URL:

https://steamunlocked.net/terraria-free-download/

Full analysis: https://app.any.run/tasks/af0b446e-aac9-4806-99bf-4a5fafda7932
Verdict: Malicious activity
Analysis date: May 22, 2020, 14:27:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

C6A8C08CA13E521A542B56E49BBC8EEA

SHA1:

9111C76221238FD5A15C49478C7A0313239F0DA5

SHA256:

5A83F0229030DF51AB8597755F2BAA0ECE8D3187825B820D2194D65972DA8B9F

SSDEEP:

3:N8cJ0RKAH5AtBFmn:2cgZAt2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executed via COM

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2556)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1000)
      • iexplore.exe (PID: 1668)
      • iexplore.exe (PID: 1904)

    • Application launched itself

      • iexplore.exe (PID: 1000)

    • Creates files in the user directory

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2556)
      • iexplore.exe (PID: 1904)
      • iexplore.exe (PID: 1000)

    • Changes internet zones settings

      • iexplore.exe (PID: 1000)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1904)
      • iexplore.exe (PID: 1668)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1000)
      • iexplore.exe (PID: 1668)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1000)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1000"C:\Program Files\Internet Explorer\iexplore.exe" https://steamunlocked.net/terraria-free-download/C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1668"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1000 CREDAT:4068617 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1904"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1000 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2556C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_26_0_0_131_activex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
5 495
Read events
832
Write events
3 149
Delete events
1 514

Modification events

(PID) Process:(1000) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
1190275008
(PID) Process:(1000) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30814277
(PID) Process:(1000) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1000) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1000) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1000) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1000) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1000) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(1000) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1000) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
0
Suspicious files
35
Text files
87
Unknown types
31

Dropped files

PID
Process
Filename
Type
1904iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab9890.tmp —
MD5:—
SHA256:—
1904iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar9891.tmp —
MD5:—
SHA256:—
1904iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\SJNIWCWG.txttext
MD5:3A4C191473D8BC5A820B4DAC6F020564
SHA256:9889FFB2D88B5157C67FE275432EE914F2C941898167010A09F6019FF4EDE0D9
1904iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_74167E25E5476CCA2A5946AAA61BF9E1der
MD5:19E1E2A623002CB369A6D2D55DE74088
SHA256:DD08A3A94D3CEBF17944D1F398052C0630E45918963E68E8965EDD1EEB517EF5
1904iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\terraria-free-download[1].htmhtml
MD5:B3D7AC088082A9B7975FCF1CA8C0709F
SHA256:2D37B0AD5784D7A0E25E20E4E11E273D47BC269F51BF5AD3ECCA54C1C109527B
1904iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_74167E25E5476CCA2A5946AAA61BF9E1binary
MD5:BF0B9730DC93295A0A330C4D8D0C15CA
SHA256:9CC52F215F9F4B0AE40A877984212C065A31FDCEC43FE3BF590159A36E7EB852
1904iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\main[1].csstext
MD5:EDB26EFFB5F70315BB64D17213B6E882
SHA256:AF70C96E40BE226A2748BF2D46F82F3BCFDEE83BF7A3B892311DA3316B98DEDE
1904iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\bootstrap-fixes[1].csstext
MD5:CDD1D6FAAD8E4181AF1060697C8802D8
SHA256:844348F4F85072C2D8BB60EF7BECEF523539537F2155A6CECFBA0E4BA14690BA
1904iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\style[1].csstext
MD5:6374BA95303BC000B362FFF731646BA0
SHA256:E765AD7C06B56BC99824428C2CA3B95FA11AC1885288053C2F9E52BD290571D9
1904iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\style[1].csstext
MD5:BEF356A9B18F55A5A2093F0211531AB6
SHA256:D5F08758DAF32FAEC2C88E034D214F15C812D6BE16E0F4034ADCAF4F797E0091
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
53
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1904
iexplore.exe
GET
200
172.217.22.99:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
1904
iexplore.exe
GET
200
172.217.22.99:80
http://ocsp.pki.goog/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEAQoXs0GkwDRCAAAAAA%2Bvho%3D
US
der
471 b
whitelisted
1904
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
1904
iexplore.exe
GET
200
172.217.22.99:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCJIRnrbzaAWwIAAAAAZzJX
US
der
472 b
whitelisted
1904
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
1904
iexplore.exe
GET
200
172.217.22.99:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCJIRnrbzaAWwIAAAAAZzJX
US
der
472 b
whitelisted
1904
iexplore.exe
GET
200
172.217.22.99:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDEKiK1zGWeAwgAAAAAPr4Q
US
der
472 b
whitelisted
1668
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrBBNpPfHTPX6Jy6BVzyBPnBWMnQQUPnQtH89FdQR%2BP8Cihz5MQ4NRE8YCEAlTNnkMFUXGp0L%2B2oY9mJ4%3D
US
der
279 b
whitelisted
1904
iexplore.exe
GET
200
23.37.43.27:80
http://s.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEGMYDTj7gJd4qdA1oxYY%2BEA%3D
NL
der
1.71 Kb
shared
1000
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1904
iexplore.exe
23.37.43.27:80
s.symcd.com
Akamai Technologies, Inc.
NL
whitelisted
1904
iexplore.exe
172.217.21.195:443
fonts.gstatic.com
Google Inc.
US
whitelisted
1904
iexplore.exe
172.217.22.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
—
—
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1904
iexplore.exe
13.35.253.56:443
dkyp75kj7ldlr.cloudfront.net
—
US
suspicious
1904
iexplore.exe
172.217.22.78:443
www.google-analytics.com
Google Inc.
US
whitelisted
1904
iexplore.exe
13.35.253.123:443
dgw7ae5vrovs7.cloudfront.net
—
US
suspicious
1904
iexplore.exe
216.58.206.8:443
www.googletagmanager.com
Google Inc.
US
whitelisted
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1668
iexplore.exe
104.16.107.1:443
properatersch.fun
Cloudflare Inc
US
suspicious

DNS requests

Domain
IP
Reputation
steamunlocked.net
  • 104.26.2.182
  • 104.26.3.182
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
fonts.googleapis.com
  • 172.217.21.202
whitelisted
www.googletagmanager.com
  • 216.58.206.8
whitelisted
dgw7ae5vrovs7.cloudfront.net
  • 13.35.253.123
  • 13.35.253.67
  • 13.35.253.90
  • 13.35.253.81
malicious
s.symcd.com
  • 23.37.43.27
shared
ocsp.pki.goog
  • 172.217.22.99
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
fonts.gstatic.com
  • 172.217.21.195
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://steamunlocked.net/terraria-free-download/