URL:

https://gameloop.fun/

Full analysis: https://app.any.run/tasks/eca6ceef-d2ea-416c-83c9-1dbc5c78d089
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 24, 2020, 17:36:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

1B745B13697BB6AE0C0E3D1A0795C37B

SHA1:

391D4B9D5787BDF50A42C3A51260F24D0EC8DE44

SHA256:

0071160E43BA950CD4EF5ADED86BA22780B3E40A995E4E7CA074F9774D64B68B

SSDEEP:

3:N8lfQLKn:2tVn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • GLP_Installer_900207212_market.exe (PID: 2888)
      • GLP_Installer_900207212_market.exe (PID: 2160)
      • QMEmulatorService.exe (PID: 3548)
      • AppMarket.exe (PID: 3744)
      • Tinst.exe (PID: 3976)
      • syzs_dl_svr.exe (PID: 2108)
      • TBSWebRenderer.exe (PID: 3824)
      • GameDownload.exe (PID: 2476)
      • vcredist.exe (PID: 3624)
      • Tinst.exe (PID: 2700)
      • Tinst.exe (PID: 2588)

    • Loads dropped or rewritten executable

      • GLP_Installer_900207212_market.exe (PID: 2160)
      • QMEmulatorService.exe (PID: 3548)
      • AppMarket.exe (PID: 3744)
      • TBSWebRenderer.exe (PID: 3824)
      • GameDownload.exe (PID: 2476)
      • msiexec.exe (PID: 2532)

    • Adds new firewall rule via NETSH.EXE

      • Tinst.exe (PID: 3976)
      • Tinst.exe (PID: 2700)

    • Actions looks like stealing of personal data

      • AppMarket.exe (PID: 3744)

    • Changes settings of System certificates

      • AppMarket.exe (PID: 3744)
      • msiexec.exe (PID: 2532)

    • Downloads executable files from the Internet

      • GLP_Installer_900207212_market.exe (PID: 2160)

    • Changes the autorun value in the registry

      • vcredist.exe (PID: 3624)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3620)

    • Executable content was dropped or overwritten

      • opera.exe (PID: 3392)
      • GLP_Installer_900207212_market.exe (PID: 2160)
      • Market.exe (PID: 2420)
      • Tinst.exe (PID: 3976)
      • vcredist.exe (PID: 3624)
      • GameDownload.exe (PID: 2476)
      • msiexec.exe (PID: 2532)
      • UI.exe (PID: 3232)
      • Tinst.exe (PID: 2700)
      • AOW_Rootfs.exe (PID: 3996)

    • Executed via COM

      • DllHost.exe (PID: 3760)
      • DllHost.exe (PID: 4036)
      • DllHost.exe (PID: 3180)

    • Creates files in the user directory

      • GLP_Installer_900207212_market.exe (PID: 2160)
      • AppMarket.exe (PID: 3744)
      • GameDownload.exe (PID: 2476)

    • Checks supported languages

      • GLP_Installer_900207212_market.exe (PID: 2160)
      • Market.exe (PID: 2420)
      • AppMarket.exe (PID: 3744)
      • GameDownload.exe (PID: 2476)
      • UI.exe (PID: 3232)

    • Reads the computer name

      • GLP_Installer_900207212_market.exe (PID: 2160)
      • Market.exe (PID: 2420)
      • Tinst.exe (PID: 3976)
      • QMEmulatorService.exe (PID: 3548)
      • AppMarket.exe (PID: 3744)
      • syzs_dl_svr.exe (PID: 2108)
      • GameDownload.exe (PID: 2476)
      • TBSWebRenderer.exe (PID: 3824)
      • UI.exe (PID: 3232)
      • Tinst.exe (PID: 2700)
      • AOW_Rootfs.exe (PID: 3996)
      • Tinst.exe (PID: 2588)

    • Reads the machine GUID from the registry

      • GLP_Installer_900207212_market.exe (PID: 2160)
      • Tinst.exe (PID: 3976)
      • syzs_dl_svr.exe (PID: 2108)
      • AppMarket.exe (PID: 3744)
      • TBSWebRenderer.exe (PID: 3824)
      • GameDownload.exe (PID: 2476)

    • Executed as Windows Service

      • QMEmulatorService.exe (PID: 3548)
      • msiexec.exe (PID: 2532)

    • Uses NETSH.EXE for network configuration

      • Tinst.exe (PID: 3976)
      • Tinst.exe (PID: 2700)

    • Creates files in the Windows directory

      • QMEmulatorService.exe (PID: 3548)
      • msiexec.exe (PID: 2532)

    • Reads Environment values

      • Netsh.exe (PID: 3980)
      • Netsh.exe (PID: 3168)
      • Netsh.exe (PID: 2896)
      • Netsh.exe (PID: 3992)
      • Netsh.exe (PID: 1460)
      • Netsh.exe (PID: 1240)
      • Netsh.exe (PID: 1724)
      • Netsh.exe (PID: 2208)
      • Netsh.exe (PID: 1080)
      • Netsh.exe (PID: 3000)
      • Netsh.exe (PID: 1576)

    • Creates files in the program directory

      • Tinst.exe (PID: 3976)
      • syzs_dl_svr.exe (PID: 2108)
      • AppMarket.exe (PID: 3744)
      • GLP_Installer_900207212_market.exe (PID: 2160)
      • QMEmulatorService.exe (PID: 3548)
      • msiexec.exe (PID: 2532)
      • AOW_Rootfs.exe (PID: 3996)
      • Tinst.exe (PID: 2700)

    • Modifies the open verb of a shell class

      • Tinst.exe (PID: 3976)

    • Creates a software uninstall entry

      • Tinst.exe (PID: 3976)
      • msiexec.exe (PID: 2532)

    • Reads CPU info

      • AppMarket.exe (PID: 3744)

    • Reads Internet Cache Settings

      • GameDownload.exe (PID: 2476)

    • Adds / modifies Windows certificates

      • AppMarket.exe (PID: 3744)
      • msiexec.exe (PID: 2532)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 2532)

    • Application launched itself

      • msiexec.exe (PID: 2532)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 2532)

    • Removes files from Windows directory

      • msiexec.exe (PID: 2532)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3256)
      • iexplore.exe (PID: 3620)
      • opera.exe (PID: 3392)
      • msiexec.exe (PID: 2532)

    • Reads the computer name

      • iexplore.exe (PID: 3256)
      • iexplore.exe (PID: 3620)
      • opera.exe (PID: 3392)
      • DllHost.exe (PID: 3760)
      • DllHost.exe (PID: 4036)
      • Netsh.exe (PID: 3980)
      • Netsh.exe (PID: 2896)
      • Netsh.exe (PID: 3168)
      • Netsh.exe (PID: 3992)
      • Netsh.exe (PID: 1240)
      • Netsh.exe (PID: 1460)
      • DllHost.exe (PID: 3180)
      • msiexec.exe (PID: 4028)
      • msiexec.exe (PID: 2532)
      • MsiExec.exe (PID: 1760)
      • Netsh.exe (PID: 1724)
      • Netsh.exe (PID: 2208)
      • Netsh.exe (PID: 1080)
      • Netsh.exe (PID: 3000)
      • Netsh.exe (PID: 1576)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3256)
      • iexplore.exe (PID: 3620)

    • Reads the machine GUID from the registry

      • iexplore.exe (PID: 3620)
      • iexplore.exe (PID: 3256)
      • opera.exe (PID: 3392)
      • DllHost.exe (PID: 3760)
      • DllHost.exe (PID: 4036)
      • Netsh.exe (PID: 3980)
      • Netsh.exe (PID: 2896)
      • Netsh.exe (PID: 3168)
      • Netsh.exe (PID: 3992)
      • Netsh.exe (PID: 1460)
      • Netsh.exe (PID: 1240)
      • DllHost.exe (PID: 3180)
      • msiexec.exe (PID: 2532)
      • msiexec.exe (PID: 4028)
      • MsiExec.exe (PID: 1760)
      • Netsh.exe (PID: 1724)
      • Netsh.exe (PID: 2208)
      • Netsh.exe (PID: 1080)
      • Netsh.exe (PID: 3000)
      • Netsh.exe (PID: 1576)

    • Changes internet zones settings

      • iexplore.exe (PID: 3256)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3620)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3256)
      • iexplore.exe (PID: 3620)
      • AppMarket.exe (PID: 3744)
      • TBSWebRenderer.exe (PID: 3824)
      • GameDownload.exe (PID: 2476)
      • msiexec.exe (PID: 2532)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3620)
      • iexplore.exe (PID: 3256)
      • GLP_Installer_900207212_market.exe (PID: 2160)
      • Tinst.exe (PID: 3976)
      • AppMarket.exe (PID: 3744)
      • TBSWebRenderer.exe (PID: 3824)
      • GameDownload.exe (PID: 2476)
      • msiexec.exe (PID: 2532)

    • Creates files in the user directory

      • iexplore.exe (PID: 3620)
      • iexplore.exe (PID: 3256)
      • opera.exe (PID: 3392)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3256)

    • Application launched itself

      • iexplore.exe (PID: 3256)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3256)
      • opera.exe (PID: 3392)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3256)

    • Manual execution by user

      • opera.exe (PID: 3392)

    • Dropped object may contain Bitcoin addresses

      • opera.exe (PID: 3392)
      • Tinst.exe (PID: 2700)
      • UI.exe (PID: 3232)

    • Check for Java to be installed

      • opera.exe (PID: 3392)

    • Reads the hosts file

      • AppMarket.exe (PID: 3744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
91
Monitored processes
34
Malicious processes
11
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start iexplore.exe iexplore.exe opera.exe glp_installer_900207212_market.exe no specs PSIProfileNotify no specs PSIProfileNotify no specs glp_installer_900207212_market.exe market.exe tinst.exe qmemulatorservice.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs appmarket.exe syzs_dl_svr.exe Thumbnail Cache Class Factory for Out of Proc Server no specs tbswebrenderer.exe gamedownload.exe ui.exe vcredist.exe msiexec.exe no specs msiexec.exe msiexec.exe no specs tinst.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs aow_rootfs.exe tinst.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1080"C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="TInst" dir=in program="c:\program files\txgameassistant\ui\TInst.exe" action=allowC:\Windows\system32\Netsh.exe—Tinst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\netsh.exe
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\credui.dll
1240"C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="TUpdate" dir=in program="c:\program files\txgameassistant\appmarket\GF186\TUpdate.exe" action=allowC:\Windows\system32\Netsh.exe—Tinst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernelbase.dll
c:\windows\system32\netsh.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\imm32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
1460"C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="GameDownload" dir=in program="c:\program files\txgameassistant\appmarket\GameDownload.exe" action=allowC:\Windows\system32\Netsh.exe—Tinst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\mprapi.dll
c:\windows\system32\rasmontr.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
1576"C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="TxGaDcc" dir=in program="c:\program files\txgameassistant\ui\TxGaDcc.exe" action=allowC:\Windows\system32\Netsh.exe—Tinst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\netsh.exe
c:\windows\system32\odbcint.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\odbc32.dll
c:\windows\system32\mfc42u.dll
c:\windows\system32\fwpuclnt.dll
1724"C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="AndroidEmulator" dir=in program="c:\program files\txgameassistant\ui\AndroidEmulator.exe" action=allowC:\Windows\system32\Netsh.exe—Tinst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\netsh.exe
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasmontr.dll
c:\windows\system32\mprapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msctf.dll
1760C:\Windows\system32\MsiExec.exe -Embedding A146C26EB791CE892212AD2499DE8520C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\advapi32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msiexec.exe
c:\windows\system32\msctf.dll
c:\windows\system32\imm32.dll
c:\windows\system32\wininet.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\iertutil.dll
2108"C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe" --conf-path="C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.cfg" --daemon --log="C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.log"C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe
AppMarket.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\program files\txgameassistant\appmarket\dl\syzs_dl_svr.exe
c:\windows\system32\ws2_32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
2160"C:\Users\admin\AppData\Local\Opera\Opera\temporary_downloads\GLP_Installer_900207212_market.exe" C:\Users\admin\AppData\Local\Opera\Opera\temporary_downloads\GLP_Installer_900207212_market.exe
opera.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\ws2_32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\opera\opera\temporary_downloads\glp_installer_900207212_market.exe
c:\windows\system32\oleaut32.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\srvcli.dll
2208"C:\Windows\system32\Netsh.exe" advfirewall firewall add rule name="adb" dir=in program="c:\program files\txgameassistant\ui\adb.exe" action=allowC:\Windows\system32\Netsh.exe—Tinst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\netsh.exe
c:\windows\system32\shlwapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\imm32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
2420"C:\Temp\TxGameDownload\Component\AppMarket\Market.exe" C:\Temp\TxGameDownload\Component\AppMarket\Market.exe
GLP_Installer_900207212_market.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\cryptbase.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\version.dll
c:\windows\system32\msctf.dll
c:\windows\system32\imm32.dll
c:\windows\system32\lpk.dll
Total events
56 567
Read events
55 196
Write events
1 351
Delete events
20

Modification events

(PID) Process:(3256) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30845484
(PID) Process:(3256) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3256) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
Operation:writeName:Blocked
Value:
6
(PID) Process:(3256) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
Operation:writeName:Time
Value:
E4070A0006001800110024003600B603
(PID) Process:(3256) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
Operation:writeName:Count
Value:
7
(PID) Process:(3256) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore
Operation:writeName:Type
Value:
3
(PID) Process:(3256) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore
Operation:writeName:Blocked
Value:
6
(PID) Process:(3256) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore
Operation:writeName:Time
Value:
E4070A0006001800110024003600B603
(PID) Process:(3256) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore
Operation:writeName:Count
Value:
7
(PID) Process:(3256) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore
Operation:writeName:Type
Value:
3
Executable files
504
Suspicious files
980
Text files
4 065
Unknown types
67

Dropped files

PID
Process
Filename
Type
3620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA0A17BC17FF10008872A7205D0D43E2_5FE90E28A5C4F66460B6A36ECFF82C5Eder
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\C0AP5ZGD.txttext
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_837A0010DA5A648BE322B702015A9E91binary
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9D161B3CD7C8B9D7B5C97E4395A9ABD5_BFEEA42363F84298DDFB76059F210CACder
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\js[1].jstext
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bbinary
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\409ff47dc05663225148bd50b38af370[1].pngimage
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA0A17BC17FF10008872A7205D0D43E2_5FE90E28A5C4F66460B6A36ECFF82C5Ebinary
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\earth[1].pngimage
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC197601BE0898B7B0FCC91FA15D8A69_837A0010DA5A648BE322B702015A9E91der
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
76
TCP/UDP connections
305
DNS requests
68
Threats
65

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3620
iexplore.exe
GET
—
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=ga&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
—
—
whitelisted
3620
iexplore.exe
GET
200
172.217.22.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDopzvCvNaHRggAAAAAXcGw
US
der
472 b
whitelisted
3620
iexplore.exe
GET
200
47.246.43.223:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHv1Dj%2BciPJEWH5JNtwL5Y07mRqwQUxBF%2BiECGwkG%2FZfMa4bRTQKOr7H0CEAwovOFHPTuPw4U8ln3fUks%3D
US
der
471 b
whitelisted
3620
iexplore.exe
GET
200
47.246.43.228:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHv1Dj%2BciPJEWH5JNtwL5Y07mRqwQUxBF%2BiECGwkG%2FZfMa4bRTQKOr7H0CEAvimEgQGTuGaJk2xbzB%2Bqg%3D
US
der
471 b
whitelisted
3620
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDFvr0VyEz0kMgWJYSA%3D%3D
US
der
1.54 Kb
whitelisted
3620
iexplore.exe
GET
200
172.217.22.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDopzvCvNaHRggAAAAAXcGw
US
der
472 b
whitelisted
3620
iexplore.exe
GET
200
47.246.43.228:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAh%2BGPuPqpJ%2B6HYKDYmC9RI%3D
US
der
471 b
whitelisted
3620
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDFvr0VyEz0kMgWJYSA%3D%3D
US
der
1.54 Kb
whitelisted
3620
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8EJH
US
der
1.49 Kb
whitelisted
3620
iexplore.exe
GET
200
47.246.43.223:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAh%2BGPuPqpJ%2B6HYKDYmC9RI%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3620
iexplore.exe
203.205.235.63:443
gameloop.fun
—
CN
suspicious
3620
iexplore.exe
47.246.43.223:80
ocsp.dcocsp.cn
—
US
malicious
3620
iexplore.exe
47.246.43.228:80
ocsp.dcocsp.cn
—
US
malicious
3620
iexplore.exe
216.58.205.232:443
www.googletagmanager.com
Google Inc.
US
whitelisted
3620
iexplore.exe
172.217.22.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3620
iexplore.exe
203.205.224.59:443
s.gameloop.fun
Tencent Building, Kejizhongyi Avenue
CN
suspicious
3620
iexplore.exe
203.205.235.61:443
aegis.qq.com
—
CN
unknown
3620
iexplore.exe
49.51.129.71:443
sy.gameloop.fun
Tencent Building, Kejizhongyi Avenue
CN
unknown
3620
iexplore.exe
203.205.235.38:443
report.syzs.qq.com
—
CN
unknown
3256
iexplore.exe
203.205.235.63:443
gameloop.fun
—
CN
suspicious

DNS requests

Domain
IP
Reputation
gameloop.fun
  • 203.205.235.63
suspicious
ocsp.dcocsp.cn
  • 47.246.43.223
  • 47.246.43.224
  • 47.246.43.225
  • 47.246.43.226
  • 47.246.43.227
  • 47.246.43.228
  • 47.246.43.229
  • 47.246.43.230
whitelisted
www.googletagmanager.com
  • 216.58.205.232
whitelisted
s.gameloop.fun
  • 203.205.224.59
  • 211.152.136.41
suspicious
aegis.qq.com
  • 203.205.235.61
suspicious
ocsp.pki.goog
  • 172.217.22.99
whitelisted
report.syzs.qq.com
  • 203.205.235.38
  • 203.205.235.63
whitelisted
sy.gameloop.fun
  • 49.51.129.71
  • 49.51.131.79
whitelisted
sy.guanjia.qq.com
  • 203.205.235.145
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted

Threats

PID
Process
Class
Message
2160
GLP_Installer_900207212_market.exe
Generic Protocol Command Decode
SURICATA TLS error message encountered
2160
GLP_Installer_900207212_market.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2160
GLP_Installer_900207212_market.exe
Generic Protocol Command Decode
SURICATA TLS error message encountered
2160
GLP_Installer_900207212_market.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2160
GLP_Installer_900207212_market.exe
Generic Protocol Command Decode
SURICATA TLS error message encountered
2160
GLP_Installer_900207212_market.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2160
GLP_Installer_900207212_market.exe
Generic Protocol Command Decode
SURICATA TLS error message encountered
2160
GLP_Installer_900207212_market.exe
Generic Protocol Command Decode
SURICATA TLS error message encountered
2160
GLP_Installer_900207212_market.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2160
GLP_Installer_900207212_market.exe
Generic Protocol Command Decode
SURICATA TLS error message encountered
5 ETPRO signatures available at the full report
Process
Message
AppMarket.exe
Standard VGA Graphics Adapter
AppMarket.exe
[1024/183852:INFO:exception_record.cc(518)] [QB]Process ID: 3744 Type: 1
AppMarket.exe
[Downloader] DriverType C: = 3
AppMarket.exe
[Downloader] GetLogicalDrives 4
TBSWebRenderer.exe
[1024/183853:INFO:exception_record.cc(518)] [QB]Process ID: 3824 Type: 2
GameDownload.exe
[Downloader] GetLogicalDrives 4
GameDownload.exe
[Downloader] DriverType C: = 3
GameDownload.exe
[Downloader] GetLogicalDrives 4
GameDownload.exe
[Downloader] DriverType C: = 3
GameDownload.exe
Standard VGA Graphics Adapter
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://gameloop.fun/