Multi-License Discount Quote
Threat Database Potentially Unwanted Programs OneBrowser

OneBrowser

By Mezo in Potentially Unwanted Programs, Browser Hijackers
Translate To:

Untrustworthy applications that manipulate browser settings without consent represent significant risks to users' online security and privacy. These programs, categorized as Potentially Unwanted Programs (PUPs), may alter how a browser functions, redirect traffic to questionable sites and track browsing activities for data collection. One such intrusive browser hijacker is OneBrowser, which interferes with user preferences and promotes dubious search engines. Understanding how it operates and spreads is essential to maintaining a secure browsing experience.

What is OneBrowser?

OneBrowser is an intrusive application that modifies browser settings to force users to use unreliable search engines. Instead of delivering relevant and trustworthy search results, these engines may prioritize sponsored content, misleading advertisements, or even direct users to risky websites. The modifications imposed by OneBrowser often include changes to the default homepage, search provider, and new tab settings.

Once installed, this browser hijacker may also inject excessive advertisements into web pages, cause frequent redirects, and manipulate search queries to benefit third-party partners. Users often experience sluggish browsing performance, unwanted pop-ups, and difficulty reverting their browser settings.

How OneBrowser Affects Browsing Experience

OneBrowser's presence on a system introduces multiple inconveniences and security concerns. Users may encounter:

  • Forced Redirects: Search queries and website visits could be redirected to dubious search engines or affiliate pages that generate revenue for the operators behind OneBrowser.
  • Intrusive Advertisements: Pop-ups, banners, and in-text advertisements may appear frequently, leading to questionable offers, deceptive pages or even fake promotions.
  • Data Tracking Risks: The browser hijacker might monitor browsing habits, search history, and personal details. Collected data could be used for targeted advertising or even sold to third parties.
  • Difficult Manual Removal: Users attempting to restore their browser settings manually may find that OneBrowser persists, sometimes reinstating itself even after uninstallation attempts.

Questionable Distribution Tactics of PUPs

PUPs like OneBrowser often do not rely on direct user downloads but instead spread through misleading distribution tactics, making them difficult to detect before installation. Common methods include:

  • Software Bundling: OneBrowser may be hidden within installers of free applications from third-party websites. Users who rush through installation processes without reviewing options may unknowingly allow it onto their systems.
  • Fake Software Updates: Fraudulent update prompts claiming to offer necessary patches for browsers, media players, or other software may secretly install OneBrowser instead.
  • Fraudulent Advertisements: Clicking on deceptive ads promising free services, giveaways, or performance improvements might lead to the unintentional download of intrusive software.
  • Compromised Websites: Visiting specific untrustworthy sites may trigger automatic scripts that attempt to install unwanted browser extensions or modify browser settings.

Strengthening Defenses against Browser Hijackers

To minimize the risk of encountering PUPs like OneBrowser, users should take proactive security measures, including:

  • Careful Software Installation: Always choose 'Custom' or 'Advanced' settings during software installations to identify and decline bundled offers.
  • Avoiding Suspicious Advertisements and Links: Avoid clicking on pop-ups or promotional content from unknown sources, as these may lead to deceptive downloads.
  • Keeping Software Updated: Ensure that browsers and essential software are updated only from official sources to prevent exposure to fake update scams.
  • Using Reliable Security Tools: Security software with real-time protection may help detect and prevent unauthorized browser modifications.
  • Regularly Reviewing Extensions and Settings: Periodically check installed browser extensions and reset browser settings if any unauthorized changes are detected.

By staying vigilant and implementing these security practices, users can better protect themselves from intrusive browser hijackers and maintain control over their browsing experience.

Analysis Report

General information

Family Name: OneBrowser
Signature status: Self Signed

Known Samples

MD5: e810fdd67f792f51677eb41147031d1e
SHA1: 64eaeeb21a0a88ecde826f57305af566909e8c97
SHA256: 6E1F84E3B1A1681C7FD2E643130433DBA9E12D442A433B0FC714E9FFC84D7FD0
File Size: 6.77 MB, 6766600 bytes
MD5: 04871138a46b1e55c4898530c95be835
SHA1: cde11f7d08536e148b8c70182cb66a389200f9d8
SHA256: DF1B14CCD5D08C61E8BB2327D1AF264E09D7274C49F21D84E6141209875ACF71
File Size: 15.37 KB, 15368 bytes
MD5: 952071dcb852425349ad191050699518
SHA1: b5825f3a889b9e1b0cf380230158ca16f62184c1
SHA256: 0055AE7323E8FBC5FAD5FC3E651929DEBF6EBB82D2CF3C885C71ED03E4E8A336
File Size: 4.25 MB, 4251144 bytes
MD5: 0eb3d14380dd71d54dff49a641b48036
SHA1: 7f06413aa0b71f815e49f63944d84cf7e0c926a8
SHA256: 1A2E843630CE3CF0AB4FCEC4D4A259FEFD792EF2C0BB108A1E658B23CA5F781A
File Size: 4.07 MB, 4070408 bytes
MD5: c5f5c43c21d5e96466bc89f636369faa
SHA1: 76ff31a1625519f9cfe7e950abfb80412f4c2918
SHA256: A40D4C0285751682187667B96CDB9C2ED036FD4C275B05B07BA41E3F6C8ECFBF
File Size: 12.82 KB, 12816 bytes
Show More
MD5: 9d99e2bb05e6983e4c9d8d0d1384b29f
SHA1: bb4f803c2dc0c75657c6683bf4b53d3bede9e3c6
SHA256: 7169C12461282FFD238DFAC0908F48680E479894187A64D0EA574FBA900FA8AA
File Size: 103.84 KB, 103840 bytes
MD5: 4cacef2c307a98bb584b065485f6419d
SHA1: 0624e96b1303911965f4857b146f75d2965a0fe2
SHA256: FAF7AB545E70A97E5BCC3C58A98962D27C91AA96E8AE0994CF27AD5E5D964917
File Size: 12.82 KB, 12816 bytes
MD5: 421111e2e972c2dc02509565dfe58b9a
SHA1: 0ca767ac8acb598cdedd6ad711234ab74f68389c
SHA256: 7016BD65896DA09D15CDA98C974D9F7AEA9F7A1EC1B8BA89BBA6B6E024DCE6E9
File Size: 104.35 KB, 104352 bytes
MD5: 483f9c126954a555c10f26f976a32f50
SHA1: 33eba8b9ed316a3718b90e72d37819986d249b9a
SHA256: 64EC17CF92438D0A961CC67B367E5D3F499DCD4E90A3239D81B685D18E80AD8E
File Size: 3.31 MB, 3309584 bytes
MD5: 48d3eb964fd9b62572d77e98a8a6aa15
SHA1: 649e71c6405a5f4ba101c7cd50f336492d8438b3
SHA256: 40BBF1D5AE1CF313AA31467BDB51F3A7D1D412BF3A5C262D6AB481F089D887C5
File Size: 12.82 KB, 12816 bytes
MD5: dba03ab3be9f17a389166b7369e2acc4
SHA1: 57e9c9c3b26315504cddbcb43f9d54722505ec4d
SHA256: 48AC6CC9978B7F63F23D6420F76BBCAC97243D16D19C25C9D5ADCA47FBF587A3
File Size: 91.66 KB, 91664 bytes
MD5: 78c66c9be1bef8db266c0dfca55640ae
SHA1: 3d7ec646ef62f1ccf613da86163db98a2cf5a856
SHA256: 55EDBBE4767D8375CE732893478CA78FAF0B3C2CE44E169AD18E55C66533B03D
File Size: 4.25 MB, 4251144 bytes
MD5: a36f5d837ad1411aadd1d051564a07b7
SHA1: cbdaea221176488c5d69fbe8ebc869b59c4a5ab0
SHA256: B44B6C273DA470D8BC9A6D21501CCCD7E32DA794A91F02EB2F0A7428F2F7E510
File Size: 6.84 MB, 6839816 bytes
MD5: 5aa120ee57bf8dbe30e78ced9d1c7e0f
SHA1: b60364cde63fc62fd33cd4b782926f33f7d6d126
SHA256: 9BEC78B77027742A72E215AC24775F7CC27930987333D47C60A6BD953A3F58C9
File Size: 6.85 MB, 6854152 bytes
MD5: b912ff7b2e3bafff09e790b5c6325034
SHA1: 9ca5c68665f67646d361349af0b48332e69b28a4
SHA256: 58593A82A2E26D37CF4752985CD38B4DCD1E15720664E0C4A45E9D18C2EB7C94
File Size: 15.37 KB, 15368 bytes
MD5: 3137246262b9b0467ecc01033147cf28
SHA1: 788d0f7d5253e84c34a220e92dbcb5866cd0f713
SHA256: 7308680634A887944EFE20288C5A187DE6F1BD9CBCC81A62B2F88601ABAB1242
File Size: 5.43 MB, 5432840 bytes
MD5: 3f3e0fedb534c5b8b2b5a04e7a021f17
SHA1: 8cc5ce48e553e73d798f2ce178c96c177f07ac15
SHA256: 493E6B44B84ACCFC38C05C9C1011B944E9AB4115830D8D8A3EFA35A76DD901B2
File Size: 6.85 MB, 6854664 bytes
MD5: bad70f661b1a50f4d5785e1680c60ebf
SHA1: 0feb753ffec52f6c8e7f50a4c9146a0b8a4b87a2
SHA256: 67107FB66F5C8BB5601F35A7E6B16D84A6920F3A2A639ADFC848DAA221295795
File Size: 4.80 MB, 4800008 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have exports table
  • File has exports table
  • File has TLS information
  • File is 32-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
Show More
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name Value
Company Name
  • Chickadee Digital, LLC
  • WORK PRODUCT, INC.
  • Work Product Inc.
  • WP Inc.
Company Short Name
  • Chickadee Digital, LLC
  • WORK PRODUCT, INC.
  • Work Product Inc.
  • WP Inc.
File Description
  • OnB Installer
  • OnBr Installer
  • OnBsr Installer
  • OneB Browser Setup
  • OneBrowser
  • OneBrowser Installer
File Version
  • 137.0.7151.69
  • 115.0.5790.171
  • 109.0.5414.121
  • 109.0.5414.120
  • 1.3.81.10
  • 1.3.80.10
Internal Name
  • chrome_wer_dll
  • eventlog_provider_dll
  • OneB Browser Setup
  • OneBrowser Installer
  • setup
Last Change
  • 0
  • 0b41cf178df5ebd22252d11719fe2d784d31c266-refs/branch-heads/7151@{#1874}
  • 168eebf2055fd26ca8c71787b7b3f9fe7c90d13d-refs/branch-heads/5414@{#1459}
  • cf9067bf10d8f798c24643029af1d24e275646d6-refs/branch-heads/5790@{#1924}
Legal Copyright
  • Copyright 2023 Chickadee Digital, LLC. All rights reserved.
  • Copyright 2023 WORK PRODUCT, INC. All rights reserved.
  • Copyright 2025 WORK PRODUCT, INC.
  • Copyright 2025 WORK PRODUCT, INC. All rights reserved.
  • Copyright 2025 Work Product Inc. All rights reserved.
  • Copyright 2026 Work Product Inc.
  • Copyright 2026 WorkProductInc All rights reserved.
  • Copyright 2026 WP Inc. All rights reserved.
Official Build 1
Original Filename
  • chrome_wer.dll
  • eventlog_provider.dll
  • OBUpdateService.exe
  • OneBUpdateService.exe
Product Name
  • OnB Installer
  • OnBr Installer
  • OnBsr Installer
  • OneB Browser Upgrader
  • OneBrowser
  • OneBrowser Update
Product Short Name
  • OnB Installer
  • OnBr Installer
  • OnBsr Installer
  • OneBrowser
Product Version
  • 137.0.7151.69
  • 115.0.5790.171
  • 109.0.5414.121
  • 109.0.5414.120
  • 1.3.81.10
  • 1.3.80.10

Digital Signatures

Signer Root Status
Work Product Inc. GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1 Self Signed
WORK PRODUCT, INC. SSL.com EV Code Signing Intermediate CA RSA R3 Self Signed
Chickadee Digital, LLC Sectigo Public Code Signing Root R46 Root Not Trusted

Block Information

Total Blocks: 16,421
Potentially Malicious Blocks: 1,402
Whitelisted Blocks: 9,554
Unknown Blocks: 5,465

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 x 0 0 x ? ? 0 ? ? 0 ? x ? ? ? ? ? ? ? ? ? 0 ? ? 0 x 0 0 x ? ? 0 0 0 0 0 x x x x x 0 ? ? 0 x 0 ? ? ? 0 0 0 0 x 0 0 0 0 0 x ? ? 0 ? 0 x 0 ? 0 ? x ? 0 0 x 0 0 0 ? ? 0 x x x ? ? ? x x 0 0 0 ? ? ? ? ? x ? 0 ? 0 0 0 0 0 0 0 0 ? ? ? ? x x ? ? 0 ? 0 ? 0 ? 0 ? 0 0 ? 0 ? 0 0 0 ? 0 0 0 ? ? x 0 0 ? ? 0 0 0 0 0 ? x x x ? 0 0 0 ? ? ? x ? ? ? ? 0 0 0 x x 0 0 0 0 ? 0 ? ? 0 0 0 ? 0 0 0 0 0 0 ? ? ? ? ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? 0 ? ? 0 0 0 0 0 ? 0 ? 0 ? ? ? 0 ? ? 0 ? ? 0 ? 0 0 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 ? ? 0 ? ? 0 0 ? 0 0 0 0 ? ? 0 ? ? ? ? 0 0 ? ? 0 0 ? ? ? 0 ? ? ? 0 0 0 0 ? ? ? ? 0 ? ? 0 0 0 0 0 ? ? 0 ? ? 0 0 0 0 ? 0 ? ? 0 ? ? ? ? ? 0 ? 0 ? 0 ? 0 0 0 ? 0 ? 0 ? ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 ? 0 ? 0 ? 0 ? ? ? ? ? ? ? ? ? 0 ? 0 ? ? 0 ? 0 ? 0 0 0 ? 0 ? ? ? ? 0 0 ? ? 0 0 0 ? ? ? ? 0 ? ? ? 0 0 ? 0 0 0 ? ? 0 ? 0 0 0 ? 0 0 0 0 0 ? ? 0 ? 0 0 ? ? ? 0 ? 0 ? ? ? 0 0 ? ? ? 0 0 ? ? 0 ? ? 0 0 0 0 0 0 0 0 0 ? ? ? ? ? 0 0 0 0 0 ? x 0 ? x 0 x 0 ? 0 ? ? x 0 ? ? ? x x x ? ? x x 0 ? 0 ? 0 ? ? ? 0 x ? 0 0 x ? x x 0 ? 0 0 0 ? 0 ? 0 ? ? 0 ? ? ? 0 0 0 0 ? 0 0 x 0 0 ? ? ? ? 0 0 0 ? 0 ? ? 0 ? 0 ? 0 0 ? 0 ? ? 0 ? 0 0 ? ? ? ? 0 ? 0 ? 0 ? ? 0 ? ? ? 0 0 ? 0 x x x 0 ? 0 ? ? ? 0 ? ? ? ? ? ? 0 ? 0 ? 0 ? ? 0 ? 0 ? 0 ? ? ? 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? 0 ? ? ? 0 ? 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? ? ? 0 ? ? ? ? ? 0 0 ? ? ? 0 0 ? ? ? ? ? 0 ? ? ? ? 0 ? 0 0 ? ? ? 0 ? ? 0 0 ? 0 ? ? ? ? ? ? 0 0 ? ? 0 0 0 0 0 0 0 ? ? 0 0 ? ? ? 0 ? ? ? 0 ? ? ? ? 0 ? 0 ? 0 ? ? ? ? ? ? ? 0 ? ? ? ? ? ? 0 ? ? 0 ? 0 ? ? ? ? ? ? ? 0 ? 0 ? 0 0 ? ? 0 ? ? ? 0 0 ? ? 0 0 0 0 ? 0 ? ? 0 0 0 0 ? ? ? 0 ? ? ? ? 0 ? ? ? 0 ? 0 0 0 ? ? ? 0 0 ? 0 ? ? ? ? ? ? ? ? ? 0 ? ? 0 0 0 0 0 0 0 ? ? ? ? 0 0 ? 0 0 0 0 0 ? 0 ? ? ? 0 ? 0 0 0 0 0 x 0 0 ? ? ? 0 0 0 0 ? ? 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? 0 ? ? 0 ? 0 ? ? ? ? ? 0 ? ? ? 0 0 ? ? 0 ? 0 ? ? ? ? 0 ? 0 ? 0 ? 0 0 0 ? ? ? ? ? ? ? ? ? 0 ? ? 0 0 0 ? ? ? 0 ? ? ? ? ? ? ? 0 ? 0 0 ? 0 ? ? ? ? ? ? ? ? 0 0 ? ? ? ? 0 ? ? 0 ? ? 0 0 ? 0 0 ? ? 0 ? ? ? 0 0 0 0 0 0 ? 0 0 x ? 0 ? ? ? ? 0 0 0 0 ? x 0 ? ? 0 ? ? ? ? ? ? ? ? ? 0 0 0 0 ? ? 0 ? 0 0 ? ? ? 0 ? 0 0 0 ? 0 0 0 ? ? ? 1 0 0 0 0 ? 0 0 0 ? ? ? 0 0 0 0 0 0 ? 0 ? ? 0 ? 0 0 0 ? 0 0 ? 0 0 ? ? 0 0 ? ? ? ? ? ? 0 ? ? ? ? 0 0 ? 0 ? 0 0 0 0 0 ? ? ? x ? 0 x x x 1 ? x 0 x 0 0 0 0 ? ? 0 ? x 0 x ? x x x ? 0 ? ? ? ? 0 ? 0 0 ? 0 x x 0 0 ? ? 0 ? ? 0 ? x x x x 0 0 0 ? 0 ? x 0 ? 0 0 0 0 x x x 0 ? 0 0 ? 0 0 0 0 0 x x x x x ? ? 0 x 0 0 0 0 0 0 0 x 0 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? x ? ? 0 ? 0 0 0 x 0 x x 0 x 0 0 x 0 x 0 x 0 0 0 x x x x ? x ? ? ? ? ? ? ? 0 ? 0 0 0 0 ? 0 ? 0 0 0 0 x 0 ? 0 0 0 0 x 0 x 0 x 0 0 ? ? 0 ? 0 0 0 0 0 0 0 0 x x x x x x 0 0 x x x x x x 0 0 x 0 ? 0 ? 0 ? 0 0 ? 0 ? ? x x ? ? 0 0 0 0 x ? x 0 0 ? 0 x 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 x ? ? ? ? ? ? 0 ? 0 ? ? 0 ? x 0 x ? ? ? ? ? ? 0 ? 0 0 0 0 0 ? x x x 0 0 ? ? 0 x ? ? 0 ? ? ? 0 ? ? 0 ? ? 0 0 0 x x 0 x x x 0 0 x x 0 0 0 0 0 x x x x 0 0 x 0 x x 0 x x x x 0 x x x 0 x x x 0 ? ? 0 ? 0 0 ? 0 0 0 ? 0 ? 0 ? ? x 0 0 ? 0 0 ? 0 0 x ? ? 0 x ? x 0 0 x 0 0 x 0 0 0 0 0 0 ? 0 ? 0 ? x ? 0 0 ? x 0 0 0 0 0 0 ? ? ? ? ? 0 ? ? ? 0 0 0 0 ? 0 0 0 0 ? ? ? 0 ? 0 ? ? x x 0 ? 0 ? x ? ? ? ? ? x ? ? 0 ? 0 ? ? ? ? ? ? 0 x x 0 0 x 0 0 ? ? x 0 ? ? ? ? x 0 ? ? 0 x x ? x ? 0 x 0 ? x ? x x 0 0 0 x 0 0 x x 0 x 0 x x 0 0 0 ? x ? 0 0 0 x 0 x 0 ? ? 0 ? 0 0 0 x x 0 0 0 ? ? ? ? ? 0 0 0 ? ? ? 0 0 ? 0 ? ? 0 ? ? x x x ? 0 0 ? ? 0 0 ? x x x x ? ? ? ? 0 0 0 0 x 0 0 0 0 0 0 0 x x x x 0 0 0 0 0 0 x 0 0 0 ? x ? 0 ? ? 0 ? x 0 0 x ? x 0 0 0 0 0 0 0 0 0 0 x 0 ? ? ? ? ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 ? 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 x x 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? ? 0 ? 0 0 0 0 0 ? ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 ? ? 0 0 ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 x x x 0 ? 0 0 0 0 0 0 x x ? ? 0 ? 0 0 ? 0 0 0 0 x 0 0 0 0 0 x 0 x 0 0 ? 0 0 x 0 x 0 0 ? 0 ? 0 ? 0 0 x 0 0 0 ? x x 0 ? 0 x 0 x 0 0 0 ? x x 0 ? 0 ? 0 x ? x ? 0 x ? 0 x 0 0 x x x 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? x x 0 x ? ? ? ? ? x ? ? ? x 0 0 x x 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? ? 0 x 0 ? x ? ? ? ? ? ? ? ? ? x x x ? x x 0 0 x 0 0 0 ? ? 0 0 0 ? ? 0 0 ? ? 0 x x 0 0 x x 0 x x 0 x 0 x 0 ? ? 0 0 0 ? ? 0 0 ?
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Agent.AN
  • Kryptik.CBX
  • Kryptik.CBXA
  • OneBrowser.A
  • Trojan.Agent.Gen.AJG
Show More
  • Trojan.Agent.Gen.APA
  • Trojan.Agent.Gen.SX
  • Trojan.Kryptik.Gen.COR
  • Trojan.ShellcodeRunner.Gen.FF

Files Modified

File Attributes
c:\users\user\downloads\72fa0ff3_obupdate.conf Generic Write,Read Attributes

Registry Modifications

Key::Value Data API Name
HKLM\software\wow6432node\onebrowser::hb  RegNtPreCreateKey
HKLM\software\wow6432node\onebrowser::72fa0ff3_installid RegNtPreCreateKey

Windows API Usage

Category API
Network Wininet
  • HttpOpenRequest
  • HttpSendRequest
  • InternetConnect
  • InternetOpen
  • InternetQueryOption
  • InternetReadFile
  • InternetSetOption
Anti Debug
  • NtQuerySystemInformation
Network Winhttp
  • WinHttpOpen
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtQueryAttributesFile
Show More
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWriteFile
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Service Control
  • OpenSCManager
  • OpenService
Network Winsock2
  • WSAStartup
Network Winsock
  • accept
  • bind
  • closesocket
  • connect
  • freeaddrinfo
  • getaddrinfo
  • getpeername
  • getsockname
  • recv
  • send
Show More
  • setsockopt
  • socket
Encryption Used
  • CryptAcquireContext
User Data Access
  • GetUserName

Shell Command Execution

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\cde11f7d08536e148b8c70182cb66a389200f9d8_0000015368.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\76ff31a1625519f9cfe7e950abfb80412f4c2918_0000012816.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\bb4f803c2dc0c75657c6683bf4b53d3bede9e3c6_0000103840.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0624e96b1303911965f4857b146f75d2965a0fe2_0000012816.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0ca767ac8acb598cdedd6ad711234ab74f68389c_0000104352.,LiQMAxHB
Show More
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\649e71c6405a5f4ba101c7cd50f336492d8438b3_0000012816.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\57e9c9c3b26315504cddbcb43f9d54722505ec4d_0000091664.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\9ca5c68665f67646d361349af0b48332e69b28a4_0000015368.,LiQMAxHB

Trending

Most Viewed

Loading...