| URL: | https://lg-fans76.myfreesites.net/ |
| Full analysis: | https://app.any.run/tasks/4d1288cc-f86c-434e-84c1-12a74a228c2c |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | January 09, 2026, 16:46:46 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 79E6B2F9ABE677F422E8CFBBAF59E8F2 |
| SHA1: | AACD7E958FAEA50C57AB64A64D813E2463FBD0B0 |
| SHA256: | 4B370D333197BE4E4A071D5A88B9AC99B1040E419CABE9FE1F1EE2783C68CE27 |
| SSDEEP: | 3:N8CIYD0gRAWrn:2CIYDxmA |
MALICIOUS
Actions looks like stealing of personal data
- setup.exe (PID: 8620)
Steals credentials from Web Browsers
- setup.exe (PID: 8620)
- setup.exe (PID: 8832)
- setup.exe (PID: 8552)
- setup.exe (PID: 5628)
- assistant_installer.exe (PID: 7312)
- assistant_installer.exe (PID: 9168)
SUSPICIOUS
WebGL fingerprinting is present
- msedge.exe (PID: 7600)
Application launched itself
- setup.exe (PID: 8620)
- setup.exe (PID: 8552)
- assistant_installer.exe (PID: 9168)
Executable content was dropped or overwritten
- setup.exe (PID: 8832)
- setup.exe (PID: 8816)
- setup.exe (PID: 8620)
- OperaSetup.exe (PID: 6548)
- setup.exe (PID: 8552)
- Assistant_123.0.5669.23_Setup.exe_sfx.exe (PID: 9144)
- setup.exe (PID: 5628)
Starts itself from another location
- setup.exe (PID: 8620)
Reads security settings of Internet Explorer
- setup.exe (PID: 8620)
Process drops legitimate windows executable
- Assistant_123.0.5669.23_Setup.exe_sfx.exe (PID: 9144)
INFO
Checks supported languages
- identity_helper.exe (PID: 5156)
- setup.exe (PID: 8620)
- setup.exe (PID: 8832)
- setup.exe (PID: 8816)
- OperaSetup.exe (PID: 6548)
- setup.exe (PID: 5628)
- setup.exe (PID: 8552)
- assistant_installer.exe (PID: 9168)
- assistant_installer.exe (PID: 7312)
- Assistant_123.0.5669.23_Setup.exe_sfx.exe (PID: 9144)
Reads the computer name
- identity_helper.exe (PID: 5156)
- setup.exe (PID: 8620)
- setup.exe (PID: 8552)
- assistant_installer.exe (PID: 9168)
Executable content was dropped or overwritten
- msedge.exe (PID: 7600)
- msedge.exe (PID: 7928)
Launching a file from the Downloads directory
- msedge.exe (PID: 7600)
Create files in a temporary directory
- setup.exe (PID: 8620)
- setup.exe (PID: 8832)
- OperaSetup.exe (PID: 6548)
- setup.exe (PID: 8816)
- setup.exe (PID: 8552)
- setup.exe (PID: 5628)
- Assistant_123.0.5669.23_Setup.exe_sfx.exe (PID: 9144)
The sample compiled with english language support
- setup.exe (PID: 8832)
- setup.exe (PID: 8620)
- OperaSetup.exe (PID: 6548)
- setup.exe (PID: 8552)
- setup.exe (PID: 5628)
- Assistant_123.0.5669.23_Setup.exe_sfx.exe (PID: 9144)
- setup.exe (PID: 8816)
Application launched itself
- msedge.exe (PID: 7600)
Reads Environment values
- identity_helper.exe (PID: 5156)
Creates files or folders in the user directory
- setup.exe (PID: 8832)
- setup.exe (PID: 8620)
- setup.exe (PID: 8552)
Checks proxy server information
- setup.exe (PID: 8620)
Reads the machine GUID from the registry
- setup.exe (PID: 8620)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
185
Monitored processes
41
Malicious processes
4
Suspicious processes
4
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 748 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=7636,i,2117912058882000572,13628212401388856260,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 1188 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=7596,i,2117912058882000572,13628212401388856260,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2256 | "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6288,i,2117912058882000572,13628212401388856260,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: PWA Identity Proxy Host Exit code: 3221226029 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 4300 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=6080,i,2117912058882000572,13628212401388856260,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 4340 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5156 | "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6288,i,2117912058882000572,13628212401388856260,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: PWA Identity Proxy Host Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 5628 | C:\Users\admin\AppData\Local\Temp\7zS4999D110\setup.exe --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=126.0.5750.18 --initial-client-data=0x27c,0x280,0x290,0x25c,0x294,0x7ffd6d03c4c8,0x7ffd6d03c4d4,0x7ffd6d03c4e0 | C:\Users\admin\AppData\Local\Temp\7zS4999D110\setup.exe | setup.exe | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Installer Version: 126.0.5750.18 Modules
| |||||||||||||||
| 5984 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3548,i,2117912058882000572,13628212401388856260,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 5984 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=6936,i,2117912058882000572,13628212401388856260,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 6544 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4336,i,2117912058882000572,13628212401388856260,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
Total events
4 749
Read events
4 745
Write events
4
Delete events
0
Modification events
| (PID) Process: | (8620) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (8620) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (8620) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (8552) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Opera Software |
| Operation: | write | Name: | Last Stable Install Path |
Value: C:\Users\admin\AppData\Local\Programs\Opera\ | |||
Executable files
21
Suspicious files
57
Text files
271
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7600 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RFfe045.TMP | — | |
MD5:— | SHA256:— | |||
| 7600 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old | — | |
MD5:— | SHA256:— | |||
| 7600 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RFfe054.TMP | — | |
MD5:— | SHA256:— | |||
| 7600 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 7600 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFfe074.TMP | — | |
MD5:— | SHA256:— | |||
| 7600 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 7600 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RFfe083.TMP | — | |
MD5:— | SHA256:— | |||
| 7600 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old | — | |
MD5:— | SHA256:— | |||
| 7600 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RFfe093.TMP | — | |
MD5:— | SHA256:— | |||
| 7600 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
117
TCP/UDP connections
94
DNS requests
96
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
7928 | msedge.exe | GET | 200 | 150.171.22.17:443 | https://config.edge.skype.com/config/v1/Edge/133.0.3065.92?clientId=4489578223053569932&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=65&mngd=0&installdate=1661339457&edu=0&soobedate=1504771245&bphint=2&fg=1&lbfgdate=1741678270&lafgdate=0 | unknown | text | 768 b | whitelisted |
7928 | msedge.exe | GET | 200 | 104.17.132.7:443 | https://lg-fans76.myfreesites.net/home.6a09da40.js | unknown | text | 6.29 Kb | unknown |
7928 | msedge.exe | GET | 200 | 104.17.132.7:443 | https://lg-fans76.myfreesites.net/s/cdn/v1.0/i/m?url=https%3A%2F%2Fstorage.googleapis.com%2Fproduction-sitebuilder-v1-0-8%2F928%2F1914928%2FmpWrwRhn%2F7dd002b5c271482eba757123f8a57ac6&methods=resize%2C2000%2C5000 | unknown | image | 128 Kb | unknown |
7928 | msedge.exe | GET | 200 | 104.17.132.7:443 | https://lg-fans76.myfreesites.net/ | unknown | html | 128 Kb | unknown |
7928 | msedge.exe | GET | 200 | 104.17.63.111:443 | https://runtime.builderservices.io/runtime-sitebuilder-21882/bundle.js | unknown | text | 128 Kb | unknown |
7928 | msedge.exe | GET | 200 | 104.20.15.96:443 | https://s10.histats.com/js15_as.js | unknown | text | 11.1 Kb | unknown |
7928 | msedge.exe | GET | 200 | 2.16.204.147:443 | https://www.bing.com/bloomfilterfiles/ExpandedDomainsFilterGlobal.json | unknown | text | 128 Kb | whitelisted |
7928 | msedge.exe | GET | 200 | 150.171.28.11:443 | https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 | unknown | text | 446 b | whitelisted |
7928 | msedge.exe | GET | 200 | 150.171.28.11:80 | http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:GuMu2VY_Fbny2dRxtkntrQPGuetfFW5Zwvy5xz-ZULQ&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | unknown | — | — | whitelisted |
7928 | msedge.exe | GET | 200 | 66.235.200.14:443 | https://gfonts-proxy.wzdev.co/css?display=swap&family=Montserrat:400,400,700|Lato:400,400,700 | unknown | text | 5.41 Kb | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | Not routed | — | whitelisted |
4476 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6768 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5752 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:138 | — | Not routed | — | whitelisted |
7928 | msedge.exe | 150.171.22.17:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
7928 | msedge.exe | 150.171.28.11:80 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
7928 | msedge.exe | 104.17.132.7:443 | lg-fans76.myfreesites.net | CLOUDFLARENET | US | whitelisted |
7928 | msedge.exe | 150.171.28.11:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
7928 | msedge.exe | 104.18.23.222:443 | copilot.microsoft.com | CLOUDFLARENET | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
lg-fans76.myfreesites.net |
| whitelisted |
copilot.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
components.mywebsitebuilder.com |
| whitelisted |
in-app.mywebsitebuilder.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Generic Protocol Command Decode | SURICATA HTTP Request unrecognized authorization method |
— | — | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |
— | — | Potentially Bad Traffic | ET INFO PE EXE or DLL Windows file download HTTP |
— | — | Misc activity | ET INFO EXE - Served Attached HTTP |
Process | Message |
|---|---|
setup.exe | RecursiveDirectoryCreate( C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable directory exists )
|
setup.exe | RecursiveDirectoryCreate( C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable directory exists )
|
assistant_installer.exe | RecursiveDirectoryCreate( C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable directory exists )
|
assistant_installer.exe | [0109/114750.067:INFO:opera\desktop\windows\assistant\installer\assistant_installer_main.cc:170] Running assistant installer with command line "C:\Users\admin\AppData\Local\Temp\.opera\afd1709f-9cf9-4658-ba1e-9a6351ba481b Opera Installer Temp\opera_package_202601091147401\assistant\assistant_installer.exe" --version
|