File name:

GreenBrowserSetup.exe

Full analysis: https://app.any.run/tasks/2572b12b-b060-41e3-9416-1f343e8fc259
Verdict: Malicious activity
Analysis date: February 13, 2024, 01:54:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

25A0892D10373DDC1450657FCAA1AAC1

SHA1:

D2B293EBAD6893D2B55F6D767AEBFC5269119508

SHA256:

9D3038997AE34CB6BFBA640C446322A275F074D0C38E74ED4A0A8B63884B7AE7

SSDEEP:

49152:vRhlgx52etLROJLO8jQ0Q/zSby4dIHuV96kSakECt05rwUM8ziGFpHmGl0O/++0M:5hexhEj3Q/Uy46uV8kDCt0JwUMWDGYDn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • GreenBrowserSetup.exe (PID: 3732)
      • is-5CSMQ.tmp (PID: 3708)
      • GreenBrowser.exe (PID: 2444)
      • Marketer_Business[1].exe (PID: 1892)
      • is-KC1RJ.tmp (PID: 3968)
      • sbsetup.exe (PID: 3688)
      • sbsetup.exe (PID: 1388)
      • is-RMKAA.tmp (PID: 1880)
      • sbsetup.exe (PID: 2488)
      • is-8HMRH.tmp (PID: 2504)

    • Changes the autorun value in the registry

      • Marketer_Business[1].exe (PID: 1892)

    • Creates a writable file in the system directory

      • is-RMKAA.tmp (PID: 1880)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • GreenBrowserSetup.exe (PID: 3732)
      • is-5CSMQ.tmp (PID: 3708)
      • GreenBrowser.exe (PID: 2444)
      • Marketer_Business[1].exe (PID: 1892)
      • sbsetup.exe (PID: 3688)
      • is-KC1RJ.tmp (PID: 3968)
      • sbsetup.exe (PID: 1388)
      • is-RMKAA.tmp (PID: 1880)
      • sbsetup.exe (PID: 2488)
      • is-8HMRH.tmp (PID: 2504)

    • Reads the Windows owner or organization settings

      • is-5CSMQ.tmp (PID: 3708)
      • Marketer.exe (PID: 2760)
      • is-KC1RJ.tmp (PID: 3968)
      • is-RMKAA.tmp (PID: 1880)
      • is-8HMRH.tmp (PID: 2504)

    • Process drops legitimate windows executable

      • is-5CSMQ.tmp (PID: 3708)
      • is-KC1RJ.tmp (PID: 3968)
      • is-RMKAA.tmp (PID: 1880)
      • WinRAR.exe (PID: 3072)
      • is-8HMRH.tmp (PID: 2504)

    • Reads Microsoft Outlook installation path

      • GreenBrowser.exe (PID: 2444)
      • Marketer.exe (PID: 2760)
      • SmartBro.exe (PID: 3724)

    • Process requests binary or script from the Internet

      • GreenBrowser.exe (PID: 2444)

    • Adds/modifies Windows certificates

      • GreenBrowser.exe (PID: 2444)

    • Reads settings of System Certificates

      • GreenBrowser.exe (PID: 2444)

    • Reads the Internet Settings

      • GreenBrowser.exe (PID: 2444)
      • Marketer_Business[1].exe (PID: 1892)
      • Marketer.exe (PID: 2760)
      • SmartBro.exe (PID: 3724)

    • Reads security settings of Internet Explorer

      • GreenBrowser.exe (PID: 2444)
      • Marketer.exe (PID: 2760)
      • SmartBro.exe (PID: 3724)

    • Checks Windows Trust Settings

      • GreenBrowser.exe (PID: 2444)

    • The process creates files with name similar to system file names

      • Marketer_Business[1].exe (PID: 1892)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Marketer_Business[1].exe (PID: 1892)

    • Creates a software uninstall entry

      • Marketer_Business[1].exe (PID: 1892)

    • Start notepad (likely ransomware note)

      • Marketer_Business[1].exe (PID: 1892)

    • Creates/Modifies COM task schedule object

      • Marketer_Business[1].exe (PID: 1892)
      • Marketer.exe (PID: 2760)
      • _RegDLL.tmp (PID: 3200)
      • _RegDLL.tmp (PID: 3228)
      • _RegDLL.tmp (PID: 2636)
      • _RegDLL.tmp (PID: 864)
      • _RegDLL.tmp (PID: 3764)
      • _RegDLL.tmp (PID: 3464)
      • _RegDLL.tmp (PID: 3304)
      • _RegDLL.tmp (PID: 2016)
      • _RegDLL.tmp (PID: 2292)
      • _RegDLL.tmp (PID: 1928)
      • _RegDLL.tmp (PID: 2672)
      • _RegDLL.tmp (PID: 1344)

    • Reads Internet Explorer settings

      • Marketer.exe (PID: 2760)
      • GreenBrowser.exe (PID: 2444)
      • SmartBro.exe (PID: 3724)

    • Searches for installed software

      • is-8HMRH.tmp (PID: 2504)

  • INFO

    • Checks supported languages

      • GreenBrowserSetup.exe (PID: 3732)
      • is-5CSMQ.tmp (PID: 3708)
      • GreenBrowser.exe (PID: 2444)
      • Marketer_Business[1].exe (PID: 1892)
      • Marketer.exe (PID: 1484)
      • Marketer.exe (PID: 2760)
      • sbsetup.exe (PID: 3688)
      • is-KC1RJ.tmp (PID: 3968)
      • sbsetup.exe (PID: 1388)
      • is-RMKAA.tmp (PID: 1880)
      • _RegDLL.tmp (PID: 3200)
      • _RegDLL.tmp (PID: 2636)
      • _RegDLL.tmp (PID: 3228)
      • _RegDLL.tmp (PID: 864)
      • _RegDLL.tmp (PID: 3764)
      • _RegDLL.tmp (PID: 1040)
      • _RegDLL.tmp (PID: 3464)
      • _RegDLL.tmp (PID: 3304)
      • _RegDLL.tmp (PID: 2016)
      • _RegDLL.tmp (PID: 1832)
      • _RegDLL.tmp (PID: 2672)
      • _RegDLL.tmp (PID: 2292)
      • _RegDLL.tmp (PID: 1344)
      • _RegDLL.tmp (PID: 1928)
      • SmartBro.exe (PID: 3724)
      • sbsetup.exe (PID: 2488)
      • is-8HMRH.tmp (PID: 2504)

    • Create files in a temporary directory

      • GreenBrowserSetup.exe (PID: 3732)
      • is-5CSMQ.tmp (PID: 3708)
      • GreenBrowser.exe (PID: 2444)
      • Marketer_Business[1].exe (PID: 1892)
      • Marketer.exe (PID: 2760)
      • sbsetup.exe (PID: 3688)
      • is-KC1RJ.tmp (PID: 3968)
      • sbsetup.exe (PID: 1388)
      • is-RMKAA.tmp (PID: 1880)
      • SmartBro.exe (PID: 3724)
      • sbsetup.exe (PID: 2488)
      • is-8HMRH.tmp (PID: 2504)

    • Reads the computer name

      • is-5CSMQ.tmp (PID: 3708)
      • GreenBrowser.exe (PID: 2444)
      • Marketer_Business[1].exe (PID: 1892)
      • Marketer.exe (PID: 2760)
      • is-KC1RJ.tmp (PID: 3968)
      • is-RMKAA.tmp (PID: 1880)
      • _RegDLL.tmp (PID: 3200)
      • _RegDLL.tmp (PID: 2636)
      • _RegDLL.tmp (PID: 3228)
      • _RegDLL.tmp (PID: 864)
      • _RegDLL.tmp (PID: 3764)
      • _RegDLL.tmp (PID: 1040)
      • _RegDLL.tmp (PID: 3464)
      • _RegDLL.tmp (PID: 3304)
      • _RegDLL.tmp (PID: 2016)
      • _RegDLL.tmp (PID: 1832)
      • _RegDLL.tmp (PID: 2292)
      • _RegDLL.tmp (PID: 2672)
      • _RegDLL.tmp (PID: 1344)
      • SmartBro.exe (PID: 3724)
      • is-8HMRH.tmp (PID: 2504)

    • Creates files in the program directory

      • is-5CSMQ.tmp (PID: 3708)
      • GreenBrowser.exe (PID: 2444)
      • Marketer_Business[1].exe (PID: 1892)
      • Marketer.exe (PID: 1484)
      • Marketer.exe (PID: 2760)
      • is-RMKAA.tmp (PID: 1880)
      • SmartBro.exe (PID: 3724)

    • Creates files or folders in the user directory

      • is-5CSMQ.tmp (PID: 3708)
      • GreenBrowser.exe (PID: 2444)
      • Marketer_Business[1].exe (PID: 1892)
      • Marketer.exe (PID: 2760)
      • is-RMKAA.tmp (PID: 1880)

    • Creates a software uninstall entry

      • is-5CSMQ.tmp (PID: 3708)
      • is-RMKAA.tmp (PID: 1880)

    • Reads Environment values

      • GreenBrowser.exe (PID: 2444)
      • Marketer_Business[1].exe (PID: 1892)
      • Marketer.exe (PID: 2760)

    • The process uses the downloaded file

      • GreenBrowser.exe (PID: 2444)
      • WinRAR.exe (PID: 3580)
      • WinRAR.exe (PID: 3072)
      • WinRAR.exe (PID: 4080)

    • Reads the machine GUID from the registry

      • GreenBrowser.exe (PID: 2444)
      • Marketer.exe (PID: 2760)
      • SmartBro.exe (PID: 3724)

    • Checks proxy server information

      • GreenBrowser.exe (PID: 2444)
      • Marketer.exe (PID: 2760)
      • SmartBro.exe (PID: 3724)

    • Reads the software policy settings

      • GreenBrowser.exe (PID: 2444)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3580)
      • WinRAR.exe (PID: 3072)
      • WinRAR.exe (PID: 4080)

    • Manual execution by a user

      • sbsetup.exe (PID: 3636)
      • sbsetup.exe (PID: 3688)
      • sbsetup.exe (PID: 3700)
      • sbsetup.exe (PID: 1388)
      • sbsetup.exe (PID: 2488)
      • sbsetup.exe (PID: 1748)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3580)
      • WinRAR.exe (PID: 3072)
      • WinRAR.exe (PID: 4080)

    • Reads mouse settings

      • _RegDLL.tmp (PID: 3228)
      • SmartBro.exe (PID: 3724)

    • Reads Microsoft Office registry keys

      • SmartBro.exe (PID: 3724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable PowerBASIC/Win 9.x (51.2)
.exe | Inno Setup installer (37.9)
.exe | Win32 Executable Delphi generic (4.9)
.dll | Win32 Dynamic Link Library (generic) (2.2)
.exe | Win32 Executable (generic) (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 36864
InitializedDataSize: 17408
UninitializedDataSize: -
EntryPoint: 0x98cc
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: This installation was built with Inno Setup.
CompanyName: MoreQuick.com
FileDescription: GreenBrowser Setup
FileVersion:
LegalCopyright:
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
87
Monitored processes
35
Malicious processes
13
Suspicious processes
0

Behavior graph

Click at the process to see the details
start greenbrowsersetup.exe is-5csmq.tmp greenbrowser.exe marketer_business[1].exe marketer.exe no specs marketer.exe notepad.exe no specs winrar.exe sbsetup.exe no specs sbsetup.exe is-kc1rj.tmp sbsetup.exe no specs sbsetup.exe is-rmkaa.tmp _regdll.tmp no specs _regdll.tmp no specs _regdll.tmp no specs _regdll.tmp no specs _regdll.tmp no specs _regdll.tmp no specs _regdll.tmp no specs _regdll.tmp no specs _regdll.tmp no specs _regdll.tmp no specs _regdll.tmp no specs _regdll.tmp no specs _regdll.tmp no specs _regdll.tmp no specs smartbro.exe no specs winrar.exe sbsetup.exe no specs sbsetup.exe is-8hmrh.tmp winrar.exe greenbrowsersetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
296"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Email Marketer Business Edition\Readme.txtC:\Windows\System32\notepad.exe—Marketer_Business[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
864_RegDLL.tmp 700 580C:\Users\admin\AppData\Local\Temp\is-RBSGM.tmp\_isetup\_RegDLL.tmp—is-RMKAA.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
479930586
Modules
Images
c:\users\admin\appdata\local\temp\is-rbsgm.tmp\_isetup\_regdll.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1040_RegDLL.tmp 700 580C:\Users\admin\AppData\Local\Temp\is-RBSGM.tmp\_isetup\_RegDLL.tmp—is-RMKAA.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
479930586
Modules
Images
c:\users\admin\appdata\local\temp\is-rbsgm.tmp\_isetup\_regdll.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1344_RegDLL.tmp 700 580C:\Users\admin\AppData\Local\Temp\is-RBSGM.tmp\_isetup\_RegDLL.tmp—is-RMKAA.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
479930586
Modules
Images
c:\users\admin\appdata\local\temp\is-rbsgm.tmp\_isetup\_regdll.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1384"C:\Users\admin\AppData\Local\Temp\GreenBrowserSetup.exe" C:\Users\admin\AppData\Local\Temp\GreenBrowserSetup.exe—explorer.exe
User:
admin
Company:
MoreQuick.com
Integrity Level:
MEDIUM
Description:
GreenBrowser Setup
Exit code:
3221226540
Version:
Modules
Images
c:\users\admin\appdata\local\temp\greenbrowsersetup.exe
c:\windows\system32\ntdll.dll
1388"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\sbsetup[1]\sbsetup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\sbsetup[1]\sbsetup.exe
explorer.exe
User:
admin
Company:
Mind Vision Software (MVS)
Integrity Level:
HIGH
Description:
Smart Bro Setup
Exit code:
0
Version:
2.7.0.0010
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\sbsetup[1]\sbsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1484"C:\Program Files\Email Marketer Business Edition\Marketer.exe" /setupC:\Program Files\Email Marketer Business Edition\Marketer.exe—Marketer_Business[1].exe
User:
admin
Company:
Nesox Solutions
Integrity Level:
HIGH
Description:
Email Marketer Administrator
Exit code:
0
Version:
2.0.1.21
Modules
Images
c:\program files\email marketer business edition\marketer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1748"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\sbsetup[1]\sbsetup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\sbsetup[1]\sbsetup.exe—explorer.exe
User:
admin
Company:
Mind Vision Software (MVS)
Integrity Level:
MEDIUM
Description:
Smart Bro Setup
Exit code:
3221226540
Version:
2.7.0.0010
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\sbsetup[1]\sbsetup.exe
c:\windows\system32\ntdll.dll
1832_RegDLL.tmp 700 580C:\Users\admin\AppData\Local\Temp\is-RBSGM.tmp\_isetup\_RegDLL.tmp—is-RMKAA.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
479930586
Modules
Images
c:\users\admin\appdata\local\temp\is-rbsgm.tmp\_isetup\_regdll.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1880"C:\Users\admin\AppData\Local\Temp\is-TVGHA.tmp\is-RMKAA.tmp" /SL4 $902FC "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\sbsetup[1]\sbsetup.exe" 1841243 52224 C:\Users\admin\AppData\Local\Temp\is-TVGHA.tmp\is-RMKAA.tmp
sbsetup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.43.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-tvgha.tmp\is-rmkaa.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
54 092
Read events
53 472
Write events
492
Delete events
128

Modification events

(PID) Process:(3708) is-5CSMQ.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GreenBrowser_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.1.14
(PID) Process:(3708) is-5CSMQ.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GreenBrowser_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\GreenBrowser
(PID) Process:(3708) is-5CSMQ.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GreenBrowser_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\GreenBrowser\
(PID) Process:(3708) is-5CSMQ.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GreenBrowser_is1
Operation:writeName:Inno Setup: Icon Group
Value:
GreenBrowser
(PID) Process:(3708) is-5CSMQ.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GreenBrowser_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(3708) is-5CSMQ.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GreenBrowser_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
desktopicon,quicklaunchicon
(PID) Process:(3708) is-5CSMQ.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GreenBrowser_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
(PID) Process:(3708) is-5CSMQ.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GreenBrowser_is1
Operation:writeName:DisplayName
Value:
GreenBrowser
(PID) Process:(3708) is-5CSMQ.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GreenBrowser_is1
Operation:writeName:UninstallString
Value:
"C:\Program Files\GreenBrowser\unins000.exe"
(PID) Process:(3708) is-5CSMQ.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GreenBrowser_is1
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files\GreenBrowser\unins000.exe" /SILENT
Executable files
95
Suspicious files
147
Text files
944
Unknown types
30

Dropped files

PID
Process
Filename
Type
3732GreenBrowserSetup.exeC:\Users\admin\AppData\Local\Temp\is-2BNTS.tmp\is-5CSMQ.tmpexecutable
MD5:33F7FF58846F9D1C124E3B9F2F464C75
SHA256:D7A755B41A765B5E682BA9130B5D94857745DE87787B0E87D012BC19A06F67AB
3708is-5CSMQ.tmpC:\Users\admin\AppData\Local\Temp\is-GM41F.tmp\_isetup\_RegDLL.tmpexecutable
MD5:C594B792B9C556EA62A30DE541D2FB03
SHA256:5DCC1E0A197922907BCA2C4369F778BD07EE4B1BBBDF633E987A028A314D548E
3708is-5CSMQ.tmpC:\Program Files\GreenBrowser\Language\is-V1U3A.tmptext
MD5:B3F349E4512EB5A8F1A43180D315B1DF
SHA256:D6FDFD2499B56D3ED08D9547447F41FDEB817287BE64F2FCBFCB29DD2671E4FA
3708is-5CSMQ.tmpC:\Program Files\GreenBrowser\GreenBrowser.exe.manifestxml
MD5:DE2515B078550B833951EE122C48F527
SHA256:7EE3E4CC43BACFBD16C8C18C6D48B87A6949C820AF2C46819A9C8E139F2E2321
3708is-5CSMQ.tmpC:\Users\admin\AppData\Local\Temp\is-GM41F.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
3708is-5CSMQ.tmpC:\Program Files\GreenBrowser\GreenBrowser.exeexecutable
MD5:8B5F79E0B21F7B4EB19E10E0F3FFE859
SHA256:E2A1162F0D45B2B91E933B794721D11D9D86D5A8359DC3912A79374E37D3D032
3708is-5CSMQ.tmpC:\Program Files\GreenBrowser\is-AOO1P.tmpxml
MD5:DE2515B078550B833951EE122C48F527
SHA256:7EE3E4CC43BACFBD16C8C18C6D48B87A6949C820AF2C46819A9C8E139F2E2321
3708is-5CSMQ.tmpC:\Program Files\GreenBrowser\thanks.txttext
MD5:C5EA84E283A0460D09E71F74EB7A632E
SHA256:4CF5201FC52B22A27B2B104F5B757806A4BFD37D43A537075DB67030F31DCA4A
3708is-5CSMQ.tmpC:\Program Files\GreenBrowser\is-6TBFJ.tmptext
MD5:C5EA84E283A0460D09E71F74EB7A632E
SHA256:4CF5201FC52B22A27B2B104F5B757806A4BFD37D43A537075DB67030F31DCA4A
3708is-5CSMQ.tmpC:\Program Files\GreenBrowser\Language\is-UPLNS.tmptext
MD5:8DF001E7D1814AD7C21A06FECC76C011
SHA256:8D47B10E16A6C9002C514C33389A6F7E596241A2362218F208EBBAA946C1B3F0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
78
DNS requests
39
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2444
GreenBrowser.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/s/gts1d4/ok7nfsVS8dU/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEQDuySslJKZ3ehDRpiVmdkZM
unknown
binary
472 b
unknown
2444
GreenBrowser.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/s/gts1d4/DtbORQ50ZQ8/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEQDy51r4r0ciJwpN38T7Drek
unknown
binary
472 b
unknown
2444
GreenBrowser.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEH6HwqMlsnS7%2BryQ1sUoZV4%3D
unknown
binary
1.40 Kb
unknown
2444
GreenBrowser.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/s/gts1d4/YgGRBeSki8s/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEQCFUugyJ2LAjhJEjJh5CWEU
unknown
binary
472 b
unknown
2444
GreenBrowser.exe
GET
302
151.101.3.5:80
http://www.cnn.com/HEALTH/
unknown
—
—
unknown
2444
GreenBrowser.exe
GET
301
151.101.195.5:80
http://edition.cnn.com/HEALTH/
unknown
text
41 b
unknown
2444
GreenBrowser.exe
GET
301
151.101.195.5:80
http://edition.cnn.com/health
unknown
text
41 b
unknown
2444
GreenBrowser.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAkO6MXeW%2Fpi0q4v9wl8SFc%3D
unknown
binary
471 b
unknown
2444
GreenBrowser.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
binary
471 b
unknown
2444
GreenBrowser.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2444
GreenBrowser.exe
154.85.61.64:80
www.5igb.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
US
unknown
2444
GreenBrowser.exe
34.117.66.109:80
www.livescore.com
GOOGLE-CLOUD-PLATFORM
US
unknown
2444
GreenBrowser.exe
34.117.66.109:443
www.livescore.com
GOOGLE-CLOUD-PLATFORM
US
unknown
2444
GreenBrowser.exe
72.247.155.75:80
ctldl.windowsupdate.com
Akamai International B.V.
ES
unknown
2444
GreenBrowser.exe
142.250.185.131:80
ocsp.pki.goog
GOOGLE
US
whitelisted
2444
GreenBrowser.exe
35.227.219.39:443
static.livescore.com
GOOGLE
US
unknown
2444
GreenBrowser.exe
34.117.170.52:443
geo.livescore.com
GOOGLE-CLOUD-PLATFORM
US
unknown

DNS requests

Domain
IP
Reputation
www.5igb.com
  • 154.85.61.64
unknown
count4.51yes.com
  • —
unknown
www.livescore.com
  • 34.117.66.109
unknown
ctldl.windowsupdate.com
  • 72.247.155.75
  • 84.53.132.75
  • 93.184.221.240
whitelisted
ocsp.pki.goog
  • 142.250.185.131
whitelisted
static.livescore.com
  • 35.227.219.39
unknown
lsm-static-prod.livescore.com
  • 34.107.154.30
unknown
geo.livescore.com
  • 34.117.170.52
unknown
www.cnn.com
  • 151.101.3.5
  • 151.101.67.5
  • 151.101.131.5
  • 151.101.195.5
whitelisted
edition.cnn.com
  • 151.101.195.5
  • 151.101.131.5
  • 151.101.3.5
  • 151.101.67.5
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GreenBrowserSetup.exe