File name:

[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.exe

Full analysis: https://app.any.run/tasks/d1073740-9e18-4a8f-aead-819e53370424
Verdict: Malicious activity
Analysis date: March 16, 2024, 17:48:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

E54FA64D71991F72458208AF7757EE1C

SHA1:

74C35BE74200970A0D0718AACD4C9E8B921587C0

SHA256:

DDC6878081575606569205CE8100EDC151852A5D44928FC8ABABE68EFE062865

SSDEEP:

98304:dbnioLCwmKmpbxNDpnV3b92AXEqnuATJv2eEW8ZRmVwwMYHZ+/bUQX2ExxktYEgA:tjL0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.exe (PID: 116)
      • [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmp (PID: 3996)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.exe (PID: 116)
      • [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmp (PID: 3996)

    • Process drops legitimate windows executable

      • [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmp (PID: 3996)

    • Reads the Windows owner or organization settings

      • [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmp (PID: 3996)

    • Reads the Internet Settings

      • [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmp (PID: 3996)

    • Non-standard symbols in registry

      • [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmp (PID: 3996)

  • INFO

    • Create files in a temporary directory

      • [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.exe (PID: 116)
      • [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmp (PID: 3996)

    • Checks supported languages

      • [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.exe (PID: 116)
      • [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmp (PID: 3996)

    • Reads the computer name

      • [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmp (PID: 3996)

    • Manual execution by a user

      • explorer.exe (PID: 1496)
      • msedge.exe (PID: 1036)

    • Reads CPU info

      • [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmp (PID: 3996)

    • Application launched itself

      • msedge.exe (PID: 480)
      • msedge.exe (PID: 1036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:10:02 05:04:04+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 86016
InitializedDataSize: 65024
UninitializedDataSize: -
EntryPoint: 0x16478
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: FreeTP.Org - Sons Of The Forest Multiplayer Fix
FileDescription: Sons Of The Forest
FileVersion:
LegalCopyright:
ProductName: Sons Of The Forest
ProductVersion: 1-1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
18
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start [freetp.org]sons-of-the-forest-multiplayer-fix-online-v3.2.exe [freetp.org]sons-of-the-forest-multiplayer-fix-online-v3.2.tmp explorer.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs [freetp.org]sons-of-the-forest-multiplayer-fix-online-v3.2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.exe" C:\Users\admin\AppData\Local\Temp\[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.exe
explorer.exe
User:
admin
Company:
FreeTP.Org - Sons Of The Forest Multiplayer Fix
Integrity Level:
HIGH
Description:
Sons Of The Forest
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\[freetp.org]sons-of-the-forest-multiplayer-fix-online-v3.2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
120"C:\Users\admin\AppData\Local\Temp\[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.exe" C:\Users\admin\AppData\Local\Temp\[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.exe—explorer.exe
User:
admin
Company:
FreeTP.Org - Sons Of The Forest Multiplayer Fix
Integrity Level:
MEDIUM
Description:
Sons Of The Forest
Exit code:
3221226540
Version:
Modules
Images
c:\users\admin\appdata\local\temp\[freetp.org]sons-of-the-forest-multiplayer-fix-online-v3.2.exe
c:\windows\system32\ntdll.dll
448"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6a88f598,0x6a88f5a8,0x6a88f5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
480"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://freetp.org/5328-.htmlC:\Program Files\Microsoft\Edge\Application\msedge.exe—[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
584"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1548 --field-trial-handle=1288,i,11602659245319342579,13375991092883825317,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
668"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2268 --field-trial-handle=1288,i,11602659245319342579,13375991092883825317,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1028"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2196 --field-trial-handle=1288,i,11602659245319342579,13375991092883825317,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1036"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate https://freetp.org/5328-.htmlC:\Program Files\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1216"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1340,i,110141418366097314,2251607542831769508,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1496"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
6 831
Read events
6 781
Write events
40
Delete events
10

Modification events

(PID) Process:(3996) [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
9C0F00008253FC2DCA77DA01
(PID) Process:(3996) [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
C0A1385BAAB29E4D4AFA11B76CFBCC20CCE96AE2694F3989471F8DCFF8E79BCD
(PID) Process:(3996) [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(3996) [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication
Operation:writeName:Name
Value:
[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmp
(PID) Process:(3996) [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication
Operation:writeName:ID
Value:
(PID) Process:(3996) [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Sog on forest\SonsOfTheForest_Data\Plugins\x86_64\steam_api64.dll
(PID) Process:(3996) [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
4F08335DB02A6CC24D71D2084776DA2FA09232E8CCA491F8695A28B3D405413A
(PID) Process:(3996) [FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214E4-0000-0000-C000-000000000046} 0xFFFF
Value:
01000000000000004DFF5175CA77DA01
(PID) Process:(480) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(480) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
Executable files
14
Suspicious files
27
Text files
86
Unknown types
24

Dropped files

PID
Process
Filename
Type
116[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.exeC:\Users\admin\AppData\Local\Temp\is-R5E1R.tmp\[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpexecutable
MD5:7300211C571951BE86BE6C6F8CDFC09D
SHA256:E77C3184D90F6E7A1276BB8389ABA06296BE97DEB2E8A3433CA9A537538696DA
3996[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpC:\Users\admin\AppData\Local\Temp\is-FU5IN.tmp\HardDrivePanel.pngimage
MD5:58EB6EB8ADAC870B56618ABCD9C692D4
SHA256:E7ABA4C280E60C5A73CD26884B60E7FC80198937A387038E79138A843EDAE88E
3996[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpC:\Users\admin\AppData\Local\Temp\is-FU5IN.tmp\get_hw_caps.dllexecutable
MD5:2E35D2894DF3B691DBD8E0D4F4C84EFC
SHA256:869079BA362CBC560D673DB290248EC2AA075A74F22A82D90621F1118F8E1C4D
3996[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpC:\Users\admin\AppData\Local\Temp\is-FU5IN.tmp\button.pngimage
MD5:51AF4120D6D22B1126CC87A5143740EF
SHA256:C74FED62141F7E666379A0B00D5B39C86975332CF08151CBE8CAB88EFF2C393C
3996[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpC:\Users\admin\AppData\Local\Temp\is-FU5IN.tmp\HDD.pngimage
MD5:6055FD19D5E3B49EB5F0F55562EA06A4
SHA256:0FD936944E6D3858D5E5AA5C1C9314DB33D9AD8F02FEAD4BFA2E180651446C0B
3996[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpC:\Users\admin\AppData\Local\Temp\is-FU5IN.tmp\innocallback.dllexecutable
MD5:1C55AE5EF9980E3B1028447DA6105C75
SHA256:6AFA2D104BE6EFE3D9A2AB96DBB75DB31565DAD64DD0B791E402ECC25529809F
3996[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpC:\Users\admin\AppData\Local\Temp\is-FU5IN.tmp\Edit.pngimage
MD5:F768E9AA3545815B6EDF0FB4CE78424F
SHA256:56983E8150BB1D01EDB5B1A557DC5E462D7F5896BC0FF4A689468CCC22D95290
3996[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpC:\Users\admin\AppData\Local\Temp\is-FU5IN.tmp\DirFolder.pngimage
MD5:80F54F431EA1DD2D7B90FA27F75142FE
SHA256:A41880120183128F5238B6CB8F8BC27F8E6BC022B4DAAEB1722BF45E6B6F473C
3996[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpC:\Users\admin\AppData\Local\Temp\is-FU5IN.tmp\Workspace.pngimage
MD5:AD51D489414A6AA5FD0AC0DA685E1ED9
SHA256:8223CF843E17737A250B81694A0BE381046ED3C7F78095D27A888636F089EC49
3996[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.tmpC:\Users\admin\AppData\Local\Temp\is-FU5IN.tmp\RequirementsPanel.pngimage
MD5:CD08B361B65C2648BFB126F484CF5758
SHA256:E7D74579124827E5755DB4FAB05DE00A2D13E423E5839975689A8FF139100F70
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
45
DNS requests
50
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
584
msedge.exe
104.21.36.76:443
freetp.org
CLOUDFLARENET
—
unknown
1036
msedge.exe
239.255.255.250:1900
—
—
—
unknown
584
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
584
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
584
msedge.exe
3.162.40.99:443
dlh8c15zw7vfn.cloudfront.net
—
US
unknown
584
msedge.exe
108.138.26.25:443
ghabovethec.info
AMAZON-02
US
unknown
584
msedge.exe
18.244.18.35:443
sandmakingsilver.info
—
US
unknown

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.42.16
whitelisted
freetp.org
  • 104.21.36.76
  • 172.67.190.98
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
dlh8c15zw7vfn.cloudfront.net
  • 3.162.40.99
  • 3.162.40.165
  • 3.162.40.176
  • 3.162.40.22
unknown
sandmakingsilver.info
  • 18.244.18.35
  • 18.244.18.49
  • 18.244.18.62
  • 18.244.18.66
unknown
hilarlymcken.info
  • 188.114.96.3
  • 188.114.97.3
unknown
ghabovethec.info
  • 108.138.26.25
  • 108.138.26.110
  • 108.138.26.86
  • 108.138.26.111
unknown
www.bing.com
  • 2.23.209.165
  • 2.23.209.189
  • 2.23.209.182
  • 2.23.209.185
  • 2.23.209.133
  • 2.23.209.140
  • 2.23.209.179
  • 2.23.209.149
  • 2.23.209.187
whitelisted
ourtshipanditlas.info
  • 13.32.121.76
  • 13.32.121.121
  • 13.32.121.126
  • 13.32.121.46
unknown
pogothere.xyz
  • 188.114.96.3
  • 188.114.97.3
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
[FreeTP.Org]Sons-Of-The-Forest-Multiplayer-Fix-Online-v3.2.exe