URL:

https://exagear-windows-emulator.en.softonic.com/android

Full analysis: https://app.any.run/tasks/d92e177e-e46f-48d4-801c-4f041d594efa
Verdict: Malicious activity
Analysis date: January 28, 2024, 14:47:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

3C5E7B5BDCBE2DAEA76591712026011C

SHA1:

0002C2FCC4243FDFCF0684AC7BDF67116BD2C08B

SHA256:

8ED00B27783411C301E18715367FC9935FF556200DD0C8097F51B1251525A8FF

SSDEEP:

3:N8yHSqJE27vHLGKSHBn:28SyE2TLGKQBn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 1036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1036"C:\Program Files\Internet Explorer\iexplore.exe" "https://exagear-windows-emulator.en.softonic.com/android"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1768"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1036 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
17 232
Read events
17 128
Write events
96
Delete events
8

Modification events

(PID) Process:(1036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(1036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(1036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(1036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1036) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
44
Text files
33
Unknown types
0

Dropped files

PID
Process
Filename
Type
1768iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_A3BDBA792161F0ADEE935E6E6327D8F9binary
MD5:879948215A11F81D5F728472833A5B51
SHA256:FB4D50F91F5AE26E525A2BDB11CA02C026407ACDE25C3B5367C8B2C027113D13
1768iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\48946DEA5580C3F43660391B918DD323_6B6142C197A95FBFE3791BA39C0CAFB4binary
MD5:B1DF2788B25588567888DEEA03841EAF
SHA256:E5E0A2B5BD15C120072A9DDEEA3DBECA0D73EE8557326CEAACA4DA5A1D24618B
1768iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\48946DEA5580C3F43660391B918DD323_6B6142C197A95FBFE3791BA39C0CAFB4binary
MD5:37E0CA5F339C207E7AE884CAF078A3F1
SHA256:7B2F04175132FFA59774E11EEB8BE4D16D77723B66D9835E74136B1E5956523B
1768iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\android[1].htmhtml
MD5:CFA7A8F3A6B286CEC721C3B77801F706
SHA256:DED88B153535451D75D5A83995C6184570FBD13E64E2685BA782782D2FF4E44D
1768iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\S070X2J8.txttext
MD5:7EAFAC2F6B1C65B1D69F79A693CE2DD0
SHA256:B6704E5C39249B84CFA4FF9164CC11CF053C5B7AFADED0639A927F42CE736A6E
1768iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:6C497ACFC2739658CEC5893324A1D125
SHA256:10252CC794CDE61332C13C3663447CFF7ED487B0968C9F9FC2283B329CA4861D
1768iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_A3BDBA792161F0ADEE935E6E6327D8F9binary
MD5:3C63B539B36A87C0D8D2AA0A382DE29A
SHA256:93FDC2D5241B9030612509E9FCDEBA9EFBB73A8CA0F754E2499FFE127795F466
1768iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:ECF089CEA645ED4D9B859EF636F858D5
SHA256:E76DEC31CFE475DB12A30E2C3152EB65593DE111B71134F5D206C9B06E919351
1768iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:6BAFC5026413A05F378E075281A32CE0
SHA256:673A17C0E8F2D6BA6B2937C4383ECD7EE09E8A8A4A2969A145BAE7BF4ACD611C
1768iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:1169EC1727338099288D27CD428837E9
SHA256:1E60FB0963D98728BFAC53273FCB7A0EF2BB39B9C9DA9521BC575C33DC6B399C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
99
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1768
iexplore.exe
GET
304
184.24.77.206:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e16ea86c3a909a98
unknown
—
—
unknown
1768
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEQD9GcemSPIwhTQbyW%2FJ4FbI
unknown
binary
2.18 Kb
unknown
1768
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
unknown
1768
iexplore.exe
GET
200
184.24.77.206:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3ecbecc82f68617c
unknown
compressed
65.2 Kb
unknown
1768
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT8p55LRlX%2BveM4oDlzhIhnAZ%2Ft2wQUOgqMHHdZKeoW9pk%2Foxez3ykRkzoCEH5DKbP5yUM4od3UWW8S4iQ%3D
unknown
binary
471 b
unknown
1768
iexplore.exe
GET
200
18.245.39.64:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
unknown
binary
1.49 Kb
unknown
1768
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
unknown
binary
471 b
unknown
1768
iexplore.exe
GET
200
184.24.77.206:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a4f23700b4b80c4c
unknown
compressed
65.2 Kb
unknown
1768
iexplore.exe
GET
—
184.24.77.206:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?eba064c166edb349
unknown
—
—
unknown
1768
iexplore.exe
GET
—
184.24.77.206:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?2c5e6309f900eb4a
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1768
iexplore.exe
35.227.233.104:443
exagear-windows-emulator.en.softonic.com
GOOGLE
US
unknown
1768
iexplore.exe
184.24.77.206:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1768
iexplore.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
1768
iexplore.exe
172.217.16.196:443
www.google.com
GOOGLE
US
whitelisted
1768
iexplore.exe
172.217.23.104:443
www.googletagmanager.com
GOOGLE
US
unknown
1768
iexplore.exe
151.101.1.91:443
sc.sftcdn.net
FASTLY
US
unknown
1768
iexplore.exe
142.250.186.98:443
securepubads.g.doubleclick.net
GOOGLE
US
unknown
1768
iexplore.exe
18.66.192.90:443
sdk.privacy-center.org
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
exagear-windows-emulator.en.softonic.com
  • 35.227.233.104
unknown
ctldl.windowsupdate.com
  • 184.24.77.206
  • 184.24.77.194
  • 184.24.77.173
  • 184.24.77.174
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
sdk.privacy-center.org
  • 18.66.192.90
  • 18.66.192.80
  • 18.66.192.23
  • 18.66.192.42
shared
www.googletagmanager.com
  • 172.217.23.104
whitelisted
securepubads.g.doubleclick.net
  • 142.250.186.98
whitelisted
www.google.com
  • 172.217.16.196
whitelisted
softonic.com
  • 35.227.233.104
whitelisted
sc.sftcdn.net
  • 151.101.1.91
  • 151.101.65.91
  • 151.101.129.91
  • 151.101.193.91
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://exagear-windows-emulator.en.softonic.com/android