File name:

State.of.Survival.Parkour.PC.V1.0_d45b8af98f.exe

Full analysis: https://app.any.run/tasks/3437bd65-19e9-4f07-a04e-f259bf0a7800
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 03, 2025, 12:43:08
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
inno
installer
antivm
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

3C89DC782FEE8CC92B530E524C814622

SHA1:

A5309B45F02AB833B9E926E640260AF0268AB643

SHA256:

874FCC4F0A8143E02D75A509E6CA152620BDAD0A8BD2DE4A9131F66CB514D20F

SSDEEP:

98304:Xkn/wao5HwRVHkKzUcu1SnKOkeohmytGPNtFmOagQbHJ5y:gviyaH6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • PC-Launcher.exe (PID: 6640)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • sspk_d45b8af98f.exe (PID: 1040)
      • sspk_d45b8af98f.tmp (PID: 1568)
      • PC-Launcher.exe (PID: 6640)
      • 7za.exe (PID: 1676)

    • Reads the Windows owner or organization settings

      • sspk_d45b8af98f.tmp (PID: 1568)

    • Creates file in the systems drive root

      • sspk_d45b8af98f.tmp (PID: 1568)

    • Process drops legitimate windows executable

      • sspk_d45b8af98f.tmp (PID: 1568)
      • 7za.exe (PID: 1676)

    • The process drops C-runtime libraries

      • sspk_d45b8af98f.tmp (PID: 1568)
      • 7za.exe (PID: 1676)

    • There is functionality for taking screenshot (YARA)

      • sspk_d45b8af98f.tmp (PID: 1568)
      • PC-Launcher.exe (PID: 6640)

    • Searches for installed software

      • sspk_d45b8af98f.tmp (PID: 1568)

    • Drops 7-zip archiver for unpacking

      • sspk_d45b8af98f.tmp (PID: 1568)

    • The process checks if it is being run in the virtual environment

      • PC-Launcher.exe (PID: 6640)
      • sspc.exe (PID: 5324)

    • Executes as Windows Service

      • WmiApSrv.exe (PID: 4436)

    • There is functionality for VM detection antiVM strings (YARA)

      • PC-Launcher.exe (PID: 6640)

    • The process creates files with name similar to system file names

      • 7za.exe (PID: 1676)

    • Reads security settings of Internet Explorer

      • TQMCenter_64.exe (PID: 2896)

    • Reads the date of Windows installation

      • TQMCenter_64.exe (PID: 2896)

    • The process deletes folder without confirmation

      • TQMCenter_64.exe (PID: 2896)

    • Starts CMD.EXE for commands execution

      • TQMCenter_64.exe (PID: 2896)

    • Reads the BIOS version

      • sspc.exe (PID: 5324)

    • Connects to unusual port

      • sspc.exe (PID: 5324)

    • Process requests binary or script from the Internet

      • sspc.exe (PID: 5324)

  • INFO

    • Reads CPU info

      • State.of.Survival.Parkour.PC.V1.0_d45b8af98f.exe (PID: 3332)
      • sspk_d45b8af98f.tmp (PID: 1568)
      • PC-Launcher.exe (PID: 6640)
      • sspc.exe (PID: 5324)

    • Checks supported languages

      • State.of.Survival.Parkour.PC.V1.0_d45b8af98f.exe (PID: 3332)
      • sspk_d45b8af98f.exe (PID: 1040)
      • sspk_d45b8af98f.tmp (PID: 1568)
      • Launcher.exe (PID: 5048)
      • PC-Launcher.exe (PID: 6640)
      • 7za.exe (PID: 1676)
      • sspc.exe (PID: 5324)
      • UnityCrashHandler64.exe (PID: 856)
      • TQMCenter_64.exe (PID: 2896)

    • Reads the machine GUID from the registry

      • State.of.Survival.Parkour.PC.V1.0_d45b8af98f.exe (PID: 3332)
      • sspk_d45b8af98f.tmp (PID: 1568)
      • PC-Launcher.exe (PID: 6640)
      • sspc.exe (PID: 5324)

    • Create files in a temporary directory

      • State.of.Survival.Parkour.PC.V1.0_d45b8af98f.exe (PID: 3332)
      • sspk_d45b8af98f.exe (PID: 1040)
      • sspk_d45b8af98f.tmp (PID: 1568)
      • PC-Launcher.exe (PID: 6640)
      • sspc.exe (PID: 5324)

    • Reads the computer name

      • State.of.Survival.Parkour.PC.V1.0_d45b8af98f.exe (PID: 3332)
      • sspk_d45b8af98f.tmp (PID: 1568)
      • 7za.exe (PID: 1676)
      • PC-Launcher.exe (PID: 6640)
      • sspc.exe (PID: 5324)
      • TQMCenter_64.exe (PID: 2896)

    • Reads the software policy settings

      • slui.exe (PID: 1164)
      • slui.exe (PID: 2772)
      • sspc.exe (PID: 5324)

    • Creates files in the program directory

      • sspk_d45b8af98f.tmp (PID: 1568)
      • 7za.exe (PID: 1676)
      • PC-Launcher.exe (PID: 6640)
      • sspc.exe (PID: 5324)
      • TQMCenter_64.exe (PID: 2896)

    • Compiled with Borland Delphi (YARA)

      • sspk_d45b8af98f.tmp (PID: 1568)
      • sspk_d45b8af98f.exe (PID: 1040)

    • Detects InnoSetup installer (YARA)

      • sspk_d45b8af98f.exe (PID: 1040)
      • sspk_d45b8af98f.tmp (PID: 1568)

    • Checks proxy server information

      • slui.exe (PID: 2772)
      • PC-Launcher.exe (PID: 6640)
      • sspc.exe (PID: 5324)

    • Creates a software uninstall entry

      • sspk_d45b8af98f.tmp (PID: 1568)

    • The sample compiled with chinese language support

      • sspk_d45b8af98f.tmp (PID: 1568)
      • PC-Launcher.exe (PID: 6640)
      • 7za.exe (PID: 1676)

    • The sample compiled with english language support

      • sspk_d45b8af98f.tmp (PID: 1568)
      • 7za.exe (PID: 1676)

    • Creates files or folders in the user directory

      • PC-Launcher.exe (PID: 6640)
      • sspc.exe (PID: 5324)

    • Qt framework related mutex has been found

      • PC-Launcher.exe (PID: 6640)

    • Reads Environment values

      • sspc.exe (PID: 5324)

    • Process checks computer location settings

      • sspc.exe (PID: 5324)
      • TQMCenter_64.exe (PID: 2896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:04:01 06:45:40+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.29
CodeSize: 1303552
InitializedDataSize: 1168384
UninitializedDataSize: -
EntryPoint: 0x112c3c
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.4
ProductVersionNumber: 1.0.0.4
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: FunPlus, Inc.
FileDescription: State of Survival
FileVersion: 1.0.0.4
InternalName: State.of.Survival
LegalCopyright: Copyright (C) 2010-2022 FunPlus, Inc.
OriginalFileName: sospc.exe
ProductName: State of Survival
ProductVersion: 1.0.0.4
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
18
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start state.of.survival.parkour.pc.v1.0_d45b8af98f.exe sppextcomobj.exe no specs slui.exe slui.exe sspk_d45b8af98f.exe sspk_d45b8af98f.tmp launcher.exe no specs pc-launcher.exe wmiapsrv.exe no specs 7za.exe conhost.exe no specs sspc.exe unitycrashhandler64.exe no specs tqmcenter_64.exe no specs cmd.exe no specs conhost.exe no specs svchost.exe state.of.survival.parkour.pc.v1.0_d45b8af98f.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
856"C:\Program Files (x86)\FunPlus\SOS - Last Warrior\nGame\1.23.700.1561\UnityCrashHandler64.exe" --attach 5324 2066390847488C:\Program Files (x86)\FunPlus\SOS - Last Warrior\nGame\1.23.700.1561\UnityCrashHandler64.exe—sspc.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\program files (x86)\funplus\sos - last warrior\ngame\1.23.700.1561\unitycrashhandler64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1040C:\Users\admin\AppData\Local\Temp\sspk_d45b8af98f.exeC:\Users\admin\AppData\Local\Temp\sspk_d45b8af98f.exe
State.of.Survival.Parkour.PC.V1.0_d45b8af98f.exe
User:
admin
Company:
FunPlus, Inc.
Integrity Level:
HIGH
Description:
SOS - Last Warrior Installer
Exit code:
0
Version:
1.9.0.208
Modules
Images
c:\users\admin\appdata\local\temp\sspk_d45b8af98f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1164"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1568"C:\Users\admin\AppData\Local\Temp\is-OCLLP.tmp\sspk_d45b8af98f.tmp" /SL5="$A0162,64978647,1142784,C:\Users\admin\AppData\Local\Temp\sspk_d45b8af98f.exe" C:\Users\admin\AppData\Local\Temp\is-OCLLP.tmp\sspk_d45b8af98f.tmp
sspk_d45b8af98f.exe
User:
admin
Company:
FunPlus, Inc.
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ocllp.tmp\sspk_d45b8af98f.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
1676"C:\Program Files (x86)\FunPlus\SOS - Last Warrior\Plugin\7z.21.07\7za.exe" x -aoa -bsp2 -bse1 -bso0 "C:/Program Files (x86)/FunPlus/SOS - Last Warrior/download/ngame/sspk_global_1.23.700.1561_43748af191da05b93e3a6ac2155441c9.7z" "-oC:/Program Files (x86)/FunPlus/SOS - Last Warrior/nGame/1.23.700.1561"C:\Program Files (x86)\FunPlus\SOS - Last Warrior\Plugin\7z.21.07\7za.exe
PC-Launcher.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
23.01
Modules
Images
c:\program files (x86)\funplus\sos - last warrior\plugin\7z.21.07\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7za.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2772C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2896"C:\Program Files (x86)\FunPlus\SOS - Last Warrior\nGame\1.23.700.1561\tqm64\TQMCenter_64.exe"C:\Program Files (x86)\FunPlus\SOS - Last Warrior\nGame\1.23.700.1561\TQM64\TQMCenter_64.exe—sspc.exe
User:
admin
Company:
Tencent
Integrity Level:
HIGH
Description:
Crashot TQM Center
Version:
2.0.10.704
Modules
Images
c:\program files (x86)\funplus\sos - last warrior\ngame\1.23.700.1561\tqm64\tqmcenter_64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3332"C:\Users\admin\AppData\Local\Temp\State.of.Survival.Parkour.PC.V1.0_d45b8af98f.exe" C:\Users\admin\AppData\Local\Temp\State.of.Survival.Parkour.PC.V1.0_d45b8af98f.exe
explorer.exe
User:
admin
Company:
FunPlus, Inc.
Integrity Level:
HIGH
Description:
State of Survival
Exit code:
0
Version:
1.0.0.4
Modules
Images
c:\users\admin\appdata\local\temp\state.of.survival.parkour.pc.v1.0_d45b8af98f.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
17 934
Read events
17 817
Write events
117
Delete events
0

Modification events

(PID) Process:(1568) sspk_d45b8af98f.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids
Operation:writeName:SOS-LastWarriorFile.myp
Value:
(PID) Process:(1568) sspk_d45b8af98f.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\Launcher.exe\SupportedTypes
Operation:writeName:.myp
Value:
(PID) Process:(1568) sspk_d45b8af98f.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AFDA3520-2432-44F4-A77B-BF23077701CC}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.2.0
(PID) Process:(1568) sspk_d45b8af98f.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AFDA3520-2432-44F4-A77B-BF23077701CC}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files (x86)\FunPlus\SOS - Last Warrior
(PID) Process:(1568) sspk_d45b8af98f.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AFDA3520-2432-44F4-A77B-BF23077701CC}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\FunPlus\SOS - Last Warrior\
(PID) Process:(1568) sspk_d45b8af98f.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AFDA3520-2432-44F4-A77B-BF23077701CC}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
FunPlus, Inc.\SOS - Last Warrior
(PID) Process:(1568) sspk_d45b8af98f.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AFDA3520-2432-44F4-A77B-BF23077701CC}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(1568) sspk_d45b8af98f.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AFDA3520-2432-44F4-A77B-BF23077701CC}_is1
Operation:writeName:Inno Setup: Language
Value:
english
(PID) Process:(1568) sspk_d45b8af98f.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AFDA3520-2432-44F4-A77B-BF23077701CC}_is1
Operation:writeName:DisplayName
Value:
SOS - Last Warrior 1.9.0.208
(PID) Process:(1568) sspk_d45b8af98f.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AFDA3520-2432-44F4-A77B-BF23077701CC}_is1
Operation:writeName:DisplayIcon
Value:
D:\Jenkins\WorkSpace\workspace\SS-Client-Production\Script\setup_copy\setup_icon.ico
Executable files
245
Suspicious files
2 305
Text files
211
Unknown types
1

Dropped files

PID
Process
Filename
Type
3332State.of.Survival.Parkour.PC.V1.0_d45b8af98f.exeC:\Users\admin\AppData\Local\Temp\sspk_tmp.dl —
MD5:—
SHA256:—
3332State.of.Survival.Parkour.PC.V1.0_d45b8af98f.exeC:\Users\admin\AppData\Local\Temp\sspk_d45b8af98f.exe —
MD5:—
SHA256:—
1568sspk_d45b8af98f.tmpC:\Users\admin\AppData\Local\Temp\is-K22K5.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
1568sspk_d45b8af98f.tmpC:\Program Files (x86)\FunPlus\SOS - Last Warrior\uninstall\FPXInstaller.dllexecutable
MD5:9758C8ED02D6394B0A5AD9FFD2DE4A7D
SHA256:82A28CA2B8F042E6FD4216BCEA60B1D8F4179E146F0BEE4AB26B9F659F366142
1568sspk_d45b8af98f.tmpC:\Program Files (x86)\FunPlus\SOS - Last Warrior\uninstall\is-KK2EQ.tmpexecutable
MD5:9758C8ED02D6394B0A5AD9FFD2DE4A7D
SHA256:82A28CA2B8F042E6FD4216BCEA60B1D8F4179E146F0BEE4AB26B9F659F366142
1568sspk_d45b8af98f.tmpC:\Program Files (x86)\FunPlus\SOS - Last Warrior\is-HL90C.tmpexecutable
MD5:81CCBD628F66AA6230D08FAED9262EAF
SHA256:D2C05FC1683A7376BA42B7AC3A4968201F16CB5428A2C263DC4C3214F9951466
1568sspk_d45b8af98f.tmpC:\Program Files (x86)\FunPlus\SOS - Last Warrior\1.9.0.208\is-F8OLS.tmpexecutable
MD5:4104F6CE0C03244245FA8514ACD42750
SHA256:EB8A69D363A71AA1E2088E52FB8E290D7E5F086C9E349138ED074846A9C2FE39
1568sspk_d45b8af98f.tmpC:\Program Files (x86)\FunPlus\SOS - Last Warrior\1.9.0.208\is-GK4RA.tmpexecutable
MD5:9633000349E44E076B7752BC1CA51817
SHA256:39A91796FAFE9D2EFC2CEA0DE239179A3A2D406EA482AF310710E6F5FED00083
1568sspk_d45b8af98f.tmpC:\Program Files (x86)\FunPlus\SOS - Last Warrior\Launcher.exeexecutable
MD5:81CCBD628F66AA6230D08FAED9262EAF
SHA256:D2C05FC1683A7376BA42B7AC3A4968201F16CB5428A2C263DC4C3214F9951466
1568sspk_d45b8af98f.tmpC:\Program Files (x86)\FunPlus\SOS - Last Warrior\uninstall\skin.zipcompressed
MD5:4AA47B752E941B73B4C64C30B3840E05
SHA256:037121DDDDB9D9ED13BAF5F0F0050A37D6BA3986BD476F210EAD2C913A8CCD83
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
118
DNS requests
52
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4488
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
756
lsass.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D
unknown
—
—
whitelisted
756
lsass.exe
GET
200
18.245.65.219:80
http://ocsp.r2m02.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAuRG10w2KRc8tGcQyZ7q2M%3D
unknown
—
—
whitelisted
4488
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
unknown
—
—
whitelisted
5324
sspc.exe
GET
200
184.24.77.39:80
http://ss-global-cdn.akamaized.net/language/bin/master/1.23.700.6/language_en.json.bin
unknown
—
—
whitelisted
756
lsass.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3332
State.of.Survival.Parkour.PC.V1.0_d45b8af98f.exe
44.231.51.107:443
kg-logagent-ss.kingsgroupgames.com
AMAZON-02
US
unknown
3332
State.of.Survival.Parkour.PC.V1.0_d45b8af98f.exe
2.16.168.108:443
userplatform-download.akamaized.net
Akamai International B.V.
RU
whitelisted
6544
svchost.exe
40.126.31.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.172.255.217:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
google.com
  • 142.250.185.142
whitelisted
kg-logagent-ss.kingsgroupgames.com
  • 44.231.51.107
  • 54.148.184.207
unknown
userplatform-download.akamaized.net
  • 2.16.168.108
  • 2.16.168.123
  • 23.48.23.21
  • 23.48.23.13
whitelisted
login.live.com
  • 40.126.31.130
  • 40.126.31.69
  • 20.190.159.2
  • 20.190.159.0
  • 20.190.159.68
  • 40.126.31.71
  • 40.126.31.131
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.172.255.217
  • 20.198.162.76
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted

Threats

PID
Process
Class
Message
6640
PC-Launcher.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
State.of.Survival.Parkour.PC.V1.0_d45b8af98f.exe