File name:

TotalBrowser Setup.exe

Full analysis: https://app.any.run/tasks/4e24f94f-c9a0-4f70-9099-3ba0fd94c488
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 17, 2025, 16:02:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

CC7E1A1CD6E8DE860DF0548B08C164D4

SHA1:

1BCA692240BCBCDCF2EA05D34F9F73ECDEFE6409

SHA256:

9A1626E0C55432F12D8D06F21FF5817F72B04E092E912E5E5B7FE5890E43374E

SSDEEP:

98304:feGK5IzjDq3iFEaL8yZEH2oz/ytXX+sgMiVkOMa2Dja8Nd1L8gx1kdy/qgm3IsXd:rwXt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • setup.exe (PID: 5036)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 5240)

    • Actions looks like stealing of personal data

      • totalbrowser.exe (PID: 4024)

  • SUSPICIOUS

    • Application launched itself

      • TotalBrowser Setup.exe (PID: 6616)
      • setup.exe (PID: 5036)
      • setup.exe (PID: 4708)
      • totalbrowser.exe (PID: 4024)
      • chrmstp.exe (PID: 4548)
      • chrmstp.exe (PID: 6768)
      • totalbrowser.exe (PID: 6364)
      • totalbrowser.exe (PID: 3288)

    • Reads security settings of Internet Explorer

      • TotalBrowser Setup.exe (PID: 6616)
      • TotalBrowser Setup.exe (PID: 6784)
      • hopiumupdater.exe (PID: 5236)
      • setup.exe (PID: 4708)
      • chrmstp.exe (PID: 6768)

    • Checks Windows Trust Settings

      • TotalBrowser Setup.exe (PID: 6784)

    • There is functionality for taking screenshot (YARA)

      • TotalBrowser Setup.exe (PID: 6616)
      • TotalBrowser Setup.exe (PID: 6784)

    • Executable content was dropped or overwritten

      • mini_installer_x86_64.exe (PID: 3128)
      • setup.exe (PID: 5036)

    • Searches for installed software

      • setup.exe (PID: 5036)

    • Creates a software uninstall entry

      • setup.exe (PID: 5036)

    • Reads the date of Windows installation

      • hopiumupdater.exe (PID: 5236)
      • setup.exe (PID: 4708)

    • Starts CMD.EXE for commands execution

      • hopiumupdater.exe (PID: 5236)

    • Executes application which crashes

      • TotalBrowser Setup.exe (PID: 6784)

  • INFO

    • The sample compiled with english language support

      • TotalBrowser Setup.exe (PID: 6616)
      • mini_installer_x86_64.exe (PID: 3128)
      • setup.exe (PID: 5036)

    • Reads the computer name

      • TotalBrowser Setup.exe (PID: 6616)
      • TotalBrowser Setup.exe (PID: 6784)
      • mini_installer_x86_64.exe (PID: 3128)
      • setup.exe (PID: 5036)
      • hopiumupdater.exe (PID: 5236)
      • setup.exe (PID: 4708)
      • totalbrowser.exe (PID: 4024)
      • totalbrowser.exe (PID: 2160)
      • totalbrowser.exe (PID: 1868)
      • chrmstp.exe (PID: 4548)
      • totalbrowser.exe (PID: 5728)
      • chrmstp.exe (PID: 6768)
      • totalbrowser.exe (PID: 6820)
      • totalbrowser.exe (PID: 6460)
      • totalbrowser.exe (PID: 3288)
      • totalbrowser.exe (PID: 6788)

    • Process checks computer location settings

      • TotalBrowser Setup.exe (PID: 6616)
      • hopiumupdater.exe (PID: 5236)
      • totalbrowser.exe (PID: 4024)
      • totalbrowser.exe (PID: 2120)
      • totalbrowser.exe (PID: 1076)
      • totalbrowser.exe (PID: 3828)
      • totalbrowser.exe (PID: 3888)
      • totalbrowser.exe (PID: 5568)
      • totalbrowser.exe (PID: 6832)
      • totalbrowser.exe (PID: 1604)
      • totalbrowser.exe (PID: 3288)
      • totalbrowser.exe (PID: 2572)
      • totalbrowser.exe (PID: 6088)

    • Checks supported languages

      • TotalBrowser Setup.exe (PID: 6616)
      • TotalBrowser Setup.exe (PID: 6784)
      • mini_installer_x86_64.exe (PID: 3128)
      • setup.exe (PID: 5036)
      • setup.exe (PID: 2612)
      • hopiumupdater.exe (PID: 5236)
      • setup.exe (PID: 4708)
      • setup.exe (PID: 6004)
      • totalbrowser.exe (PID: 5008)
      • totalbrowser.exe (PID: 4024)
      • totalbrowser.exe (PID: 2160)
      • totalbrowser.exe (PID: 1868)
      • totalbrowser.exe (PID: 6800)
      • totalbrowser.exe (PID: 1556)
      • totalbrowser.exe (PID: 4012)
      • totalbrowser.exe (PID: 2120)
      • totalbrowser.exe (PID: 1076)
      • totalbrowser.exe (PID: 1520)
      • totalbrowser.exe (PID: 6568)
      • totalbrowser.exe (PID: 6356)
      • totalbrowser.exe (PID: 3816)
      • totalbrowser.exe (PID: 6244)
      • totalbrowser.exe (PID: 2148)
      • totalbrowser.exe (PID: 2084)
      • chrmstp.exe (PID: 4548)
      • totalbrowser.exe (PID: 5728)
      • chrmstp.exe (PID: 3984)
      • chrmstp.exe (PID: 6768)
      • totalbrowser.exe (PID: 5036)
      • chrmstp.exe (PID: 5740)
      • totalbrowser.exe (PID: 6848)
      • totalbrowser.exe (PID: 3888)
      • totalbrowser.exe (PID: 7068)
      • totalbrowser.exe (PID: 3828)
      • totalbrowser.exe (PID: 6832)
      • totalbrowser.exe (PID: 5568)
      • totalbrowser.exe (PID: 6820)
      • totalbrowser.exe (PID: 6460)
      • totalbrowser.exe (PID: 2600)
      • totalbrowser.exe (PID: 624)
      • totalbrowser.exe (PID: 1604)
      • totalbrowser.exe (PID: 6660)
      • totalbrowser.exe (PID: 3436)
      • totalbrowser.exe (PID: 2572)
      • totalbrowser.exe (PID: 6088)
      • totalbrowser.exe (PID: 3288)

    • Reads the machine GUID from the registry

      • TotalBrowser Setup.exe (PID: 6784)
      • totalbrowser.exe (PID: 4024)
      • totalbrowser.exe (PID: 3288)

    • Creates files or folders in the user directory

      • TotalBrowser Setup.exe (PID: 6784)
      • setup.exe (PID: 4708)
      • WerFault.exe (PID: 7036)
      • totalbrowser.exe (PID: 4024)
      • totalbrowser.exe (PID: 1868)
      • chrmstp.exe (PID: 6768)
      • totalbrowser.exe (PID: 3288)
      • totalbrowser.exe (PID: 6660)

    • Reads the software policy settings

      • TotalBrowser Setup.exe (PID: 6784)
      • WerFault.exe (PID: 7036)

    • Checks proxy server information

      • TotalBrowser Setup.exe (PID: 6784)
      • WerFault.exe (PID: 7036)
      • totalbrowser.exe (PID: 4024)
      • totalbrowser.exe (PID: 3288)

    • Create files in a temporary directory

      • TotalBrowser Setup.exe (PID: 6784)
      • mini_installer_x86_64.exe (PID: 3128)
      • hopiumupdater.exe (PID: 5236)
      • totalbrowser.exe (PID: 4024)
      • totalbrowser.exe (PID: 3288)

    • Creates files in the program directory

      • setup.exe (PID: 5036)
      • setup.exe (PID: 4708)

    • Manual execution by a user

      • totalbrowser.exe (PID: 3288)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:09:06 09:49:46+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.36
CodeSize: 4790784
InitializedDataSize: 4512768
UninitializedDataSize: -
EntryPoint: 0x413dbc
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.1.0.0
ProductVersionNumber: 1.1.0.0
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: TotalSecurity
FileDescription: TotalBrowser Installer
FileVersion: 1.1.0.0
InternalName: TotalBrowser
LegalCopyright: Protected.net Group Limited
OriginalFileName: TotalBrowser Setup.exe
ProductName: TotalBrowser Installer
ProductVersion: 1.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
203
Monitored processes
62
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start totalbrowser setup.exe no specs totalbrowser setup.exe mini_installer_x86_64.exe setup.exe setup.exe no specs hopiumupdater.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs setup.exe no specs setup.exe no specs werfault.exe totalbrowser.exe totalbrowser.exe totalbrowser.exe no specs totalbrowser.exe totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs totalbrowser.exe no specs shellexperiencehost.exe no specs systemsettings.exe rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
624"C:\Program Files\Total Browser\Application\totalbrowser.exe" --type=renderer --instant-process --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5644 --field-trial-handle=1864,i,7833236690504375942,3121667889941636085,262144 /prefetch:1C:\Program Files\Total Browser\Application\totalbrowser.exe—totalbrowser.exe
User:
admin
Company:
TotalSecurity Ltd
Integrity Level:
LOW
Description:
Total Browser
Exit code:
0
Version:
116.0.5845.10014
Modules
Images
c:\program files\total browser\application\totalbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\total browser\application\116.0.5845.10014\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
836"C:\Program Files\Total Browser\Application\totalbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4904 --field-trial-handle=1864,i,8748322783716650564,9851897763299965667,262144 /prefetch:8C:\Program Files\Total Browser\Application\totalbrowser.exe—totalbrowser.exe
User:
admin
Company:
TotalSecurity Ltd
Integrity Level:
LOW
Description:
Total Browser
Exit code:
0
Version:
116.0.5845.10014
900schtasks /create /xml "C:\Users\admin\AppData\Local\Temp\totalbrowser\utask.xml" /tn "TotalBrowserUpdateSL" /fC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1076"C:\Program Files\Total Browser\Application\totalbrowser.exe" --type=renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4012 --field-trial-handle=1864,i,7833236690504375942,3121667889941636085,262144 /prefetch:1C:\Program Files\Total Browser\Application\totalbrowser.exe—totalbrowser.exe
User:
admin
Company:
TotalSecurity Ltd
Integrity Level:
LOW
Description:
Total Browser
Exit code:
0
Version:
116.0.5845.10014
Modules
Images
c:\program files\total browser\application\totalbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\total browser\application\116.0.5845.10014\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1520"C:\Program Files\Total Browser\Application\totalbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4320 --field-trial-handle=1864,i,7833236690504375942,3121667889941636085,262144 /prefetch:8C:\Program Files\Total Browser\Application\totalbrowser.exe—totalbrowser.exe
User:
admin
Company:
TotalSecurity Ltd
Integrity Level:
LOW
Description:
Total Browser
Exit code:
0
Version:
116.0.5845.10014
Modules
Images
c:\program files\total browser\application\totalbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\total browser\application\116.0.5845.10014\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1556"C:\Program Files\Total Browser\Application\totalbrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2288 --field-trial-handle=1864,i,7833236690504375942,3121667889941636085,262144 /prefetch:8C:\Program Files\Total Browser\Application\totalbrowser.exe—totalbrowser.exe
User:
admin
Company:
TotalSecurity Ltd
Integrity Level:
LOW
Description:
Total Browser
Exit code:
0
Version:
116.0.5845.10014
Modules
Images
c:\program files\total browser\application\totalbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\total browser\application\116.0.5845.10014\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1604"C:\Program Files\Total Browser\Application\totalbrowser.exe" --type=renderer --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5212 --field-trial-handle=1864,i,7833236690504375942,3121667889941636085,262144 /prefetch:1C:\Program Files\Total Browser\Application\totalbrowser.exe—totalbrowser.exe
User:
admin
Company:
TotalSecurity Ltd
Integrity Level:
LOW
Description:
Total Browser
Exit code:
0
Version:
116.0.5845.10014
Modules
Images
c:\program files\total browser\application\totalbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\total browser\application\116.0.5845.10014\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1868"C:\Program Files\Total Browser\Application\totalbrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --network-service-scheduler --start-stack-profiler --mojo-platform-channel-handle=2160 --field-trial-handle=1864,i,7833236690504375942,3121667889941636085,262144 /prefetch:8C:\Program Files\Total Browser\Application\totalbrowser.exe
totalbrowser.exe
User:
admin
Company:
TotalSecurity Ltd
Integrity Level:
MEDIUM
Description:
Total Browser
Exit code:
0
Version:
116.0.5845.10014
Modules
Images
c:\program files\total browser\application\totalbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\total browser\application\116.0.5845.10014\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2084"C:\Program Files\Total Browser\Application\totalbrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4240 --field-trial-handle=1864,i,7833236690504375942,3121667889941636085,262144 /prefetch:8C:\Program Files\Total Browser\Application\totalbrowser.exe—totalbrowser.exe
User:
admin
Company:
TotalSecurity Ltd
Integrity Level:
LOW
Description:
Total Browser
Exit code:
0
Version:
116.0.5845.10014
Modules
Images
c:\program files\total browser\application\totalbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\total browser\application\116.0.5845.10014\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2120"C:\Program Files\Total Browser\Application\totalbrowser.exe" --type=renderer --first-renderer-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1864,i,7833236690504375942,3121667889941636085,262144 /prefetch:1C:\Program Files\Total Browser\Application\totalbrowser.exe—totalbrowser.exe
User:
admin
Company:
TotalSecurity Ltd
Integrity Level:
LOW
Description:
Total Browser
Exit code:
0
Version:
116.0.5845.10014
Modules
Images
c:\program files\total browser\application\totalbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\total browser\application\116.0.5845.10014\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
15 970
Read events
15 767
Write events
174
Delete events
29

Modification events

(PID) Process:(6784) TotalBrowser Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6784) TotalBrowser Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6784) TotalBrowser Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5036) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Total Browser
Operation:writeName:InstallerProgress
Value:
19
(PID) Process:(5036) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Total Browser
Operation:writeName:InstallerProgress
Value:
25
(PID) Process:(5036) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Total Browser
Operation:writeName:InstallerProgress
Value:
39
(PID) Process:(5036) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Total Browser
Operation:writeName:InstallerProgress
Value:
46
(PID) Process:(5036) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Total Browser
Operation:writeName:InstallerProgress
Value:
53
(PID) Process:(5036) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Total Browser
Operation:writeName:InstallerProgress
Value:
59
(PID) Process:(5036) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Total Browser
Operation:writeName:UninstallString
Value:
C:\Program Files\Total Browser\Application\116.0.5845.10014\Installer\setup.exe
Executable files
6
Suspicious files
547
Text files
158
Unknown types
0

Dropped files

PID
Process
Filename
Type
6784TotalBrowser Setup.exeC:\Users\admin\AppData\Local\Temp\totalbrowser_JWWXpf\mini_installer_x86_64.exe —
MD5:—
SHA256:—
3128mini_installer_x86_64.exeC:\Users\admin\AppData\Local\Temp\totalbrowser_JWWXpf\CR_A5D5A.tmp\CHROME.PACKED.7Z —
MD5:—
SHA256:—
6784TotalBrowser Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:971C514F84BBA0785F80AA1C23EDFD79
SHA256:F157ED17FCAF8837FA82F8B69973848C9B10A02636848F995698212A08F31895
5036setup.exeC:\Program Files\Total Browser\Application\116.0.5845.10014\Installer\chrome.7z —
MD5:—
SHA256:—
6784TotalBrowser Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C60C0C29522E01E6A22BD2717F20782E_DC39533247764BEA0B5C0AC18CF57121binary
MD5:9C9EFE702E0F19E7695F6186D9E13F55
SHA256:733B3395860CA3AE02D0FD371743010C0CFD0546FC822E561F5DFE84DC2AF231
6784TotalBrowser Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C60C0C29522E01E6A22BD2717F20782E_DC39533247764BEA0B5C0AC18CF57121binary
MD5:9A1F8E362C4D02E1FC476EA2E1DAAD8C
SHA256:FEA15EDDE765262A3F17EB3B5C758C14EA202F3A7F9E4824E2A2DCF16FD6294F
6784TotalBrowser Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:BC163AB311A27EEBA1C3FD86F80E152F
SHA256:FAA563E1E36FDB365419D211A2B037EC622BB426EFD390D3058B4A990E653917
6784TotalBrowser Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:1B2F64E2C231679226CE03C532573585
SHA256:7F519DC1D30F772792C1E43CB91AD1ED894045644DE8D8D476FE79C3F504AA14
3128mini_installer_x86_64.exeC:\Users\admin\AppData\Local\Temp\totalbrowser_JWWXpf\CR_A5D5A.tmp\setup.exeexecutable
MD5:37065EF451EB3F694AE41D52BF2F4267
SHA256:8DBFEE668C545F7A7F893077CC415A239C1DA484328F536C7687B5F55778D896
5036setup.exeC:\Program Files\Total Browser\Application\116.0.5845.10014\Installer\setup.exeexecutable
MD5:37065EF451EB3F694AE41D52BF2F4267
SHA256:8DBFEE668C545F7A7F893077CC415A239C1DA484328F536C7687B5F55778D896
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
117
DNS requests
105
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6784
TotalBrowser Setup.exe
GET
200
142.250.186.35:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
6784
TotalBrowser Setup.exe
GET
200
142.250.186.35:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
6784
TotalBrowser Setup.exe
GET
200
142.250.185.227:80
http://o.pki.goog/we2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEQDp0QUsJKDTjglgzzMcQMHF
unknown
—
—
whitelisted
6784
TotalBrowser Setup.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
6784
TotalBrowser Setup.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6288
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2736
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4712
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1176
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5732
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1076
svchost.exe
2.19.106.8:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
6784
TotalBrowser Setup.exe
172.217.16.155:443
storage.googleapis.com
GOOGLE
US
whitelisted
6784
TotalBrowser Setup.exe
142.250.186.35:80
c.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.0
  • 20.190.159.23
  • 40.126.31.3
  • 20.190.159.129
  • 20.190.159.131
  • 40.126.31.1
  • 20.190.159.130
whitelisted
go.microsoft.com
  • 2.19.106.8
whitelisted
storage.googleapis.com
  • 172.217.16.155
  • 142.250.186.59
  • 216.58.206.91
  • 142.250.186.155
  • 172.217.18.27
  • 142.250.181.251
  • 216.58.206.59
  • 216.58.212.155
  • 142.250.186.187
  • 142.250.185.91
  • 142.250.184.251
  • 142.250.184.219
  • 172.217.16.219
  • 142.250.186.91
  • 142.250.186.123
  • 142.250.74.219
whitelisted
c.pki.goog
  • 142.250.186.35
whitelisted
o.pki.goog
  • 142.250.185.227
whitelisted
install.protected.net
  • 185.172.148.128
unknown
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 51.104.136.2
whitelisted

Threats

No threats detected
Process
Message
TotalBrowser Setup.exe
release stream: beta
TotalBrowser Setup.exe
is_admin:true | system_arch:SYSTEM_ARCH_X86_64
TotalBrowser Setup.exe
Runnning as admin: true
TotalBrowser Setup.exe
downloading: https://install.protected.net/hopium/windows/1.1.14.0/mini_installer_x86_64.exe
TotalBrowser Setup.exe
getting buffer
TotalBrowser Setup.exe
C:\Users\admin\AppData\Local\Temp\totalbrowser_JWWXpf
TotalBrowser Setup.exe
writing file (86821456 bytes)
TotalBrowser Setup.exe
Performing system level install
TotalBrowser Setup.exe
download complete
TotalBrowser Setup.exe
Requesting backend::quit(0)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TotalBrowser Setup.exe