URL:

https://freegogpcgames.com/22814/spaceengine/

Full analysis: https://app.any.run/tasks/b6c8bd92-6d50-4942-9453-a119aafd2748
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: August 18, 2024, 18:01:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
Indicators:
MD5:

2CC93ABAA5824C8F750B5CB04AD24009

SHA1:

058F583206945722B662A652D718E8603D889647

SHA256:

0C74AE57BEA21FDD69A0C4686848FCE754B12C8EE4F15D9E794437C2558909B2

SSDEEP:

3:N82K90wK2ANMLv:22K9O2ANu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7296)
      • powershell.exe (PID: 6528)

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 3696)
      • msiexec.exe (PID: 6544)

    • Actions looks like stealing of personal data

      • powershell.exe (PID: 6528)
      • powershell.exe (PID: 7296)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • cookie_exporter.exe (PID: 6356)
      • msiexec.exe (PID: 8120)
      • viewer.exe (PID: 320)
      • msiexec.exe (PID: 2468)
      • msiexec.exe (PID: 5196)
      • viewer.exe (PID: 5760)
      • msiexec.exe (PID: 3184)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 8120)
      • viewer.exe (PID: 320)
      • msiexec.exe (PID: 2468)
      • msiexec.exe (PID: 8140)
      • msiexec.exe (PID: 5196)
      • viewer.exe (PID: 5760)
      • msiexec.exe (PID: 3184)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 8120)
      • msiexec.exe (PID: 8140)
      • msiexec.exe (PID: 5196)

    • Adds/modifies Windows certificates

      • viewer.exe (PID: 320)

    • Reads the date of Windows installation

      • viewer.exe (PID: 320)
      • msiexec.exe (PID: 8120)
      • msiexec.exe (PID: 5196)
      • viewer.exe (PID: 5760)

    • Executes as Windows Service

      • VSSVC.exe (PID: 8112)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 8140)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 3696)
      • msiexec.exe (PID: 6544)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 3696)
      • msiexec.exe (PID: 6544)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 3696)
      • msiexec.exe (PID: 6544)

    • Detected use of alternative data streams (AltDS)

      • powershell.exe (PID: 7296)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 3696)
      • msiexec.exe (PID: 6544)

  • INFO

    • Reads the computer name

      • identity_helper.exe (PID: 5980)
      • cookie_exporter.exe (PID: 6356)
      • msiexec.exe (PID: 8120)
      • msiexec.exe (PID: 8140)
      • viewer.exe (PID: 320)
      • msiexec.exe (PID: 2468)
      • msiexec.exe (PID: 3696)
      • msiexec.exe (PID: 7336)
      • msiexec.exe (PID: 5196)
      • viewer.exe (PID: 5760)
      • msiexec.exe (PID: 3184)
      • msiexec.exe (PID: 6544)
      • msiexec.exe (PID: 6800)

    • Checks supported languages

      • cookie_exporter.exe (PID: 6356)
      • identity_helper.exe (PID: 5980)
      • msiexec.exe (PID: 8120)
      • msiexec.exe (PID: 8140)
      • viewer.exe (PID: 320)
      • msiexec.exe (PID: 3696)
      • msiexec.exe (PID: 7336)
      • msiexec.exe (PID: 5196)
      • viewer.exe (PID: 5760)
      • msiexec.exe (PID: 2468)
      • msiexec.exe (PID: 3184)
      • msiexec.exe (PID: 6544)
      • msiexec.exe (PID: 6800)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 6548)
      • powershell.exe (PID: 7296)
      • powershell.exe (PID: 6528)

    • The process uses the downloaded file

      • msedge.exe (PID: 7756)
      • msedge.exe (PID: 6548)
      • msedge.exe (PID: 4128)

    • Reads Environment values

      • cookie_exporter.exe (PID: 6356)
      • identity_helper.exe (PID: 5980)
      • msiexec.exe (PID: 8120)
      • msiexec.exe (PID: 2468)
      • msiexec.exe (PID: 3696)
      • msiexec.exe (PID: 5196)
      • msiexec.exe (PID: 3184)
      • msiexec.exe (PID: 6544)

    • Reads the software policy settings

      • msiexec.exe (PID: 3980)
      • msiexec.exe (PID: 8120)
      • viewer.exe (PID: 320)
      • msiexec.exe (PID: 6160)
      • msiexec.exe (PID: 8140)
      • msiexec.exe (PID: 2468)
      • powershell.exe (PID: 7296)
      • msiexec.exe (PID: 7792)
      • msiexec.exe (PID: 5196)
      • viewer.exe (PID: 5760)
      • msiexec.exe (PID: 7444)
      • msiexec.exe (PID: 3184)
      • powershell.exe (PID: 6528)

    • Checks proxy server information

      • cookie_exporter.exe (PID: 6356)
      • powershell.exe (PID: 7296)
      • powershell.exe (PID: 6528)

    • Application launched itself

      • msedge.exe (PID: 6548)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 3980)
      • msiexec.exe (PID: 6160)
      • powershell.exe (PID: 7296)
      • msiexec.exe (PID: 7792)
      • msiexec.exe (PID: 7444)
      • powershell.exe (PID: 6528)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3980)
      • msiexec.exe (PID: 8120)
      • msiexec.exe (PID: 6160)
      • msiexec.exe (PID: 8140)
      • msiexec.exe (PID: 7792)
      • msiexec.exe (PID: 5196)
      • msiexec.exe (PID: 7444)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 8120)
      • msiexec.exe (PID: 2468)
      • msiexec.exe (PID: 8140)
      • viewer.exe (PID: 320)
      • msiexec.exe (PID: 5196)
      • viewer.exe (PID: 5760)
      • msiexec.exe (PID: 3184)

    • Create files in a temporary directory

      • msiexec.exe (PID: 8120)
      • msiexec.exe (PID: 3696)
      • powershell.exe (PID: 7296)
      • msiexec.exe (PID: 5196)
      • powershell.exe (PID: 6528)
      • msiexec.exe (PID: 6544)

    • Process checks computer location settings

      • viewer.exe (PID: 320)
      • msiexec.exe (PID: 8120)
      • msiexec.exe (PID: 5196)
      • viewer.exe (PID: 5760)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 7296)
      • powershell.exe (PID: 6528)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 7296)
      • powershell.exe (PID: 6528)

    • Disables trace logs

      • powershell.exe (PID: 7296)
      • powershell.exe (PID: 6528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
245
Monitored processes
109
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start iexplore.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cookie_exporter.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe msedge.exe no specs msiexec.exe msiexec.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs viewer.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs powershell.exe conhost.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe msiexec.exe viewer.exe msiexec.exe msiexec.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs powershell.exe conhost.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
232"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=6732 --field-trial-handle=2496,i,14255185232850727260,4546532106812022916,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
320"C:\Users\admin\AppData\Local\Temp\viewer.exe" /RunAsAdmin "C:\WINDOWS\System32\msiexec.exe" /i "C:\Users\admin\Downloads\Setup.msi"C:\Users\admin\AppData\Local\Temp\viewer.exe
msiexec.exe
User:
admin
Company:
Caphyon LTD
Integrity Level:
HIGH
Description:
File that launches another file
Exit code:
0
Version:
21.8.2.0
Modules
Images
c:\users\admin\appdata\local\temp\viewer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\crypt32.dll
752"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5360 --field-trial-handle=2496,i,14255185232850727260,4546532106812022916,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1248"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8384 --field-trial-handle=2496,i,14255185232850727260,4546532106812022916,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1636"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3472 --field-trial-handle=2496,i,14255185232850727260,4546532106812022916,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1688"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://start.artificusbrowser.com/notification/?verify=110mrdd1724004251C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2128"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=5768 --field-trial-handle=2496,i,14255185232850727260,4546532106812022916,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5648 --field-trial-handle=2496,i,14255185232850727260,4546532106812022916,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6320 --field-trial-handle=2496,i,14255185232850727260,4546532106812022916,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2152"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=7216 --field-trial-handle=2496,i,14255185232850727260,4546532106812022916,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
90 271
Read events
89 517
Write events
705
Delete events
49

Modification events

(PID) Process:(6368) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:L1WatermarkLowPart
Value:
0
(PID) Process:(6368) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:L1WatermarkHighPart
Value:
0
(PID) Process:(6368) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
0
(PID) Process:(6368) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
0
(PID) Process:(6368) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(6368) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31125912
(PID) Process:(6368) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6368) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6368) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6368) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
Executable files
52
Suspicious files
429
Text files
200
Unknown types
2

Dropped files

PID
Process
Filename
Type
6548msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFe5242.TMP —
MD5:—
SHA256:—
6548msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6548msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RFe5242.TMP —
MD5:—
SHA256:—
6548msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6548msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RFe5242.TMP —
MD5:—
SHA256:—
6548msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6548msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RFe5232.TMP —
MD5:—
SHA256:—
6548msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6548msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFe5242.TMP —
MD5:—
SHA256:—
6548msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
251
DNS requests
319
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5140
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
6296
svchost.exe
GET
206
217.20.58.101:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724111528&P2=404&P3=2&P4=YZ9RBIiFTKe%2fS6YVLQfk%2fQHmEQBPbizpwH7v2B6zDjQBtEPZyFuhWD2nH5t20i9d4nbVrg3d6o0G%2biMfOqtdGw%3d%3d
US
binary
7.49 Kb
whitelisted
752
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
407 b
whitelisted
6296
svchost.exe
GET
206
217.20.58.101:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724111528&P2=404&P3=2&P4=YZ9RBIiFTKe%2fS6YVLQfk%2fQHmEQBPbizpwH7v2B6zDjQBtEPZyFuhWD2nH5t20i9d4nbVrg3d6o0G%2biMfOqtdGw%3d%3d
US
binary
1.09 Kb
whitelisted
6792
msedge.exe
GET
200
185.33.87.66:80
http://c.adseras.com/cf?id=18234433571866965016&sid=jJwSjyxSBdy&subid=78448&fid=23952
US
html
4.89 Kb
unknown
6792
msedge.exe
GET
200
172.64.149.23:80
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
US
binary
1.52 Kb
whitelisted
2132
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
6296
svchost.exe
GET
206
217.20.58.101:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0d54af34-938f-4611-a991-322d59c82cba?P1=1724573462&P2=404&P3=2&P4=TS1cAwoMBJliZdbPv6CRL3tomyvNHqrsKrJpeWBHY6rxrhHIgKesa7hcEct%2fdXep0TD%2fUOBpRcIlRT4DomN0iQ%3d%3d
US
binary
34.6 Kb
whitelisted
6296
svchost.exe
GET
206
217.20.58.101:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724111528&P2=404&P3=2&P4=YZ9RBIiFTKe%2fS6YVLQfk%2fQHmEQBPbizpwH7v2B6zDjQBtEPZyFuhWD2nH5t20i9d4nbVrg3d6o0G%2biMfOqtdGw%3d%3d
US
binary
2.03 Kb
whitelisted
6296
svchost.exe
GET
200
217.20.58.101:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/062b65bc-b6a4-4f5a-8413-7218292237fe?P1=1724202082&P2=404&P3=2&P4=L8ayEJFYVGrKSmSovjYmRurQ5oaFiuy6R%2f7dJqLpCK9SldUN42ldoqXaK4xRPxt7vsObxe02PKpcDJHxDHewPQ%3d%3d
US
binary
72.1 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1128
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5600
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6548
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
6792
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6792
msedge.exe
188.114.96.3:443
freegogpcgames.com
—
—
unknown
6792
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6792
msedge.exe
13.107.246.60:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.142
whitelisted
freegogpcgames.com
  • 188.114.96.3
  • 188.114.97.3
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.60
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 188.114.96.3
  • 188.114.97.3
  • 23.216.77.152
  • 23.216.77.175
  • 2.19.126.152
  • 2.19.126.145
whitelisted
i0.wp.com
  • 192.0.77.2
whitelisted
stats.wp.com
  • 192.0.76.3
whitelisted
v0.wordpress.com
  • 192.0.78.13
  • 192.0.78.12
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://freegogpcgames.com/22814/spaceengine/