| File name: | ArcadeInstallPROJIGI2D111b.bin |
| Full analysis: | https://app.any.run/tasks/ccb72297-b90d-4a67-ba22-9d6aeaac339b |
| Verdict: | Malicious activity |
| Analysis date: | December 21, 2023, 05:53:35 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 5870E552DE456F93988E68E0652DCB05 |
| SHA1: | CC01FC584BCC524364EC522D3C8E804DF3EC1EF9 |
| SHA256: | 75EB04DCB8B5747BCB73867045F530845E3F56450CDBB3389A2C9504FA5BFC9E |
| SSDEEP: | 98304:ZVwCb7rb8jqWcxHoSWLv1vYFfW2mNdvWq/DPL7UfsJpNY9BKE9AsKD345KmOnRKO:Hwap0XkbcLHK70 |
| .dll | | | Win32 Dynamic Link Library (generic) (43.5) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (29.8) |
| .exe | | | Generic Win/DOS Executable (13.2) |
| .exe | | | DOS Executable Generic (13.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 1999:05:21 22:48:48+02:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, Removable run from swap |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 8704 |
| InitializedDataSize: | 5632 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x21af |
| OSVersion: | 4 |
| ImageVersion: | 4 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows 16-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Windows, Latin1 |
| CompanyName: | Gamespy Industries, Inc. |
| FileDescription: | GameSpy Arcade Install |
| FileVersion: | - |
| LegalCopyright: | Copyright 2001 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 120 | "C:\Users\admin\AppData\Local\Temp\ArcadeInstallPROJIGI2D111b.bin.exe" | C:\Users\admin\AppData\Local\Temp\ArcadeInstallPROJIGI2D111b.bin.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 316 | "C:\PROGRA~1\GAMESP~1\Aphex.exe" +svc _news | C:\Program Files\GameSpy Arcade\Aphex.exe | ArcadeInstallPROJIGI2D111b.bin.exe | ||||||||||||
User: admin Company: GameSpy Industries, Inc. Integrity Level: HIGH Description: GameSpy Arcade 1.1 Exit code: 3489660927 Version: 1.10 Build 5043 Modules
| |||||||||||||||
| 548 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=6432 --field-trial-handle=1288,i,2407357972792688772,12316348891885140560,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 908 | "C:\Program Files\GameSpy Arcade\Aphex.exe" | C:\Program Files\GameSpy Arcade\Aphex.exe | explorer.exe | ||||||||||||
User: admin Company: GameSpy Industries, Inc. Integrity Level: MEDIUM Description: GameSpy Arcade 1.1 Exit code: 0 Version: 1.10 Build 5043 Modules
| |||||||||||||||
| 1216 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0x170,0x174,0x178,0x144,0x180,0x6d8ff598,0x6d8ff5a8,0x6d8ff5b4 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1384 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 --field-trial-handle=1408,i,2277266271190202967,15178289284071751776,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1404 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5236 --field-trial-handle=1288,i,2407357972792688772,12316348891885140560,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1588 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument C:\PROGRA~1\GAMESP~1\README~1.HTM | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | ArcadeInstallPROJIGI2D111b.bin.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1632 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.gamespyarcade.com/register/ | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | ArcadeInstallPROJIGI2D111b.bin.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1768 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate http://www.gamespyarcade.com/register/ | C:\Program Files\Microsoft\Edge\Application\msedge.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| (PID) Process: | (2080) ArcadeInstallPROJIGI2D111b.bin.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2080) ArcadeInstallPROJIGI2D111b.bin.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2080) ArcadeInstallPROJIGI2D111b.bin.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2080) ArcadeInstallPROJIGI2D111b.bin.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (316) Aphex.exe | Key: | HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\User Trusted External Applications |
| Operation: | write | Name: | C:\PROGRA~1\GAMESP~1\GSAPak.exe |
Value: Yes | |||
| (PID) Process: | (1632) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (1632) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (1632) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (1588) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (1588) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2080 | ArcadeInstallPROJIGI2D111b.bin.exe | C:\Users\admin\AppData\Local\Temp\GSAEULA.TXT | text | |
MD5:7C8DCDFC9BB4E79B531BFA6FEB457D48 | SHA256:5BE6B4E30D612D03535EB3E99533B5B83C674985E281AB73A46D7E9D996E0983 | |||
| 2080 | ArcadeInstallPROJIGI2D111b.bin.exe | C:\Program Files\GameSpy Arcade\~GLH0005.TMP | executable | |
MD5:C6DFC742228E265463FAE3952F8E193B | SHA256:C68924550FC13279B6CAA7107823A34877223FCE0A98AFFE43D7FF09EADDCD76 | |||
| 2080 | ArcadeInstallPROJIGI2D111b.bin.exe | C:\Program Files\GameSpy Arcade\~GLH0006.TMP | executable | |
MD5:C6DFC742228E265463FAE3952F8E193B | SHA256:C68924550FC13279B6CAA7107823A34877223FCE0A98AFFE43D7FF09EADDCD76 | |||
| 2080 | ArcadeInstallPROJIGI2D111b.bin.exe | C:\Users\admin\AppData\Local\Temp\~GLH0001.TMP | text | |
MD5:7C8DCDFC9BB4E79B531BFA6FEB457D48 | SHA256:5BE6B4E30D612D03535EB3E99533B5B83C674985E281AB73A46D7E9D996E0983 | |||
| 2080 | ArcadeInstallPROJIGI2D111b.bin.exe | C:\Program Files\GameSpy Arcade\temp.000 | executable | |
MD5:6AA20F11BE91288BF1F43F97C09F4C77 | SHA256:EC2CA3F3F7177BAB02559500EBFB049CB9BD2DBF29E2FA1C8DAB6EA5ED0DBFEA | |||
| 2080 | ArcadeInstallPROJIGI2D111b.bin.exe | C:\Program Files\GameSpy Arcade\~GLH0002.TMP | executable | |
MD5:443E13846997C537E8F5ED61130AB705 | SHA256:49EF36BD01B8EBF38C7B807A5FB44CBAF47C9D4EFA883B01C41494C61AE4A2E2 | |||
| 2080 | ArcadeInstallPROJIGI2D111b.bin.exe | C:\Program Files\GameSpy Arcade\~GLH0004.TMP | executable | |
MD5:6AA20F11BE91288BF1F43F97C09F4C77 | SHA256:EC2CA3F3F7177BAB02559500EBFB049CB9BD2DBF29E2FA1C8DAB6EA5ED0DBFEA | |||
| 2080 | ArcadeInstallPROJIGI2D111b.bin.exe | C:\Program Files\GameSpy Arcade\ArcadeRes.dll | executable | |
MD5:C6DFC742228E265463FAE3952F8E193B | SHA256:C68924550FC13279B6CAA7107823A34877223FCE0A98AFFE43D7FF09EADDCD76 | |||
| 2080 | ArcadeInstallPROJIGI2D111b.bin.exe | C:\Program Files\GameSpy Arcade\~GLH0008.TMP | executable | |
MD5:C8B83C9CA12F70F8F42FBDC5857578B4 | SHA256:9C64927C412107CFEA262009E5C1BA74BDD03C309711F6257D997A87102CA0D7 | |||
| 2080 | ArcadeInstallPROJIGI2D111b.bin.exe | C:\Users\admin\AppData\Local\Temp\GLH125.tmp | executable | |
MD5:B4BFA3E42692E76A00E3B7F9CFC7D876 | SHA256:101210BDECFC7DEAB857224F7F35CBE00BDD068581C26C8A08768B0A8A1C264D | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
316 | Aphex.exe | GET | 301 | 165.160.13.20:80 | http://www.gamespyarcade.com/software/sda.txt | unknown | — | — | unknown |
316 | Aphex.exe | GET | 301 | 165.160.13.20:80 | http://www.gamespyarcade.com/software/banner.html | unknown | — | — | unknown |
316 | Aphex.exe | GET | 200 | 199.232.192.129:80 | http://www.gamespy.com/ | unknown | html | 70.1 Kb | unknown |
316 | Aphex.exe | GET | 200 | 199.232.192.129:80 | http://www.gamespy.com/ | unknown | html | 70.1 Kb | unknown |
2908 | msedge.exe | GET | 200 | 199.232.196.129:80 | http://www.gamespy.com/ | unknown | html | 17.0 Kb | unknown |
2908 | msedge.exe | GET | 301 | 165.160.13.20:80 | http://www.gamespyarcade.com/register/ | unknown | — | — | unknown |
2908 | msedge.exe | GET | 200 | 151.101.1.135:80 | http://media.gamespy.com/spy/spy.css | unknown | — | — | unknown |
2908 | msedge.exe | GET | 200 | 151.101.1.135:80 | http://oystatic.ignimgs.com/src/core/js/external/jquery/jquery-1.6.2.min.js | unknown | html | 31.3 Kb | unknown |
2908 | msedge.exe | GET | 200 | 151.101.1.135:80 | http://media.gamespy.com/spy/gspy_channel.css | unknown | text | 5.18 Kb | unknown |
2908 | msedge.exe | GET | 200 | 151.101.1.135:80 | http://oystatic.ignimgs.com/min/core/css/default/sugarads-min.css | unknown | text | 698 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
316 | Aphex.exe | 165.160.13.20:28900 | downtime.gamespyarcade.com | CSC | US | unknown |
316 | Aphex.exe | 165.160.13.20:80 | downtime.gamespyarcade.com | CSC | US | unknown |
316 | Aphex.exe | 199.232.192.129:80 | www.gamespy.com | FASTLY | US | unknown |
2908 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1768 | msedge.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
2908 | msedge.exe | 204.79.197.239:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
2908 | msedge.exe | 165.160.13.20:80 | downtime.gamespyarcade.com | CSC | US | unknown |
Domain | IP | Reputation |
|---|---|---|
downtime.gamespyarcade.com |
| unknown |
www.gamespyarcade.com |
| unknown |
www.gamespy.com |
| unknown |
config.edge.skype.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
nav-edge.smartscreen.microsoft.com |
| whitelisted |
data-edge.smartscreen.microsoft.com |
| whitelisted |
media.gamespy.com |
| unknown |
oystatic.ignimgs.com |
| unknown |
scripts.ign.com |
| unknown |
PID | Process | Class | Message |
|---|---|---|---|
2908 | msedge.exe | Generic Protocol Command Decode | SURICATA HTTP Request abnormal Content-Encoding header |
2908 | msedge.exe | Generic Protocol Command Decode | SURICATA HTTP Request abnormal Content-Encoding header |
2908 | msedge.exe | Generic Protocol Command Decode | SURICATA HTTP Request abnormal Content-Encoding header |
2908 | msedge.exe | Generic Protocol Command Decode | SURICATA HTTP Request abnormal Content-Encoding header |
2908 | msedge.exe | Generic Protocol Command Decode | SURICATA HTTP Request abnormal Content-Encoding header |
2908 | msedge.exe | Generic Protocol Command Decode | SURICATA HTTP Request abnormal Content-Encoding header |
2908 | msedge.exe | Generic Protocol Command Decode | SURICATA HTTP Request abnormal Content-Encoding header |
2908 | msedge.exe | Generic Protocol Command Decode | SURICATA HTTP Request abnormal Content-Encoding header |
2908 | msedge.exe | Generic Protocol Command Decode | SURICATA HTTP Request abnormal Content-Encoding header |
2908 | msedge.exe | Generic Protocol Command Decode | SURICATA HTTP Request abnormal Content-Encoding header |