Analysis date (UTC): 7 July 2025, 14:44Analysis environment: Windows 10 Pro, build 19044, x64

games.lol

MD5:000C8B43790D5541965D04615408CA32

SHA1:5D5141DBE1D275D126297E94CD7958A873CD4549

SHA256:B47CBAF9C364A26A0A39964FF35C1C7C59EA0C847C06EBD56A9542021F504CE3

Analysis result

Threat level:Malicious activity

Tags:

loader

Full analysis:Analysis games.lol Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

Reads the date of Windows installation

Gameslolinstaller.exe (PID: 5620)
Gameslolinstaller.exe (PID: 6900)

Reads security settings of Internet Explorer

Gameslolinstaller.exe (PID: 5620)
Gameslolinstaller.exe (PID: 6900)

Creates file in the systems drive root

explorer.exe (PID: 4772)

Executable content was dropped or overwritten

Gameslolinstaller.exe (PID: 5620)
Gameslolinstaller.exe (PID: 6900)

Process drops legitimate windows executable

Gameslolinstaller.exe (PID: 5620)
Gameslolinstaller.exe (PID: 6900)

Starts POWERSHELL.EXE for commands execution

Gameslolinstaller.exe (PID: 1760)
Gameslolinstaller.exe (PID: 6832)

INFO

Application launched itself

chrome.exe (PID: 1328)

Creates files or folders in the user directory

explorer.exe (PID: 4772)
Gameslolinstaller.exe (PID: 5620)
Gameslolinstaller.exe (PID: 1760)

Checks supported languages

Gameslolinstaller.exe (PID: 5620)
Gameslolinstaller.exe (PID: 1760)
Gameslolinstaller.exe (PID: 6832)
Gameslolinstaller.exe (PID: 6900)

Reads the machine GUID from the registry

Gameslolinstaller.exe (PID: 5620)
Gameslolinstaller.exe (PID: 1760)
Gameslolinstaller.exe (PID: 6900)
Gameslolinstaller.exe (PID: 6832)

Create files in a temporary directory

Gameslolinstaller.exe (PID: 5620)
Gameslolinstaller.exe (PID: 6900)

Reads security settings of Internet Explorer

explorer.exe (PID: 4772)

Checks proxy server information

Gameslolinstaller.exe (PID: 5620)
explorer.exe (PID: 4772)
Gameslolinstaller.exe (PID: 1760)
Gameslolinstaller.exe (PID: 6900)
Gameslolinstaller.exe (PID: 6832)

Reads the computer name

Gameslolinstaller.exe (PID: 1760)
Gameslolinstaller.exe (PID: 5620)
Gameslolinstaller.exe (PID: 6900)
Gameslolinstaller.exe (PID: 6832)

Reads the software policy settings

explorer.exe (PID: 4772)
Gameslolinstaller.exe (PID: 1760)
Gameslolinstaller.exe (PID: 6900)
Gameslolinstaller.exe (PID: 5620)
Gameslolinstaller.exe (PID: 6832)

Reads Environment values

Gameslolinstaller.exe (PID: 1760)
Gameslolinstaller.exe (PID: 6832)

Disables trace logs

Gameslolinstaller.exe (PID: 1760)
Gameslolinstaller.exe (PID: 6832)

Creates files in the program directory

Gameslolinstaller.exe (PID: 1760)

Executable content was dropped or overwritten

chrome.exe (PID: 1328)

Threats

PID	Process	Class	Message
5928	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
5928	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
5928	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Global content delivery network (unpkg .com)
5928	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
5928	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
—	—	Potentially Bad Traffic	ET INFO Executable served from Amazon S3
—	—	Potential Corporate Privacy Violation	ET INFO PE EXE or DLL Windows file download HTTP
—	—	Possibly Unwanted Program Detected	ET ADWARE_PUP Win32/MobiGame Install Stats Checkin M1
—	—	Possibly Unwanted Program Detected	ET ADWARE_PUP Win32/MobiGame Install Stats Checkin M1
—	—	Possibly Unwanted Program Detected	ET ADWARE_PUP Win32/MobiGame Install Stats Checkin M1

Rows per page