File name:

free-fire-gameloop.exe

Full analysis: https://app.any.run/tasks/ddae441c-5dda-4174-8d99-fbc2f8579121
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: July 28, 2025, 15:11:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
adware
tgbdownloader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

4DD66324D20BB685F7186F5759DB3996

SHA1:

9D9377F2A3817F7CFB2994585A26BC18785858D2

SHA256:

3A2846143D7BF192E0DC3BCDBE6245EBC71CBC8DE527F07B194E1E559C74FDAC

SSDEEP:

98304:ZHShnyAv85RgB6yU41Q6a7ofZoTS7acH/94WFQZAjBz8pjT8YKUV08ZlwFnCzUwG:X0h

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • TGBDOWNLOADER has been detected

      • free-fire-gameloop.exe (PID: 1644)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • free-fire-gameloop.exe (PID: 1644)
      • TInst.exe (PID: 1496)
      • Market.exe (PID: 1380)
      • UI.exe (PID: 1336)

    • Creates file in the systems drive root

      • free-fire-gameloop.exe (PID: 1644)
      • TInst.exe (PID: 1496)
      • QMEmulatorService.exe (PID: 1568)
      • AppMarket.exe (PID: 3584)

    • There is functionality for taking screenshot (YARA)

      • free-fire-gameloop.exe (PID: 1644)
      • Market.exe (PID: 1380)
      • QMEmulatorService.exe (PID: 1568)

    • Reads security settings of Internet Explorer

      • free-fire-gameloop.exe (PID: 1644)
      • TInst.exe (PID: 1496)
      • AppMarket.exe (PID: 3584)

    • Process drops legitimate windows executable

      • Market.exe (PID: 1380)
      • TInst.exe (PID: 1496)

    • The process creates files with name similar to system file names

      • TInst.exe (PID: 1496)
      • Market.exe (PID: 1380)

    • The process drops C-runtime libraries

      • TInst.exe (PID: 1496)
      • Market.exe (PID: 1380)

    • Executes as Windows Service

      • QMEmulatorService.exe (PID: 1568)

    • Detected use of alternative data streams (AltDS)

      • free-fire-gameloop.exe (PID: 1644)

    • Creates a software uninstall entry

      • TInst.exe (PID: 1496)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • TInst.exe (PID: 1496)

    • Uses WMIC.EXE to obtain computer system information

      • PcyybAssistant.exe (PID: 7020)

    • Uses SYSTEMINFO.EXE to read the environment

      • AppMarket.exe (PID: 3584)

    • Reads the date of Windows installation

      • AppMarket.exe (PID: 3584)

    • Reads the BIOS version

      • AppMarket.exe (PID: 3584)

  • INFO

    • The sample compiled with english language support

      • free-fire-gameloop.exe (PID: 1644)
      • TInst.exe (PID: 1496)
      • UI.exe (PID: 1336)
      • Market.exe (PID: 1380)

    • Create files in a temporary directory

      • free-fire-gameloop.exe (PID: 1644)
      • TInst.exe (PID: 1496)
      • AppMarket.exe (PID: 3584)

    • Checks supported languages

      • free-fire-gameloop.exe (PID: 1644)
      • Market.exe (PID: 1380)
      • TInst.exe (PID: 1496)
      • QMEmulatorService.exe (PID: 1568)
      • AppMarket.exe (PID: 3584)
      • PcyybAssistant.exe (PID: 7020)
      • wmpf_installer.exe (PID: 6892)
      • syzs_dl_svr.exe (PID: 6148)
      • cef_frame_render.exe (PID: 5884)
      • cef_frame_render.exe (PID: 6748)
      • cef_frame_render.exe (PID: 5284)
      • cef_frame_render.exe (PID: 5652)
      • UI.exe (PID: 1336)
      • cef_frame_render.exe (PID: 2388)

    • The sample compiled with chinese language support

      • free-fire-gameloop.exe (PID: 1644)
      • TInst.exe (PID: 1496)
      • UI.exe (PID: 1336)
      • Market.exe (PID: 1380)

    • Creates files or folders in the user directory

      • free-fire-gameloop.exe (PID: 1644)
      • TInst.exe (PID: 1496)
      • AppMarket.exe (PID: 3584)
      • PcyybAssistant.exe (PID: 7020)
      • wmpf_installer.exe (PID: 6892)
      • cef_frame_render.exe (PID: 6748)

    • Reads the computer name

      • free-fire-gameloop.exe (PID: 1644)
      • TInst.exe (PID: 1496)
      • AppMarket.exe (PID: 3584)
      • QMEmulatorService.exe (PID: 1568)
      • syzs_dl_svr.exe (PID: 6148)
      • Market.exe (PID: 1380)
      • cef_frame_render.exe (PID: 6748)
      • PcyybAssistant.exe (PID: 7020)
      • cef_frame_render.exe (PID: 5884)
      • UI.exe (PID: 1336)
      • cef_frame_render.exe (PID: 5652)

    • Reads the machine GUID from the registry

      • free-fire-gameloop.exe (PID: 1644)
      • AppMarket.exe (PID: 3584)
      • wmpf_installer.exe (PID: 6892)
      • cef_frame_render.exe (PID: 6748)
      • syzs_dl_svr.exe (PID: 6148)

    • Reads the software policy settings

      • free-fire-gameloop.exe (PID: 1644)
      • slui.exe (PID: 1068)
      • TInst.exe (PID: 1496)
      • cef_frame_render.exe (PID: 6748)
      • AppMarket.exe (PID: 3584)

    • Creates files in the program directory

      • free-fire-gameloop.exe (PID: 1644)
      • TInst.exe (PID: 1496)
      • QMEmulatorService.exe (PID: 1568)
      • AppMarket.exe (PID: 3584)
      • syzs_dl_svr.exe (PID: 6148)

    • Process checks computer location settings

      • free-fire-gameloop.exe (PID: 1644)
      • AppMarket.exe (PID: 3584)
      • cef_frame_render.exe (PID: 5284)
      • cef_frame_render.exe (PID: 2388)

    • Checks proxy server information

      • slui.exe (PID: 1068)
      • AppMarket.exe (PID: 3584)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 768)

    • Reads product name

      • AppMarket.exe (PID: 3584)

    • Reads Environment values

      • AppMarket.exe (PID: 3584)

    • Reads Windows Product ID

      • AppMarket.exe (PID: 3584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:09:27 04:52:07+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 2605568
InitializedDataSize: 1210368
UninitializedDataSize: -
EntryPoint: 0x22109e
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 1.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
FileDescription: Uptodown GameLoop Downloader
ProductName: Uptodown GameLoop Downloader
CompanyName: Tencent
FileVersion: 1, 0, 0, 1
InternalName: TGBDownloader.exe
LegalCopyright: Copyright ? 2020 Tencent. All Rights Reserved.
OriginalFileName: TGBDownloader.exe
ProductVersion: 1, 0, 0, 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
35
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start free-fire-gameloop.exe market.exe slui.exe tinst.exe qmemulatorservice.exe netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs appmarket.exe pcyybassistant.exe no specs wmpf_installer.exe no specs wmic.exe no specs conhost.exe no specs syzs_dl_svr.exe conhost.exe no specs cef_frame_render.exe no specs cef_frame_render.exe cef_frame_render.exe no specs cef_frame_render.exe no specs systeminfo.exe no specs conhost.exe no specs tiworker.exe no specs cef_frame_render.exe no specs ui.exe svchost.exe free-fire-gameloop.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
700\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—syzs_dl_svr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
768wmic path Win32_ComputerSystem get HypervisorPresentC:\Windows\SysWOW64\wbem\WMIC.exe—PcyybAssistant.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1036\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1068C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1236"C:\WINDOWS\system32\Netsh.exe" advfirewall firewall add rule name="AppMarket" dir=in program="c:\program files\txgameassistant\appmarket\AppMarket.exe" action=allowC:\Windows\SysWOW64\netsh.exe—TInst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1336"C:\Temp\TxGameDownload\Component\UI\caf421b6322a339165119069085b3879\UI.exe" 0C:\Temp\TxGameDownload\Component\UI\caf421b6322a339165119069085b3879\UI.exe
AppMarket.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\temp\txgamedownload\component\ui\caf421b6322a339165119069085b3879\ui.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3996_none_d954cb49e10154a6\gdiplus.dll
1380"C:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Market.exe" C:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Market.exe
free-fire-gameloop.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\temp\txgamedownload\component\appmarket\02e9cc9a4389b639aa8d98dac4dfb4ee\market.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3996_none_d954cb49e10154a6\gdiplus.dll
1496"C:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\Tinst.exe" C:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\TInst.exe
free-fire-gameloop.exe
User:
admin
Integrity Level:
HIGH
Description:
TMarketInst
Exit code:
0
Version:
3.71.3151.81
Modules
Images
c:\temp\txgamedownload\component\appmarket\02e9cc9a4389b639aa8d98dac4dfb4ee\setup\tinst.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
1568"C:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe"C:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe
services.exe
User:
SYSTEM
Company:
Tencent
Integrity Level:
SYSTEM
Description:
腾讯手游助手
Version:
3.71.3151.81
Modules
Images
c:\program files\txgameassistant\appmarket\qmemulatorservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
1612"C:\WINDOWS\system32\Netsh.exe" advfirewall firewall add rule name="TUpdate" dir=in program="c:\program files\txgameassistant\appmarket\GF186\TUpdate.exe" action=allowC:\Windows\SysWOW64\netsh.exe—TInst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
18 771
Read events
18 717
Write events
51
Delete events
3

Modification events

(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tencent\MobileGamePC\Beacon
Operation:writeName:Last_Sid_free-fire-gameloop.exe
Value:
0B9D6367-D289-4762-A762-198D16B4DD07
(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tencent\MobileGamePC
Operation:writeName:TempPath
Value:
C:\Temp\TxGameDownload\Component\
(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tencent\MobileGamePC
Operation:writeName:UserLanguage
Value:
en
(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tencent\MobileGamePC
Operation:writeName:abtestid
Value:
{"Component":"0"}
(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tencent\MobileGamePC\GameDownload
Operation:writeName:DownloadSpeed
Value:
0
(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Tencent\MobileGamePC
Operation:writeName:SupplyId
Value:
(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tencent\MobileGamePC
Operation:writeName:Region
Value:
DE
(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Tencent\MobileGamePC\AppMarket
Operation:writeName:InstallPath
Value:
C:\Program Files\TxGameAssistant\AppMarket
(PID) Process:(1496) TInst.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tencent\MobileGamePC
Operation:writeName:sf
Value:
C:\Temp\TxGameDownload\MobileGamePCShared
(PID) Process:(1496) TInst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:AppMarket
Value:
Executable files
444
Suspicious files
411
Text files
2 185
Unknown types
114

Dropped files

PID
Process
Filename
Type
1644free-fire-gameloop.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Market.exe —
MD5:—
SHA256:—
1380Market.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:9F3CF9F22836C32D988D7C7E0A977E1B
SHA256:7D588A5A958E32875D7BD346D1371E6EBFD9D5D2EDE47755942BADFC9C74E207
1380Market.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:11E55839FCB3A53BDFED2A27FB7D5E80
SHA256:F6BDC8FFD172B44F4D169707D9A457AEEF619872661229B8629EE4F15EEFFF0D
1380Market.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\AndrowsInstaller.exeexecutable
MD5:0238214FF5F8A40A66D535E1795FED50
SHA256:8E91EBE57AD70A58866ABDBAA5A406A3B036E519E9C4463E5ABEBE3986001792
1380Market.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\api-ms-win-core-file-l1-1-0.dllexecutable
MD5:D826D27C73D9F2420FB39FBE0745C7F0
SHA256:C0E5D482BD93BF71A73C01D0C1EC0722EA3260EBA1F4C87E797BAE334B5E9870
1380Market.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:64978E199A7239D2C911876447A7F05B
SHA256:92B947F1D6236F86ED7E105CFF19E23C13D1968861426511B775905E1D26B47A
1380Market.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\api-ms-win-core-file-l2-1-0.dllexecutable
MD5:B9287EB7BCBFDCEC2E8D4198FD266509
SHA256:096409422ECD1894E4D6289FD2D1C7490BD83DAFF0C1E3D16C36C78BD477B895
1380Market.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\api-ms-win-core-file-l1-2-1.dllexecutable
MD5:A32230B9BFDB8813E94D095222AAFA11
SHA256:7068D2B8AEA252294E6B5C3BF3630475D0A91E11877F11A04E8ED1F91196410F
1380Market.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\api-ms-win-core-errorhandling-l1-1-0.dllexecutable
MD5:9D74D89F2679C0C5DDB35A1EF30BD182
SHA256:E207FFC6FEF144E5D393E79DE75F8F20D223F1AC33A011EEB822D30FA2031046
1380Market.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\aowgameex2.datbinary
MD5:C99BCCA61C47433E0DF19B4A7668EB56
SHA256:010C86CAC8101A693C2F35F798C40162FDC510CF809FA2604D42EF2B929A0062
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
153
DNS requests
46
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5644
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
764
lsass.exe
GET
200
163.181.254.188:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEATBuWAZH8q%2B3NqTAabNeMM%3D
unknown
—
—
whitelisted
2220
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2220
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
3732
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
3584
AppMarket.exe
POST
200
43.154.254.18:80
http://masterconn.qq.com/q.cgi
unknown
—
—
whitelisted
764
lsass.exe
GET
200
163.181.254.188:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRdfbJlK8FvT8EKTy%2FQWk9HlJQmegQUKyMWgRtHiYqQeuzoMtRsjnL5ziUCEA6xppOq9GVD9UJAOok2b2g%3D
unknown
—
—
whitelisted
3584
AppMarket.exe
GET
200
163.181.254.188:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEA%2FgMquETQMxBsUMjhPIsGg%3D
unknown
—
—
whitelisted
3584
AppMarket.exe
GET
200
163.181.254.188:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRdfbJlK8FvT8EKTy%2FQWk9HlJQmegQUKyMWgRtHiYqQeuzoMtRsjnL5ziUCEAtfHw4uO3jgnc1uenuzUtk%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5944
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
7076
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1644
free-fire-gameloop.exe
157.255.4.39:443
master.etl.desktop.qq.com
China Unicom Guangdong IP network
CN
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1644
free-fire-gameloop.exe
101.33.47.206:8081
oth.eve.mdt.qq.com
Tencent Building, Kejizhongyi Avenue
SG
whitelisted
5644
svchost.exe
40.126.31.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5644
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1644
free-fire-gameloop.exe
49.51.129.71:443
unifiedaccess.gameloop.com
Tencent Building, Kejizhongyi Avenue
DE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.206
whitelisted
master.etl.desktop.qq.com
  • 157.255.4.39
whitelisted
oth.eve.mdt.qq.com
  • 101.33.47.206
  • 43.173.131.185
  • 101.33.47.68
whitelisted
login.live.com
  • 40.126.31.129
  • 20.190.159.4
  • 40.126.31.71
  • 20.190.159.0
  • 20.190.159.129
  • 40.126.31.1
  • 40.126.31.69
  • 40.126.31.67
  • 40.126.31.73
  • 20.190.159.71
  • 40.126.31.3
  • 40.126.31.0
  • 20.190.159.131
  • 20.190.159.128
  • 40.126.31.2
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
unifiedaccess.gameloop.com
  • 49.51.129.71
  • 49.51.131.79
unknown
down.gameloop.com
  • 43.152.29.148
  • 43.152.26.239
  • 43.152.26.197
  • 43.152.26.142
  • 43.174.109.182
  • 43.152.28.43
  • 43.152.26.209
  • 43.152.28.41
  • 43.152.26.151
  • 43.152.26.238
  • 43.152.26.110
  • 43.152.28.77
  • 43.152.26.154
  • 43.152.29.72
  • 43.152.27.98
malicious
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.30
  • 23.216.77.37
  • 23.216.77.42
  • 23.216.77.38
  • 23.216.77.36
  • 23.216.77.41
  • 23.216.77.35
  • 23.216.77.25
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
—
—
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
—
—
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
—
—
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
—
—
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
Process
Message
AppMarket.exe
[Downloader] GetLogicalDrives 4
AppMarket.exe
[Downloader] DriverType C: = 3
AppMarket.exe
[Downloader] GetLogicalDrives 4
AppMarket.exe
[Downloader] DriverType C: = 3
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
free-fire-gameloop.exe