| File name: | pirate-bay.exe |
| Full analysis: | https://app.any.run/tasks/6cba560d-1b0b-4fc5-947e-e2e4657d2df1 |
| Verdict: | Malicious activity |
| Analysis date: | March 10, 2024, 12:41:47 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 616967C76C84DAC06B96CF7B7A5BFEDE |
| SHA1: | 372836E13698261F9BA1FBC59F10647F73576A9C |
| SHA256: | 0833E608B614276CF11316B93D31ED1E1AC0A35562046CAE306227F5F92A71BB |
| SSDEEP: | 196608:rSNO+RxF4fh/t6aVi0S8rQk1HaiwfDM4V:2cq4fh/t6Oovk1Hae4V |
| .exe | | | Win32 Executable PowerBASIC/Win 9.x (51.2) |
|---|---|---|
| .exe | | | Inno Setup installer (37.9) |
| .exe | | | Win32 Executable Delphi generic (4.9) |
| .dll | | | Win32 Dynamic Link Library (generic) (2.2) |
| .exe | | | Win32 Executable (generic) (1.5) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 1992:06:19 22:22:17+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 37376 |
| InitializedDataSize: | 16896 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x991c |
| OSVersion: | 1 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.0.0.0 |
| ProductVersionNumber: | 0.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Windows, Latin1 |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | |
| FileDescription: | |
| FileVersion: | |
| LegalCopyright: | Copyright © 2007 MyRealGames.com, Kristanix. |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 296 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1600 --field-trial-handle=1292,i,14310892343318069410,17500812965859878548,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 584 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4368 --field-trial-handle=1292,i,14310892343318069410,17500812965859878548,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 668 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4944 --field-trial-handle=1292,i,14310892343318069410,17500812965859878548,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 924 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2300 --field-trial-handle=1292,i,14310892343318069410,17500812965859878548,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1040 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6a61f598,0x6a61f5a8,0x6a61f5b4 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1216 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3544 --field-trial-handle=1292,i,14310892343318069410,17500812965859878548,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1352 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1464 --field-trial-handle=1292,i,14310892343318069410,17500812965859878548,131072 /prefetch:3 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1380 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4204 --field-trial-handle=1292,i,14310892343318069410,17500812965859878548,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1604 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4484 --field-trial-handle=1292,i,14310892343318069410,17500812965859878548,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1824 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate http://www.myrealgames.com/?game_title=PirateBay | C:\Program Files\Microsoft\Edge\Application\msedge.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| (PID) Process: | (2852) is-GL347.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Pirate Bay_is1 |
| Operation: | write | Name: | Inno Setup: Setup Version |
Value: 5.1.11 | |||
| (PID) Process: | (2852) is-GL347.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Pirate Bay_is1 |
| Operation: | write | Name: | Inno Setup: App Path |
Value: C:\Program Files\MyRealGames.com\Pirate Bay | |||
| (PID) Process: | (2852) is-GL347.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Pirate Bay_is1 |
| Operation: | write | Name: | InstallLocation |
Value: C:\Program Files\MyRealGames.com\Pirate Bay\ | |||
| (PID) Process: | (2852) is-GL347.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Pirate Bay_is1 |
| Operation: | write | Name: | Inno Setup: Icon Group |
Value: Pirate Bay | |||
| (PID) Process: | (2852) is-GL347.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Pirate Bay_is1 |
| Operation: | write | Name: | Inno Setup: User |
Value: admin | |||
| (PID) Process: | (2852) is-GL347.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Pirate Bay_is1 |
| Operation: | write | Name: | DisplayName |
Value: Pirate Bay | |||
| (PID) Process: | (2852) is-GL347.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Pirate Bay_is1 |
| Operation: | write | Name: | UninstallString |
Value: "C:\Program Files\MyRealGames.com\Pirate Bay\unins000.exe" | |||
| (PID) Process: | (2852) is-GL347.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Pirate Bay_is1 |
| Operation: | write | Name: | QuietUninstallString |
Value: "C:\Program Files\MyRealGames.com\Pirate Bay\unins000.exe" /SILENT | |||
| (PID) Process: | (2852) is-GL347.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Pirate Bay_is1 |
| Operation: | write | Name: | NoModify |
Value: 1 | |||
| (PID) Process: | (2852) is-GL347.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Pirate Bay_is1 |
| Operation: | write | Name: | NoRepair |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2852 | is-GL347.tmp | C:\Program Files\MyRealGames.com\Pirate Bay\unins000.exe | executable | |
MD5:31FB0654B125823DB04444247199AAC3 | SHA256:9D3DF0476D6CCCA810A53597F139D50DBED79BF6950185A5F90A9576F394A2EF | |||
| 2852 | is-GL347.tmp | C:\Users\admin\AppData\Local\Temp\is-6MHU2.tmp\_isetup\_shfoldr.dll | executable | |
MD5:92DC6EF532FBB4A5C3201469A5B5EB63 | SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 | |||
| 3660 | pirate-bay.exe | C:\Users\admin\AppData\Local\Temp\is-NC1I7.tmp\is-GL347.tmp | executable | |
MD5:3DAFB498BB15D5260CB2C12B391A0D48 | SHA256:C5D5F5F814C5BC4989D691442051E5E78CF1971EB9B773A7A26B438E58A73D7A | |||
| 2852 | is-GL347.tmp | C:\Program Files\MyRealGames.com\Pirate Bay\icon.bmp | image | |
MD5:325635ACD62BF11343364AC6EA71DE8B | SHA256:4C3A802280DD7C13B1686C3413E8736F30FA256777C0927AD5B2C7A96FCEA704 | |||
| 2852 | is-GL347.tmp | C:\Program Files\MyRealGames.com\Pirate Bay\is-N3NV5.tmp | executable | |
MD5:0BE4A226874ECCB9F8BFE3D8DCED0C09 | SHA256:D98CD5D6ED9C4A95701684AA83777CEFD5D8096E14C836493F67159D68161C01 | |||
| 2852 | is-GL347.tmp | C:\Program Files\MyRealGames.com\Pirate Bay\is-21UQ6.tmp | executable | |
MD5:31FB0654B125823DB04444247199AAC3 | SHA256:9D3DF0476D6CCCA810A53597F139D50DBED79BF6950185A5F90A9576F394A2EF | |||
| 2852 | is-GL347.tmp | C:\Program Files\MyRealGames.com\Pirate Bay\is-3MBPP.tmp | executable | |
MD5:CAE6861B19A2A7E5D42FEFC4DFDF5CCF | SHA256:C4C8C2D251B90D77D1AC75CBD39C3F0B18FC170D5A95D1C13A0266F7260B479D | |||
| 2852 | is-GL347.tmp | C:\Program Files\MyRealGames.com\Pirate Bay\license.txt | text | |
MD5:828185886BC784948207FE5D527F8D44 | SHA256:9D928BEF82DF3982817F7D23719CD99C10472E5DD25C5F2ED27A6276A8CC8896 | |||
| 2852 | is-GL347.tmp | C:\Program Files\MyRealGames.com\Pirate Bay\is-51P41.tmp | text | |
MD5:828185886BC784948207FE5D527F8D44 | SHA256:9D928BEF82DF3982817F7D23719CD99C10472E5DD25C5F2ED27A6276A8CC8896 | |||
| 2852 | is-GL347.tmp | C:\Program Files\MyRealGames.com\Pirate Bay\msvcm80.dll | executable | |
MD5:CAE6861B19A2A7E5D42FEFC4DFDF5CCF | SHA256:C4C8C2D251B90D77D1AC75CBD39C3F0B18FC170D5A95D1C13A0266F7260B479D | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1352 | msedge.exe | GET | 200 | 104.18.38.233:80 | http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt | unknown | binary | 1.52 Kb | unknown |
1352 | msedge.exe | GET | 301 | 66.242.8.2:80 | http://www.myrealgames.com/?game_title=PirateBay | unknown | html | 194 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
1352 | msedge.exe | 13.107.21.239:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
1824 | msedge.exe | 239.255.255.250:1900 | — | — | — | unknown |
1352 | msedge.exe | 66.242.8.2:80 | www.myrealgames.com | SERVERS-COM | US | unknown |
1352 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1352 | msedge.exe | 66.242.8.2:443 | www.myrealgames.com | SERVERS-COM | US | unknown |
1352 | msedge.exe | 104.18.38.233:80 | crt.sectigo.com | CLOUDFLARENET | — | shared |
Domain | IP | Reputation |
|---|---|---|
config.edge.skype.com |
| whitelisted |
www.myrealgames.com |
| unknown |
edge.microsoft.com |
| whitelisted |
crt.sectigo.com |
| whitelisted |
cdn.myrealgames.com |
| unknown |
tags.expo9.exponential.com |
| whitelisted |
cdnjs.cloudflare.com |
| whitelisted |
static.getclicky.com |
| whitelisted |
www.google.com |
| whitelisted |
s.tribalfusion.com |
| shared |