.126.214
suspicious
clientservices.googleapis.com
  • 216.58.205.227
whitelisted
accounts.google.com
  • 216.58.212.141
shared
www.google.com
  • 172.217.16.164
malicious
www.google.com.ua
  • 172.217.16.163
whitelisted
clients2.google.com
  • 142.250.74.206
whitelisted
www.google.fi
  • 216.58.205.227
whitelisted
clients2.googleusercontent.com
  • 172.217.18.161
whitelisted
redirector.gvt1.com
  • 172.217.16.206
whitelisted
r3---sn-5goeen7k.gvt1.com
  • 173.194.150.201
whitelisted

Threats

PID
Process
Class
Message
1312
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1312
chrome.exe
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://download.webnavigator.co