URL:

https://gamefervor.com:443/api/getisti/11480082?url=https://s3-us-west-1.amazonaws.com/ext-emulator/flow-helper/minigame/installer4.exe&appid=com.tencent.ig

Full analysis: https://app.any.run/tasks/6a317278-91d3-48a4-a019-352d8540bb82
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 14, 2019, 11:18:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

C2F2C4F654E0D640F004F70C58D3B5B8

SHA1:

530812F7FCEBB563E18E35EEFE2D37268B65BF5F

SHA256:

7EB913FC76B723206DF4354F9D57C001CD6945DBC172FF80996E5CE1B030BDB4

SSDEEP:

3:N8lQuKu9LDjaQXKVYpWIzPSEBQ7WtAT9txYJKSDsKxLDhSWRgOXRLREbyuRP:26uKpCKO13BQrptxYEmsugWRgOXRLiD9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 11480082[1].exe (PID: 3184)
      • 11480082[1].exe (PID: 1796)
      • BrowserAssistant.exe (PID: 4088)
      • 11480082[1].exe (PID: 3892)
      • GameOffer.exe (PID: 3576)
      • dynamicgame__dy_1743176615.exe (PID: 1336)

    • Loads dropped or rewritten executable

      • 11480082[1].exe (PID: 1796)
      • BrowserAssistant.exe (PID: 4088)

    • Loads the Task Scheduler DLL interface

      • 11480082[1].exe (PID: 1796)
      • MsiExec.exe (PID: 2596)

    • Changes the autorun value in the registry

      • 11480082[1].exe (PID: 1796)

    • Writes to a start menu file

      • msiexec.exe (PID: 2636)

    • Downloads executable files from the Internet

      • GameOffer.exe (PID: 3576)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 4028)
      • iexplore.exe (PID: 3540)
      • 11480082[1].exe (PID: 1796)
      • msiexec.exe (PID: 2636)
      • GameOffer.exe (PID: 3576)

    • Uses RUNDLL32.EXE to load library

      • MsiExec.exe (PID: 2596)

    • Reads internet explorer settings

      • 11480082[1].exe (PID: 1796)

    • Executes PowerShell scripts

      • MsiExec.exe (PID: 2596)
      • MsiExec.exe (PID: 3864)
      • MsiExec.exe (PID: 3712)

    • Creates files in the user directory

      • MsiExec.exe (PID: 2596)
      • 11480082[1].exe (PID: 3184)
      • powershell.exe (PID: 2124)
      • powershell.exe (PID: 3596)
      • powershell.exe (PID: 2704)
      • powershell.exe (PID: 1640)
      • powershell.exe (PID: 2800)
      • powershell.exe (PID: 2624)
      • powershell.exe (PID: 2396)
      • powershell.exe (PID: 2248)
      • GameOffer.exe (PID: 3576)
      • msiexec.exe (PID: 2636)

    • Reads Internet Cache Settings

      • 11480082[1].exe (PID: 1796)

    • Reads Environment values

      • MsiExec.exe (PID: 2596)
      • 11480082[1].exe (PID: 1796)
      • MsiExec.exe (PID: 3864)
      • MsiExec.exe (PID: 3712)

    • Creates files in the Windows directory

      • 11480082[1].exe (PID: 1796)

    • Starts Microsoft Installer

      • 11480082[1].exe (PID: 1796)

    • Removes files from Windows directory

      • 11480082[1].exe (PID: 1796)

    • Uses TASKKILL.EXE to kill process

      • powershell.exe (PID: 2704)

    • Executed as Windows Service

      • vssvc.exe (PID: 1512)

    • Application launched itself

      • 11480082[1].exe (PID: 1796)

    • Executed via COM

      • DrvInst.exe (PID: 1032)

    • Starts CMD.EXE for commands execution

      • 11480082[1].exe (PID: 1796)
      • cmd.exe (PID: 2368)
      • cmd.exe (PID: 3936)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 3936)
      • cmd.exe (PID: 2368)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3540)

    • Application launched itself

      • iexplore.exe (PID: 3540)
      • msiexec.exe (PID: 2636)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 4028)
      • iexplore.exe (PID: 3540)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2596)
      • MsiExec.exe (PID: 3864)
      • MsiExec.exe (PID: 3712)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 2636)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2636)

    • Searches for installed software

      • msiexec.exe (PID: 2636)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 1512)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 1032)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 1032)

    • Manual execution by user

      • explorer.exe (PID: 3876)
      • rundll32.exe (PID: 4036)

    • Application was crashed

      • dynamicgame__dy_1743176615.exe (PID: 1336)

    • Modifies the open verb of a shell class

      • rundll32.exe (PID: 4036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
91
Monitored processes
38
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start iexplore.exe iexplore.exe 11480082[1].exe msiexec.exe msiexec.exe rundll32.exe no specs powershell.exe 11480082[1].exe no specs msiexec.exe no specs msiexec.exe no specs powershell.exe powershell.exe no specs taskkill.exe no specs powershell.exe no specs powershell.exe browserassistant.exe powershell.exe 11480082[1].exe no specs vssvc.exe no specs drvinst.exe no specs msiexec.exe no specs powershell.exe powershell.exe gameoffer.exe cmd.exe no specs cmd.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs dynamicgame__dy_1743176615.exe explorer.exe no specs rundll32.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
364ATTRIB -r "\\?\C:\Users\admin\AppData\Local\Temp\{4A081~1\TEMPLA~1.MSI" C:\Windows\system32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1032DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot22" "" "" "695c3f483" "00000000" "000005BC" "000003C8"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1336"C:\Users\admin\AppData\Roaming\Direct Game UNI Installer\dynamicgame__dy_1743176615.exe" C:\Users\admin\AppData\Roaming\Direct Game UNI Installer\dynamicgame__dy_1743176615.exe
GameOffer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Lite Setup
Exit code:
216
Version:
Modules
Images
c:\users\admin\appdata\roaming\direct game uni installer\dynamicgame__dy_1743176615.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1364ATTRIB -r "C:\Users\admin\AppData\Local\Temp\EXE3B6.tmp.bat" C:\Windows\system32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1400C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\admin\AppData\Local\Temp\EXE4C1.tmp.bat" "C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1512C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1640 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pss410A.ps1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe—MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1796"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\11480082[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\11480082[1].exe
iexplore.exe
User:
admin
Company:
GamesLOL
Integrity Level:
MEDIUM
Description:
Direct Game UNI Installer Installer
Exit code:
0
Version:
1.0.15
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\lh043oam\11480082[1].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2124 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pss959.ps1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2248 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pssEAEE.ps1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
5 906
Read events
4 425
Write events
1 451
Delete events
30

Modification events

(PID) Process:(3540) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3540) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3540) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3540) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3540) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3540) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3540) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{7ADB0815-D6E1-11E9-B86F-5254004A04AF}
Value:
0
(PID) Process:(3540) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3540) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
2
(PID) Process:(3540) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E307090006000E000B0013000E008400
Executable files
97
Suspicious files
35
Text files
2 147
Unknown types
9

Dropped files

PID
Process
Filename
Type
3540iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
3540iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
4028iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab9D00.tmp —
MD5:—
SHA256:—
4028iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar9D01.tmp —
MD5:—
SHA256:—
4028iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab9D12.tmp —
MD5:—
SHA256:—
4028iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar9D13.tmp —
MD5:—
SHA256:—
4028iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab9DB0.tmp —
MD5:—
SHA256:—
4028iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar9DB1.tmp —
MD5:—
SHA256:—
3540iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF93B0694FEB23EFCE.TMP —
MD5:—
SHA256:—
4028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
20
DNS requests
13
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1796
11480082[1].exe
GET
—
13.224.196.81:80
http://sun346.net/app/banner?it=3&fhnid=
US
—
—
whitelisted
2124
powershell.exe
POST
—
52.33.155.26:80
http://logs-01.loggly.com/inputs/1f667d94-35d0-4958-aa21-54e5d3fd784d/tag/browser-assistant/
US
—
—
whitelisted
1796
11480082[1].exe
GET
200
13.224.196.81:80
http://sun346.net/app/banner?it=2&fhnid=
US
html
167 b
whitelisted
1796
11480082[1].exe
GET
200
13.224.196.81:80
http://sun346.net/app/banner?it=1&fhnid=
US
html
167 b
whitelisted
1796
11480082[1].exe
GET
200
13.225.78.105:80
http://pads289.net/app/banner?it=3&fhnid=
US
html
167 b
shared
2596
MsiExec.exe
GET
200
172.217.18.4:80
http://www.google.com/
US
html
12.2 Kb
malicious
2800
powershell.exe
POST
—
52.33.155.26:80
http://logs-01.loggly.com/inputs/1f667d94-35d0-4958-aa21-54e5d3fd784d/tag/browser-assistant/
US
—
—
whitelisted
3596
powershell.exe
POST
200
52.33.155.26:80
http://logs-01.loggly.com/inputs/1f667d94-35d0-4958-aa21-54e5d3fd784d/tag/browser-assistant/
US
text
19 b
whitelisted
1796
11480082[1].exe
GET
200
13.225.78.105:80
http://pads289.net/Content/Site.css
US
text
412 b
shared
4028
iexplore.exe
GET
200
95.101.72.131:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
unknown
compressed
57.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4028
iexplore.exe
13.225.78.87:443
gamefervor.com
—
US
suspicious
3540
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
4028
iexplore.exe
95.101.72.131:80
www.download.windowsupdate.com
Akamai International B.V.
—
whitelisted
2596
MsiExec.exe
172.217.18.4:80
www.google.com
Google Inc.
US
whitelisted
1796
11480082[1].exe
13.224.196.81:80
sun346.net
—
US
suspicious
2124
powershell.exe
52.33.155.26:80
logs-01.loggly.com
Amazon.com, Inc.
US
unknown
3596
powershell.exe
52.33.155.26:80
logs-01.loggly.com
Amazon.com, Inc.
US
unknown
2800
powershell.exe
52.33.155.26:80
logs-01.loggly.com
Amazon.com, Inc.
US
unknown
4088
BrowserAssistant.exe
52.33.155.26:80
logs-01.loggly.com
Amazon.com, Inc.
US
unknown
2624
powershell.exe
52.33.155.26:80
logs-01.loggly.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
gamefervor.com
  • 13.225.78.87
  • 13.225.78.111
  • 13.225.78.27
  • 13.225.78.39
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
x.ss2.us
  • 143.204.98.159
  • 143.204.98.76
  • 143.204.98.221
  • 143.204.98.54
whitelisted
www.download.windowsupdate.com
  • 95.101.72.131
  • 95.101.72.115
whitelisted
www.google.com
  • 172.217.18.4
malicious
pads289.net
  • 13.225.78.105
  • 13.225.78.92
  • 13.225.78.117
  • 13.225.78.91
shared
sun346.net
  • 13.224.196.81
  • 13.224.196.71
  • 13.224.196.30
  • 13.224.196.89
whitelisted
logs-01.loggly.com
  • 52.33.155.26
  • 54.236.79.251
whitelisted
ravenfile.com
  • 174.129.234.58
  • 23.21.85.7
suspicious
www.nevenetet-yasak.com
  • 18.202.152.223
  • 34.250.49.113
  • 52.18.183.31
suspicious

Threats

PID
Process
Class
Message
3576
GameOffer.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (MSIE)
3576
GameOffer.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (MSIE)
3576
GameOffer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3576
GameOffer.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://gamefervor.com:443/api/getisti/11480082?url=https://s3-us-west-1.amazonaws.com/ext-emulator/flow-helper/minigame/installer4.exe&appid=com.tencent.ig