File name:

free-fire-gameloop.exe

Full analysis: https://app.any.run/tasks/ddae441c-5dda-4174-8d99-fbc2f8579121
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: July 28, 2025, 15:11:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
adware
tgbdownloader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

4DD66324D20BB685F7186F5759DB3996

SHA1:

9D9377F2A3817F7CFB2994585A26BC18785858D2

SHA256:

3A2846143D7BF192E0DC3BCDBE6245EBC71CBC8DE527F07B194E1E559C74FDAC

SSDEEP:

98304:ZHShnyAv85RgB6yU41Q6a7ofZoTS7acH/94WFQZAjBz8pjT8YKUV08ZlwFnCzUwG:X0h

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • TGBDOWNLOADER has been detected

      • free-fire-gameloop.exe (PID: 1644)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • free-fire-gameloop.exe (PID: 1644)
      • TInst.exe (PID: 1496)
      • QMEmulatorService.exe (PID: 1568)
      • AppMarket.exe (PID: 3584)

    • Executable content was dropped or overwritten

      • free-fire-gameloop.exe (PID: 1644)
      • Market.exe (PID: 1380)
      • TInst.exe (PID: 1496)
      • UI.exe (PID: 1336)

    • There is functionality for taking screenshot (YARA)

      • free-fire-gameloop.exe (PID: 1644)
      • Market.exe (PID: 1380)
      • QMEmulatorService.exe (PID: 1568)

    • Reads security settings of Internet Explorer

      • free-fire-gameloop.exe (PID: 1644)
      • AppMarket.exe (PID: 3584)
      • TInst.exe (PID: 1496)

    • The process drops C-runtime libraries

      • Market.exe (PID: 1380)
      • TInst.exe (PID: 1496)

    • The process creates files with name similar to system file names

      • Market.exe (PID: 1380)
      • TInst.exe (PID: 1496)

    • Process drops legitimate windows executable

      • TInst.exe (PID: 1496)
      • Market.exe (PID: 1380)

    • Creates a software uninstall entry

      • TInst.exe (PID: 1496)

    • Detected use of alternative data streams (AltDS)

      • free-fire-gameloop.exe (PID: 1644)

    • Executes as Windows Service

      • QMEmulatorService.exe (PID: 1568)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • TInst.exe (PID: 1496)

    • Uses WMIC.EXE to obtain computer system information

      • PcyybAssistant.exe (PID: 7020)

    • Uses SYSTEMINFO.EXE to read the environment

      • AppMarket.exe (PID: 3584)

    • Reads the date of Windows installation

      • AppMarket.exe (PID: 3584)

    • Reads the BIOS version

      • AppMarket.exe (PID: 3584)

  • INFO

    • The sample compiled with english language support

      • free-fire-gameloop.exe (PID: 1644)
      • Market.exe (PID: 1380)
      • TInst.exe (PID: 1496)
      • UI.exe (PID: 1336)

    • Creates files or folders in the user directory

      • free-fire-gameloop.exe (PID: 1644)
      • TInst.exe (PID: 1496)
      • AppMarket.exe (PID: 3584)
      • wmpf_installer.exe (PID: 6892)
      • PcyybAssistant.exe (PID: 7020)
      • cef_frame_render.exe (PID: 6748)

    • The sample compiled with chinese language support

      • free-fire-gameloop.exe (PID: 1644)
      • Market.exe (PID: 1380)
      • TInst.exe (PID: 1496)
      • UI.exe (PID: 1336)

    • Checks supported languages

      • free-fire-gameloop.exe (PID: 1644)
      • Market.exe (PID: 1380)
      • TInst.exe (PID: 1496)
      • QMEmulatorService.exe (PID: 1568)
      • PcyybAssistant.exe (PID: 7020)
      • AppMarket.exe (PID: 3584)
      • wmpf_installer.exe (PID: 6892)
      • syzs_dl_svr.exe (PID: 6148)
      • cef_frame_render.exe (PID: 5884)
      • cef_frame_render.exe (PID: 2388)
      • cef_frame_render.exe (PID: 6748)
      • cef_frame_render.exe (PID: 5652)
      • cef_frame_render.exe (PID: 5284)
      • UI.exe (PID: 1336)

    • Create files in a temporary directory

      • free-fire-gameloop.exe (PID: 1644)
      • TInst.exe (PID: 1496)
      • AppMarket.exe (PID: 3584)

    • Reads the computer name

      • free-fire-gameloop.exe (PID: 1644)
      • Market.exe (PID: 1380)
      • TInst.exe (PID: 1496)
      • QMEmulatorService.exe (PID: 1568)
      • AppMarket.exe (PID: 3584)
      • PcyybAssistant.exe (PID: 7020)
      • syzs_dl_svr.exe (PID: 6148)
      • cef_frame_render.exe (PID: 5884)
      • cef_frame_render.exe (PID: 6748)
      • cef_frame_render.exe (PID: 5652)
      • UI.exe (PID: 1336)

    • Reads the machine GUID from the registry

      • free-fire-gameloop.exe (PID: 1644)
      • AppMarket.exe (PID: 3584)
      • wmpf_installer.exe (PID: 6892)
      • syzs_dl_svr.exe (PID: 6148)
      • cef_frame_render.exe (PID: 6748)

    • Creates files in the program directory

      • free-fire-gameloop.exe (PID: 1644)
      • TInst.exe (PID: 1496)
      • QMEmulatorService.exe (PID: 1568)
      • AppMarket.exe (PID: 3584)
      • syzs_dl_svr.exe (PID: 6148)

    • Reads the software policy settings

      • free-fire-gameloop.exe (PID: 1644)
      • slui.exe (PID: 1068)
      • TInst.exe (PID: 1496)
      • AppMarket.exe (PID: 3584)
      • cef_frame_render.exe (PID: 6748)

    • Process checks computer location settings

      • free-fire-gameloop.exe (PID: 1644)
      • AppMarket.exe (PID: 3584)
      • cef_frame_render.exe (PID: 2388)
      • cef_frame_render.exe (PID: 5284)

    • Checks proxy server information

      • slui.exe (PID: 1068)
      • AppMarket.exe (PID: 3584)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 768)

    • Reads product name

      • AppMarket.exe (PID: 3584)

    • Reads Environment values

      • AppMarket.exe (PID: 3584)

    • Reads Windows Product ID

      • AppMarket.exe (PID: 3584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:09:27 04:52:07+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 2605568
InitializedDataSize: 1210368
UninitializedDataSize: -
EntryPoint: 0x22109e
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 1.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
FileDescription: Uptodown GameLoop Downloader
ProductName: Uptodown GameLoop Downloader
CompanyName: Tencent
FileVersion: 1, 0, 0, 1
InternalName: TGBDownloader.exe
LegalCopyright: Copyright ? 2020 Tencent. All Rights Reserved.
OriginalFileName: TGBDownloader.exe
ProductVersion: 1, 0, 0, 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
35
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start free-fire-gameloop.exe market.exe slui.exe tinst.exe qmemulatorservice.exe netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs appmarket.exe pcyybassistant.exe no specs wmpf_installer.exe no specs wmic.exe no specs conhost.exe no specs syzs_dl_svr.exe conhost.exe no specs cef_frame_render.exe no specs cef_frame_render.exe cef_frame_render.exe no specs cef_frame_render.exe no specs systeminfo.exe no specs conhost.exe no specs tiworker.exe no specs cef_frame_render.exe no specs ui.exe svchost.exe free-fire-gameloop.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
700\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—syzs_dl_svr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
768wmic path Win32_ComputerSystem get HypervisorPresentC:\Windows\SysWOW64\wbem\WMIC.exe—PcyybAssistant.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1036\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1068C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1236"C:\WINDOWS\system32\Netsh.exe" advfirewall firewall add rule name="AppMarket" dir=in program="c:\program files\txgameassistant\appmarket\AppMarket.exe" action=allowC:\Windows\SysWOW64\netsh.exe—TInst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1336"C:\Temp\TxGameDownload\Component\UI\caf421b6322a339165119069085b3879\UI.exe" 0C:\Temp\TxGameDownload\Component\UI\caf421b6322a339165119069085b3879\UI.exe
AppMarket.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\temp\txgamedownload\component\ui\caf421b6322a339165119069085b3879\ui.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3996_none_d954cb49e10154a6\gdiplus.dll
1380"C:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Market.exe" C:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Market.exe
free-fire-gameloop.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\temp\txgamedownload\component\appmarket\02e9cc9a4389b639aa8d98dac4dfb4ee\market.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3996_none_d954cb49e10154a6\gdiplus.dll
1496"C:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\Tinst.exe" C:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\TInst.exe
free-fire-gameloop.exe
User:
admin
Integrity Level:
HIGH
Description:
TMarketInst
Exit code:
0
Version:
3.71.3151.81
Modules
Images
c:\temp\txgamedownload\component\appmarket\02e9cc9a4389b639aa8d98dac4dfb4ee\setup\tinst.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
1568"C:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe"C:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe
services.exe
User:
SYSTEM
Company:
Tencent
Integrity Level:
SYSTEM
Description:
腾讯手游助手
Version:
3.71.3151.81
Modules
Images
c:\program files\txgameassistant\appmarket\qmemulatorservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
1612"C:\WINDOWS\system32\Netsh.exe" advfirewall firewall add rule name="TUpdate" dir=in program="c:\program files\txgameassistant\appmarket\GF186\TUpdate.exe" action=allowC:\Windows\SysWOW64\netsh.exe—TInst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
18 771
Read events
18 717
Write events
51
Delete events
3

Modification events

(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tencent\MobileGamePC\Beacon
Operation:writeName:Last_Sid_free-fire-gameloop.exe
Value:
0B9D6367-D289-4762-A762-198D16B4DD07
(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tencent\MobileGamePC
Operation:writeName:TempPath
Value:
C:\Temp\TxGameDownload\Component\
(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tencent\MobileGamePC
Operation:writeName:UserLanguage
Value:
en
(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tencent\MobileGamePC
Operation:writeName:abtestid
Value:
{"Component":"0"}
(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tencent\MobileGamePC\GameDownload
Operation:writeName:DownloadSpeed
Value:
0
(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Tencent\MobileGamePC
Operation:writeName:SupplyId
Value:
(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tencent\MobileGamePC
Operation:writeName:Region
Value:
DE
(PID) Process:(1644) free-fire-gameloop.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Tencent\MobileGamePC\AppMarket
Operation:writeName:InstallPath
Value:
C:\Program Files\TxGameAssistant\AppMarket
(PID) Process:(1496) TInst.exeKey:HKEY_CURRENT_USER\SOFTWARE\Tencent\MobileGamePC
Operation:writeName:sf
Value:
C:\Temp\TxGameDownload\MobileGamePCShared
(PID) Process:(1496) TInst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:AppMarket
Value:
Executable files
444
Suspicious files
411
Text files
2 185
Unknown types
114

Dropped files

PID
Process
Filename
Type
1644free-fire-gameloop.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Market.exe —
MD5:—
SHA256:—
1644free-fire-gameloop.exeC:\Users\admin\AppData\Local\Tencent\TxGameAssistant\TGBDownloader\dr.dllexecutable
MD5:2814ACBD607BA47BDBCDF6AC3076EE95
SHA256:5904A7E4D97EEAC939662C3638A0E145F64FF3DD0198F895C4BF0337595C6A67
1644free-fire-gameloop.exeC:\Users\admin\AppData\Roaming\Tencent\DeskUpdate\GlobalMgr.dbtext
MD5:455614569E145AAF3303E62A94BF53A1
SHA256:2F44E3C1F59488673221613739CB38CFBDC1491E6847BE86F5468BD99CE7FF1B
1644free-fire-gameloop.exeC:\test.tmpbinary
MD5:FEF8EB1D0299C8A882F1079028001F94
SHA256:D68F3FBDB5E74AFCA2D50E8557281CB1C3338891AD2F2DB84C16B914E3A3855E
1380Market.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\api-ms-win-core-file-l1-2-0.dllexecutable
MD5:EC4F2CB68DCF7E96516EB284003BE8BB
SHA256:3816BBB7DD76D8FC6A7B83A0ED2F61B23DD5FC0843D3308EE077CB725D5C9088
1380Market.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\api-ms-win-core-file-l1-1-0.dllexecutable
MD5:D826D27C73D9F2420FB39FBE0745C7F0
SHA256:C0E5D482BD93BF71A73C01D0C1EC0722EA3260EBA1F4C87E797BAE334B5E9870
1380Market.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:64978E199A7239D2C911876447A7F05B
SHA256:92B947F1D6236F86ED7E105CFF19E23C13D1968861426511B775905E1D26B47A
1380Market.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\api-ms-win-core-file-l2-1-0.dllexecutable
MD5:B9287EB7BCBFDCEC2E8D4198FD266509
SHA256:096409422ECD1894E4D6289FD2D1C7490BD83DAFF0C1E3D16C36C78BD477B895
1380Market.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\api-ms-win-core-heap-l1-1-0.dllexecutable
MD5:EE5C2FB7BC23BFD06FF32556CC7C3B4D
SHA256:EFC9F0E32BCE971900DDF66A1A9E68DAA3BFB2099A1BA9F24C6EE82DA2CBD6E8
1380Market.exeC:\Temp\TxGameDownload\Component\AppMarket\02e9cc9a4389b639aa8d98dac4dfb4ee\Setup\api-ms-win-core-handle-l1-1-0.dllexecutable
MD5:6A35A52D536E34BA060A19D06B1DAC80
SHA256:A369EF130749BF8CD9F67055179E6F537F200C060AF47493D49473912A95021E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
153
DNS requests
46
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5644
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2220
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2220
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
3732
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
764
lsass.exe
GET
200
163.181.254.188:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEATBuWAZH8q%2B3NqTAabNeMM%3D
unknown
—
—
whitelisted
764
lsass.exe
GET
200
163.181.254.188:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRdfbJlK8FvT8EKTy%2FQWk9HlJQmegQUKyMWgRtHiYqQeuzoMtRsjnL5ziUCEA6xppOq9GVD9UJAOok2b2g%3D
unknown
—
—
whitelisted
3584
AppMarket.exe
POST
200
43.154.254.18:80
http://masterconn.qq.com/q.cgi
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5944
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
7076
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1644
free-fire-gameloop.exe
157.255.4.39:443
master.etl.desktop.qq.com
China Unicom Guangdong IP network
CN
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1644
free-fire-gameloop.exe
101.33.47.206:8081
oth.eve.mdt.qq.com
Tencent Building, Kejizhongyi Avenue
SG
whitelisted
5644
svchost.exe
40.126.31.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5644
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1644
free-fire-gameloop.exe
49.51.129.71:443
unifiedaccess.gameloop.com
Tencent Building, Kejizhongyi Avenue
DE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.206
whitelisted
master.etl.desktop.qq.com
  • 157.255.4.39
whitelisted
oth.eve.mdt.qq.com
  • 101.33.47.206
  • 43.173.131.185
  • 101.33.47.68
whitelisted
login.live.com
  • 40.126.31.129
  • 20.190.159.4
  • 40.126.31.71
  • 20.190.159.0
  • 20.190.159.129
  • 40.126.31.1
  • 40.126.31.69
  • 40.126.31.67
  • 40.126.31.73
  • 20.190.159.71
  • 40.126.31.3
  • 40.126.31.0
  • 20.190.159.131
  • 20.190.159.128
  • 40.126.31.2
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
unifiedaccess.gameloop.com
  • 49.51.129.71
  • 49.51.131.79
unknown
down.gameloop.com
  • 43.152.29.148
  • 43.152.26.239
  • 43.152.26.197
  • 43.152.26.142
  • 43.174.109.182
  • 43.152.28.43
  • 43.152.26.209
  • 43.152.28.41
  • 43.152.26.151
  • 43.152.26.238
  • 43.152.26.110
  • 43.152.28.77
  • 43.152.26.154
  • 43.152.29.72
  • 43.152.27.98
malicious
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.30
  • 23.216.77.37
  • 23.216.77.42
  • 23.216.77.38
  • 23.216.77.36
  • 23.216.77.41
  • 23.216.77.35
  • 23.216.77.25
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
—
—
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
—
—
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
—
—
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
—
—
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
Process
Message
AppMarket.exe
[Downloader] DriverType C: = 3
AppMarket.exe
[Downloader] GetLogicalDrives 4
AppMarket.exe
[Downloader] GetLogicalDrives 4
AppMarket.exe
[Downloader] DriverType C: = 3
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
free-fire-gameloop.exe