URL:

http://download.freemake.net/products/83C7EDEFEEE7B3427DA57671C097DF4B/FreemakeVideoDownloaderSetup.exe?customName=FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.exe

Full analysis: https://app.any.run/tasks/0fd2ffd3-7e1e-4226-bf8f-6caf0cde83a5
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: March 04, 2020, 18:19:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
Indicators:
MD5:

F57D1A8FFA5B90659290D31D812A4C5C

SHA1:

7162955FB7B02A7409D5E4F9091CA0F8BF9E9E69

SHA256:

AF50F6B30E2AF8D9CB86291462717D15F47D722060A304725FFAA5D99751ED50

SSDEEP:

3:N1KaKElLAuIs9aQGRWQThwmxSyHLmhKZIEOAzABf2X2Q/eAYr3OAzABf2X28ibtn:Ca5LQ7TRWQzxSbhxEOWAVs/eAAOWAVJp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 2656)
      • FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp (PID: 2108)

    • Application was dropped or rewritten from another process

      • FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.exe (PID: 3992)
      • FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.exe (PID: 3968)
      • FreemakeVideoDownloaderFull.exe (PID: 1744)
      • FreemakeVideoDownloader.exe (PID: 3640)
      • FreemakeVD.exe (PID: 2560)
      • ProductUpdater.exe (PID: 2392)
      • FreemakeUtilsService.exe (PID: 2216)

    • Starts NET.EXE for service management

      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

    • Changes the autorun value in the registry

      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

    • Loads dropped or rewritten executable

      • regsvr32.exe (PID: 3912)
      • regsvr32.exe (PID: 580)
      • regsvr32.exe (PID: 1780)
      • regsvr32.exe (PID: 376)
      • regsvr32.exe (PID: 916)
      • FreemakeVD.exe (PID: 2560)
      • FreemakeUtilsService.exe (PID: 2216)
      • ProductUpdater.exe (PID: 2392)

    • Registers / Runs the DLL via REGSVR32.EXE

      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

    • Changes settings of System certificates

      • FreemakeVD.exe (PID: 2560)
      • ProductUpdater.exe (PID: 2392)
      • FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp (PID: 2108)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2884)
      • iexplore.exe (PID: 2656)
      • FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.exe (PID: 3992)
      • FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.exe (PID: 3968)
      • FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp (PID: 2108)
      • FreemakeVideoDownloaderFull.exe (PID: 1744)
      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

    • Reads the Windows organization settings

      • FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp (PID: 2108)
      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

    • Reads Windows owner or organization settings

      • FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp (PID: 2108)
      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

    • Reads Internet Cache Settings

      • FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp (PID: 2108)

    • Uses NETSH.EXE for network configuration

      • FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp (PID: 2108)
      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

    • Starts CMD.EXE for commands execution

      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

    • Uses TASKLIST.EXE to query information about running processes

      • cmd.exe (PID: 3428)
      • cmd.exe (PID: 3088)
      • cmd.exe (PID: 3084)
      • cmd.exe (PID: 1544)
      • cmd.exe (PID: 2988)
      • cmd.exe (PID: 2860)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3752)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 916)
      • regsvr32.exe (PID: 3912)
      • regsvr32.exe (PID: 580)
      • regsvr32.exe (PID: 1780)
      • regsvr32.exe (PID: 376)

    • Creates files in the user directory

      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

    • Adds / modifies Windows certificates

      • FreemakeVD.exe (PID: 2560)
      • ProductUpdater.exe (PID: 2392)
      • FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp (PID: 2108)

    • Starts Internet Explorer

      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

    • Executed as Windows Service

      • FreemakeUtilsService.exe (PID: 2216)

    • Reads Environment values

      • ProductUpdater.exe (PID: 2392)
      • FreemakeVD.exe (PID: 2560)

    • Creates files in the program directory

      • FreemakeVD.exe (PID: 2560)
      • ProductUpdater.exe (PID: 2392)

    • Searches for installed software

      • FreemakeVD.exe (PID: 2560)

    • Starts SC.EXE for service management

      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2884)
      • iexplore.exe (PID: 2656)
      • iexplore.exe (PID: 3924)
      • iexplore.exe (PID: 2628)

    • Application launched itself

      • iexplore.exe (PID: 2884)
      • iexplore.exe (PID: 3924)

    • Changes internet zones settings

      • iexplore.exe (PID: 2884)
      • iexplore.exe (PID: 3924)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2884)

    • Application was dropped or rewritten from another process

      • FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp (PID: 3224)
      • FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp (PID: 2108)
      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2884)
      • FreemakeVD.exe (PID: 2560)
      • ProductUpdater.exe (PID: 2392)
      • iexplore.exe (PID: 2628)

    • Loads dropped or rewritten executable

      • FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp (PID: 2108)
      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

    • Creates files in the user directory

      • iexplore.exe (PID: 2884)
      • iexplore.exe (PID: 2628)

    • Dropped object may contain Bitcoin addresses

      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

    • Creates a software uninstall entry

      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

    • Creates files in the program directory

      • FreemakeVideoDownloaderFull.tmp (PID: 2576)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2628)
      • iexplore.exe (PID: 2884)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2628)
      • iexplore.exe (PID: 2884)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2628)

    • Dropped object may contain TOR URL's

      • iexplore.exe (PID: 2628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
105
Monitored processes
49
Malicious processes
16
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe freemakevideodownloadersetup_9eab57bf-deed-be10-55b9-44499db2c35b.exe freemakevideodownloadersetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp no specs freemakevideodownloadersetup_9eab57bf-deed-be10-55b9-44499db2c35b.exe freemakevideodownloadersetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp freemakevideodownloaderfull.exe netsh.exe no specs freemakevideodownloaderfull.tmp netsh.exe no specs net.exe no specs cmd.exe no specs net1.exe no specs taskkill.exe no specs cmd.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs tasklist.exe no specs findstr.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs netsh.exe no specs netsh.exe no specs freemakevideodownloader.exe no specs freemakevd.exe sc.exe no specs sc.exe no specs net.exe no specs iexplore.exe productupdater.exe net1.exe no specs freemakeutilsservice.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
376"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Freemake\COM\1.1\FMMediaFormats.dll"C:\Windows\system32\regsvr32.exe—FreemakeVideoDownloaderFull.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
440"net" start "Freemake Improver"C:\Windows\system32\net.exe—FreemakeVideoDownloaderFull.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
580"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Freemake\COM\1.1\FMMediaUtils.dll"C:\Windows\system32\regsvr32.exe—FreemakeVideoDownloaderFull.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
608tasklist C:\Windows\system32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
916"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Freemake\COM\1.1\FMMediaSource.dll"C:\Windows\system32\regsvr32.exe—FreemakeVideoDownloaderFull.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
940"C:\Windows\system32\netsh.exe" http add urlacl url=http://+:11425/ user=\everyoneC:\Windows\system32\netsh.exe—FreemakeVideoDownloaderFull.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1136C:\Windows\system32\net1 start "Freemake Improver"C:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
1544"C:\Windows\system32\cmd.exe" /C ""C:\Users\admin\AppData\Local\Temp\is-HNFMH.tmp\CheckRunningInstance.cmd""C:\Windows\system32\cmd.exe—FreemakeVideoDownloaderFull.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1744"C:\Users\admin\AppData\Local\Temp\FreemakeVideoDownloaderFull.exe" /LANG=en /dotnet=0 locale=FR /DIR="C:\Program Files\Freemake" /autoinstall C:\Users\admin\AppData\Local\Temp\FreemakeVideoDownloaderFull.exe
FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp
User:
admin
Company:
Ellora Assets Corporation
Integrity Level:
HIGH
Description:
Freemake Video Downloader Setup
Exit code:
0
Version:
3.8.4.68
Modules
Images
c:\users\admin\appdata\local\temp\freemakevideodownloaderfull.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1780"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Freemake\COM\1.1\FMTransformBase.dll"C:\Windows\system32\regsvr32.exe—FreemakeVideoDownloaderFull.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
8 397
Read events
2 229
Write events
4 964
Delete events
1 204

Modification events

(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
2292268318
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30798417
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
310
Suspicious files
46
Text files
202
Unknown types
25

Dropped files

PID
Process
Filename
Type
2884iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF1E8CD77D5EACA979.TMP —
MD5:—
SHA256:—
2884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.exe.qcw5v5x.partial:Zone.Identifier —
MD5:—
SHA256:—
2884iexplore.exeC:\Users\admin\AppData\Local\Temp\CabE5B.tmp —
MD5:—
SHA256:—
2884iexplore.exeC:\Users\admin\AppData\Local\Temp\TarE5C.tmp —
MD5:—
SHA256:—
2884iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\LXR9A16F.txt —
MD5:—
SHA256:—
2884iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\GPLZMY03.txt —
MD5:—
SHA256:—
2656iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.exe.qcw5v5x.partialexecutable
MD5:—
SHA256:—
2656iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b[1].exeexecutable
MD5:—
SHA256:—
2884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{B4603A39-5E44-11EA-972D-5254004A04AF}.datbinary
MD5:—
SHA256:—
2108FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmpC:\Users\admin\AppData\Local\Temp\is-OJHN5.tmp\freemake_dl.dllexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
42
TCP/UDP connections
87
DNS requests
37
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2108
FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp
HEAD
200
94.31.29.8:80
http://download.freemake.net/products/AC7916432EA5EB3611941EC3348668DA/FreemakeVideoDownloaderFull.exe
GB
—
—
whitelisted
2108
FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp
GET
200
34.192.103.139:80
http://installreport.freemake.com/installation/installation_stat.php?id=FreemakeVideoDownloader&language=en&version=3.8.4.68&exit_step=FINISH_ONLINE&is_net_before=1&is_net_after=0&install_type=Full&is_toolbar_checked=false&statistics=1&country=FR&guid={138A905D-3A72-4DA3-B6A0-CBE3D2919849}&errorcode=0&adv=0
US
—
—
suspicious
2576
FreemakeVideoDownloaderFull.tmp
GET
200
34.192.103.139:80
http://installreport.freemake.com/installation/installation_stat.php?id=FreemakeVideoDownloader&language=en&version=3.8.4.68&exit_step=FINISH&is_net_before=&is_net_after=&install_type=Full&is_toolbar_checked=false&statistics=1&country=FR&guid={138A905D-3A72-4DA3-B6A0-CBE3D2919849}&errorcode=0&adv=
US
—
—
suspicious
2108
FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp
GET
200
34.192.103.139:80
http://installreport.freemake.com/installation/installation_stat.php?id=FreemakeVideoDownloader&language=en&version=3.8.4.68&exit_step=START_ONLINE&is_net_before=1&is_net_after=0&install_type=Full&is_toolbar_checked=false&statistics=1&country=FR&guid={138A905D-3A72-4DA3-B6A0-CBE3D2919849}&errorcode=0&adv=0
US
—
—
suspicious
2108
FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp
GET
200
34.192.103.139:80
http://installreport.freemake.com/installation/installation_stat.php?id=FreemakeVideoDownloader&language=en&version=3.8.4.68&exit_step=BINDING_FAILED&is_net_before=1&is_net_after=0&install_type=Full&is_toolbar_checked=false&statistics=1&country=FR&guid={138A905D-3A72-4DA3-B6A0-CBE3D2919849}&errorcode=0&adv=0
US
—
—
suspicious
2108
FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp
GET
200
94.31.29.8:80
http://download.freemake.net/products/AC7916432EA5EB3611941EC3348668DA/FreemakeVideoDownloaderFull.exe
GB
executable
21.6 Mb
whitelisted
2628
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D
US
der
471 b
whitelisted
2628
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D
US
der
471 b
whitelisted
2656
iexplore.exe
GET
200
94.31.29.8:80
http://download.freemake.net/products/83C7EDEFEEE7B3427DA57671C097DF4B/FreemakeVideoDownloaderSetup.exe?customName=FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.exe
GB
executable
987 Kb
whitelisted
2884
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
iexplore.exe
94.31.29.8:80
—
netDNA
GB
malicious
2884
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2884
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2108
FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp
34.192.103.139:80
geoip.freemake.com
Amazon.com, Inc.
US
suspicious
2108
FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp
3.232.136.89:80
releases.freemake.com
—
US
unknown
2108
FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp
34.192.103.139:443
geoip.freemake.com
Amazon.com, Inc.
US
suspicious
2108
FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp
94.31.29.8:80
—
netDNA
GB
malicious
2884
iexplore.exe
204.79.197.200:443
ieonline.microsoft.com
Microsoft Corporation
US
whitelisted
2560
FreemakeVD.exe
34.192.103.139:443
geoip.freemake.com
Amazon.com, Inc.
US
suspicious
2576
FreemakeVideoDownloaderFull.tmp
34.192.103.139:80
geoip.freemake.com
Amazon.com, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
download.freemake.net
  • 93.184.220.66
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
geoip.freemake.com
  • 34.192.103.139
unknown
crl3.digicert.com
  • 93.184.220.29
whitelisted
installreport.freemake.com
  • 34.192.103.139
suspicious
data.freemake.com
  • 34.192.103.139
suspicious
releases.freemake.com
  • 3.232.136.89
  • 3.223.228.43
unknown
ieonline.microsoft.com
  • 204.79.197.200
whitelisted

Threats

PID
Process
Class
Message
2656
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2656
iexplore.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2108
FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp
Misc activity
ADWARE [PTsecurity] PUP.Win32/Freemake.A UserAgent
2108
FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp
Misc activity
ADWARE [PTsecurity] PUP.Win32/Freemake.A UserAgent
2108
FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2108
FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.tmp
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://download.freemake.net/products/83C7EDEFEEE7B3427DA57671C097DF4B/FreemakeVideoDownloaderSetup.exe?customName=FreemakeVideoDownloaderSetup_9eab57bf-deed-be10-55b9-44499db2c35b.exe