File name:

freetube-0.21.1-setup-x641.exe

Full analysis: https://app.any.run/tasks/0e4952fd-5633-430e-a2bf-5d0c92b25a8f
Verdict: Malicious activity
Analysis date: July 13, 2024, 02:33:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

76275603D337751CA14DDF4189FF47C0

SHA1:

84F8E751F0C93743DCC5A36DCCDCC1664A0DF7CE

SHA256:

44853358F0D035879D567309ED69C41DA9C0994E1524EBE130C4DF8E4F04C66B

SSDEEP:

786432:Z8ONp1GzO2I2EFSXCnIhhJybIkIot13R0qE:Z8Op1hSpXGohsbIkpv3RFE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • freetube-0.21.1-setup-x641.exe (PID: 4400)

  • SUSPICIOUS

    • Creates a software uninstall entry

      • freetube-0.21.1-setup-x641.exe (PID: 4400)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • freetube-0.21.1-setup-x641.exe (PID: 4400)

    • The process creates files with name similar to system file names

      • freetube-0.21.1-setup-x641.exe (PID: 4400)

    • Application launched itself

      • FreeTube.exe (PID: 4896)

    • Executable content was dropped or overwritten

      • freetube-0.21.1-setup-x641.exe (PID: 4400)

    • Drops 7-zip archiver for unpacking

      • freetube-0.21.1-setup-x641.exe (PID: 4400)

    • Reads security settings of Internet Explorer

      • freetube-0.21.1-setup-x641.exe (PID: 4400)

    • Process drops legitimate windows executable

      • freetube-0.21.1-setup-x641.exe (PID: 4400)

  • INFO

    • Checks supported languages

      • freetube-0.21.1-setup-x641.exe (PID: 4400)
      • FreeTube.exe (PID: 4896)
      • FreeTube.exe (PID: 5872)
      • FreeTube.exe (PID: 4152)
      • FreeTube.exe (PID: 3760)
      • FreeTube.exe (PID: 2992)

    • Reads the computer name

      • freetube-0.21.1-setup-x641.exe (PID: 4400)
      • FreeTube.exe (PID: 4896)
      • FreeTube.exe (PID: 3760)
      • FreeTube.exe (PID: 4152)
      • FreeTube.exe (PID: 2992)

    • Creates files or folders in the user directory

      • freetube-0.21.1-setup-x641.exe (PID: 4400)
      • FreeTube.exe (PID: 4152)
      • FreeTube.exe (PID: 4896)
      • FreeTube.exe (PID: 2992)

    • Checks proxy server information

      • FreeTube.exe (PID: 4896)

    • Create files in a temporary directory

      • freetube-0.21.1-setup-x641.exe (PID: 4400)
      • FreeTube.exe (PID: 4896)

    • Process checks computer location settings

      • FreeTube.exe (PID: 4896)
      • FreeTube.exe (PID: 5872)

    • Reads product name

      • FreeTube.exe (PID: 4896)

    • Reads Environment values

      • FreeTube.exe (PID: 4896)

    • Reads the machine GUID from the registry

      • FreeTube.exe (PID: 4896)
      • FreeTube.exe (PID: 2992)

    • Manual execution by a user

      • FreeTube.exe (PID: 4896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:26:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.21.1.0
ProductVersionNumber: 0.21.1.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: PrestonN
FileDescription: A private YouTube client
FileVersion: 0.21.1
LegalCopyright: Copyleft © 2020-2024 freetubeapp@protonmail.com
ProductName: FreeTube
ProductVersion: 0.21.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
116
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start freetube-0.21.1-setup-x641.exe freetube.exe no specs freetube.exe no specs freetube.exe freetube.exe no specs freetube.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2992"C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --user-data-dir="C:\Users\admin\AppData\Roaming\FreeTube" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3324,i,1951046789740294533,11956986716690453728,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:8C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe—FreeTube.exe
User:
admin
Company:
PrestonN
Integrity Level:
MEDIUM
Description:
FreeTube
Exit code:
0
Version:
0.21.1
Modules
Images
c:\users\admin\appdata\local\programs\freetube\freetube.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\users\admin\appdata\local\programs\freetube\ffmpeg.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3760"C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\FreeTube" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,1951046789740294533,11956986716690453728,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:2C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe—FreeTube.exe
User:
admin
Company:
PrestonN
Integrity Level:
LOW
Description:
FreeTube
Version:
0.21.1
Modules
Images
c:\users\admin\appdata\local\programs\freetube\freetube.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4152"C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\FreeTube" --standard-schemes=app --secure-schemes=app --fetch-schemes=app --field-trial-handle=2044,i,1951046789740294533,11956986716690453728,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe
FreeTube.exe
User:
admin
Company:
PrestonN
Integrity Level:
MEDIUM
Description:
FreeTube
Version:
0.21.1
Modules
Images
c:\users\admin\appdata\local\programs\freetube\freetube.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\users\admin\appdata\local\programs\freetube\ffmpeg.dll
4400"C:\Users\admin\Desktop\freetube-0.21.1-setup-x641.exe" C:\Users\admin\Desktop\freetube-0.21.1-setup-x641.exe
explorer.exe
User:
admin
Company:
PrestonN
Integrity Level:
MEDIUM
Description:
A private YouTube client
Exit code:
0
Version:
0.21.1
Modules
Images
c:\users\admin\desktop\freetube-0.21.1-setup-x641.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4896"C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe" C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe—explorer.exe
User:
admin
Company:
PrestonN
Integrity Level:
MEDIUM
Description:
FreeTube
Version:
0.21.1
Modules
Images
c:\users\admin\appdata\local\programs\freetube\freetube.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
5872"C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\FreeTube" --standard-schemes=app --secure-schemes=app --fetch-schemes=app --app-path="C:\Users\admin\AppData\Local\Programs\FreeTube\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2828,i,1951046789740294533,11956986716690453728,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:1C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe—FreeTube.exe
User:
admin
Company:
PrestonN
Integrity Level:
MEDIUM
Description:
FreeTube
Version:
0.21.1
Modules
Images
c:\users\admin\appdata\local\programs\freetube\freetube.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
6 284
Read events
6 252
Write events
14
Delete events
18

Modification events

(PID) Process:(4400) freetube-0.21.1-setup-x641.exeKey:HKEY_CURRENT_USER\SOFTWARE\609c326f-6a5e-5cd1-9fc0-6e966fad073f
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\Programs\FreeTube
(PID) Process:(4400) freetube-0.21.1-setup-x641.exeKey:HKEY_CURRENT_USER\SOFTWARE\609c326f-6a5e-5cd1-9fc0-6e966fad073f
Operation:writeName:KeepShortcuts
Value:
true
(PID) Process:(4400) freetube-0.21.1-setup-x641.exeKey:HKEY_CURRENT_USER\SOFTWARE\609c326f-6a5e-5cd1-9fc0-6e966fad073f
Operation:writeName:ShortcutName
Value:
FreeTube
(PID) Process:(4400) freetube-0.21.1-setup-x641.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\609c326f-6a5e-5cd1-9fc0-6e966fad073f
Operation:writeName:DisplayName
Value:
FreeTube 0.21.1
(PID) Process:(4400) freetube-0.21.1-setup-x641.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\609c326f-6a5e-5cd1-9fc0-6e966fad073f
Operation:writeName:UninstallString
Value:
"C:\Users\admin\AppData\Local\Programs\FreeTube\Uninstall FreeTube.exe" /currentuser
(PID) Process:(4400) freetube-0.21.1-setup-x641.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\609c326f-6a5e-5cd1-9fc0-6e966fad073f
Operation:writeName:QuietUninstallString
Value:
"C:\Users\admin\AppData\Local\Programs\FreeTube\Uninstall FreeTube.exe" /currentuser /S
(PID) Process:(4400) freetube-0.21.1-setup-x641.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\609c326f-6a5e-5cd1-9fc0-6e966fad073f
Operation:writeName:DisplayVersion
Value:
0.21.1
(PID) Process:(4400) freetube-0.21.1-setup-x641.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\609c326f-6a5e-5cd1-9fc0-6e966fad073f
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\AppData\Local\Programs\FreeTube\FreeTube.exe,0
(PID) Process:(4400) freetube-0.21.1-setup-x641.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\609c326f-6a5e-5cd1-9fc0-6e966fad073f
Operation:writeName:Publisher
Value:
PrestonN
(PID) Process:(4400) freetube-0.21.1-setup-x641.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\609c326f-6a5e-5cd1-9fc0-6e966fad073f
Operation:writeName:NoModify
Value:
1
Executable files
22
Suspicious files
163
Text files
14
Unknown types
7

Dropped files

PID
Process
Filename
Type
4400freetube-0.21.1-setup-x641.exeC:\Users\admin\AppData\Local\Temp\nsg50E3.tmp\app-64.7z —
MD5:—
SHA256:—
4400freetube-0.21.1-setup-x641.exeC:\Users\admin\AppData\Local\Temp\nsg50E3.tmp\7z-out\icudtl.dat —
MD5:—
SHA256:—
4400freetube-0.21.1-setup-x641.exeC:\Users\admin\AppData\Local\Temp\nsg50E3.tmp\7z-out\LICENSES.chromium.html —
MD5:—
SHA256:—
4400freetube-0.21.1-setup-x641.exeC:\Users\admin\AppData\Local\Temp\nsg50E3.tmp\nsDialogs.dllexecutable
MD5:466179E1C8EE8A1FF5E4427DBB6C4A01
SHA256:1E40211AF65923C2F4FD02CE021458A7745D28E2F383835E3015E96575632172
4400freetube-0.21.1-setup-x641.exeC:\Users\admin\AppData\Local\Temp\nsg50E3.tmp\nsExec.dllexecutable
MD5:EC0504E6B8A11D5AAD43B296BEEB84B2
SHA256:5D9CEB1CE5F35AEA5F9E5A0C0EDEEEC04DFEFE0C77890C80C70E98209B58B962
4400freetube-0.21.1-setup-x641.exeC:\Users\admin\AppData\Local\Temp\nsg50E3.tmp\UAC.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
4400freetube-0.21.1-setup-x641.exeC:\Users\admin\AppData\Local\Temp\nsg50E3.tmp\modern-wizard.bmpimage
MD5:52FF52EEE3B944B862C11C268A02C196
SHA256:2079F7A3EBA60E0D9EE827A7208AA052A71B384873B641DE5E299AEB8E733109
4400freetube-0.21.1-setup-x641.exeC:\Users\admin\AppData\Local\Temp\nsg50E3.tmp\7z-out\LICENSE.electron.txttext
MD5:4D42118D35941E0F664DDDBD83F633C5
SHA256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
4400freetube-0.21.1-setup-x641.exeC:\Users\admin\AppData\Local\Temp\nsg50E3.tmp\7z-out\locales\am.pakbinary
MD5:5D55F8A437E65DD7962337857E78970B
SHA256:F7D24B9CD21562665BA250CAEE9C280A1C95EFEA4B5F37D1AFDD36C369A61B87
4400freetube-0.21.1-setup-x641.exeC:\Users\admin\AppData\Local\Temp\nsg50E3.tmp\7z-out\chrome_100_percent.pakbinary
MD5:CB4F128469CD84711ED1C9C02212C7A8
SHA256:7DD5485DEF22A53C0635EFDF8AE900F147EC8C8A22B9ED71C24668075DD605D3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
43
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2052
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2064
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2052
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
104.126.37.145:443
https://www.bing.com/AS/API/WindowsCortanaPane/V2/Suggestions?qry=rege&setlang=en-US&cc=US&nohs=1&qfm=1&cp=4&cvid=917f2af1fe65416cbd620a4b992edbf0&ig=9e5ca3b8609c45288674b78f53cdefa2
unknown
binary
4.98 Kb
unknown
—
—
GET
200
104.126.37.145:443
https://www.bing.com/AS/API/WindowsCortanaPane/V2/Suggestions?qry=regedi&setlang=en-US&cc=US&nohs=1&qfm=1&cp=6&cvid=917f2af1fe65416cbd620a4b992edbf0&ig=46856f19730442d7bfc8a588e4a577aa
unknown
binary
4.00 Kb
unknown
—
—
GET
200
104.126.37.145:443
https://www.bing.com/AS/API/WindowsCortanaPane/V2/Suggestions?qry=reg&setlang=en-US&cc=US&nohs=1&qfm=1&cp=3&cvid=917f2af1fe65416cbd620a4b992edbf0&ig=65838b980f4f409493f636a698a90235
unknown
binary
5.15 Kb
unknown
—
—
GET
200
104.126.37.131:443
https://www.bing.com/AS/API/WindowsCortanaPane/V2/Suggestions?qry=re&setlang=en-US&cc=US&nohs=1&qfm=1&cp=2&cvid=917f2af1fe65416cbd620a4b992edbf0&ig=886f7dfaf8a943d7ac515843550c84b9
unknown
binary
5.01 Kb
unknown
—
—
GET
200
104.126.37.131:443
https://www.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=DyIrb3t-gQF4cnWyAbUBK6UBK7gB&or=w
unknown
s
21.3 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:1900
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.126.37.139:443
www.bing.com
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2052
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2064
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2052
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
www.bing.com
  • 104.126.37.139
  • 104.126.37.128
  • 104.126.37.131
  • 104.126.37.163
  • 104.126.37.145
whitelisted
google.com
  • 142.250.181.238
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
api.invidious.io
  • 93.95.230.186
unknown
api.github.com
  • 140.82.121.5
whitelisted
write.as
  • 174.143.201.50
whitelisted
self.events.data.microsoft.com
  • 51.105.71.137
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
freetube-0.21.1-setup-x641.exe