URL: | https://cdn.gametop.com/free-games-download/The-Silent-Age.exe |
Full analysis: | https://app.any.run/tasks/9cc8031f-fca6-48aa-bd7c-a251d8e54d75 |
Verdict: | Malicious activity |
Analysis date: | September 05, 2020, 14:40:49 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 820277EAF3621D84E5BAEA583CB1084D |
SHA1: | 09F1E2D13785961A53C29CA636F04D81F7BD1635 |
SHA256: | E2B07F360FAEA0997F52C97A0AFA1A436FD27C58E29992FF722BD9933D55B9C0 |
SSDEEP: | 3:N8cfIzfIK0Oz8KLLlkuTC:2cfmgK0BK3lkuTC |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3300 | "C:\Program Files\Mozilla Firefox\firefox.exe" "https://cdn.gametop.com/free-games-download/The-Silent-Age.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 68.0.1 | ||||
1700 | "C:\Program Files\Mozilla Firefox\firefox.exe" https://cdn.gametop.com/free-games-download/The-Silent-Age.exe | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 68.0.1 | ||||
4088 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.0.1057058201\1168697724" -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 1168 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 1 Version: 68.0.1 | ||||
660 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.3.1042281199\1655022006" -childID 1 -isForBrowser -prefsHandle 1708 -prefMapHandle 1652 -prefsLen 1 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 1728 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 68.0.1 | ||||
1248 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.13.1530786200\774916534" -childID 2 -isForBrowser -prefsHandle 2956 -prefMapHandle 2960 -prefsLen 5996 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 2976 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 68.0.1 | ||||
2512 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1700.20.454057210\2138901820" -childID 3 -isForBrowser -prefsHandle 3672 -prefMapHandle 3132 -prefsLen 6718 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1700 "\\.\pipe\gecko-crash-server-pipe.1700" 3680 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 68.0.1 | ||||
1332 | "C:\Users\admin\Downloads\The-Silent-Age.exe" | C:\Users\admin\Downloads\The-Silent-Age.exe | firefox.exe | |
User: admin Company: GameTop Pte. Ltd. Integrity Level: MEDIUM Description: The Silent Age Setup Exit code: 0 Version: | ||||
2376 | "C:\Users\admin\AppData\Local\Temp\is-B872G.tmp\The-Silent-Age.tmp" /SL5="$80132,189273908,56832,C:\Users\admin\Downloads\The-Silent-Age.exe" | C:\Users\admin\AppData\Local\Temp\is-B872G.tmp\The-Silent-Age.tmp | — | The-Silent-Age.exe |
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.52.0.0 | ||||
1476 | "C:\Users\admin\Downloads\The-Silent-Age.exe" /SPAWNWND=$3017C /NOTIFYWND=$80132 | C:\Users\admin\Downloads\The-Silent-Age.exe | The-Silent-Age.tmp | |
User: admin Company: GameTop Pte. Ltd. Integrity Level: HIGH Description: The Silent Age Setup Exit code: 0 Version: | ||||
3836 | "C:\Users\admin\AppData\Local\Temp\is-4B2PB.tmp\The-Silent-Age.tmp" /SL5="$50186,189273908,56832,C:\Users\admin\Downloads\The-Silent-Age.exe" /SPAWNWND=$3017C /NOTIFYWND=$80132 | C:\Users\admin\AppData\Local\Temp\is-4B2PB.tmp\The-Silent-Age.tmp | The-Silent-Age.exe | |
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.52.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1700 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
1700 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | — | |
MD5:— | SHA256:— | |||
1700 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | — | |
MD5:— | SHA256:— | |||
1700 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm | — | |
MD5:— | SHA256:— | |||
1700 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp | — | |
MD5:— | SHA256:— | |||
1700 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm | — | |
MD5:— | SHA256:— | |||
1700 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp | — | |
MD5:— | SHA256:— | |||
1700 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm | — | |
MD5:— | SHA256:— | |||
1700 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js | text | |
MD5:354459382F30B8994109C88659DFA1F3 | SHA256:E3E8E2B7E7EECA231620D83C70FA5A926E8B9CE74C51F595F71191DC0B50527E | |||
1700 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.bin | binary | |
MD5:5027177F513CDAE07DB2330E1DED5934 | SHA256:0C53F16051E738287A4612F68E296238087627E594CFD6DDFA1FECC2E998328B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3436 | iexplore.exe | GET | 301 | 172.217.22.51:80 | http://www.gametop.com/stats/the-silent-age_install.html | US | html | 258 b | whitelisted |
3436 | iexplore.exe | GET | 200 | 151.139.128.14:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D | US | der | 727 b | whitelisted |
3436 | iexplore.exe | GET | 200 | 151.139.128.14:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D | US | der | 727 b | whitelisted |
1700 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
3436 | iexplore.exe | GET | 200 | 216.58.212.131:80 | http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCHc4Ud72cyewgAAAAAVMtp | US | der | 472 b | whitelisted |
1700 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
3436 | iexplore.exe | GET | 200 | 216.58.212.131:80 | http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D | US | der | 468 b | whitelisted |
1700 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
1700 | firefox.exe | POST | 200 | 172.217.18.3:80 | http://ocsp.pki.goog/gts1o1core | US | der | 472 b | whitelisted |
1700 | firefox.exe | POST | 200 | 172.217.18.3:80 | http://ocsp.pki.goog/gts1o1core | US | der | 472 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1700 | firefox.exe | 2.16.186.112:80 | detectportal.firefox.com | Akamai International B.V. | — | whitelisted |
1700 | firefox.exe | 52.13.211.193:443 | search.services.mozilla.com | Amazon.com, Inc. | US | unknown |
1700 | firefox.exe | 172.217.18.170:443 | safebrowsing.googleapis.com | Google Inc. | US | whitelisted |
1700 | firefox.exe | 2.16.186.49:443 | shavar.services.mozilla.com | Akamai International B.V. | — | whitelisted |
1700 | firefox.exe | 34.215.78.214:443 | incoming.telemetry.mozilla.org | Amazon.com, Inc. | US | unknown |
1700 | firefox.exe | 143.204.201.119:443 | snippets.cdn.mozilla.net | — | US | suspicious |
1700 | firefox.exe | 143.204.201.102:443 | firefox.settings.services.mozilla.com | — | US | suspicious |
3436 | iexplore.exe | 172.217.22.51:443 | www.gametop.com | Google Inc. | US | whitelisted |
3436 | iexplore.exe | 172.217.22.51:80 | www.gametop.com | Google Inc. | US | whitelisted |
1700 | firefox.exe | 172.217.22.46:443 | www.youtube.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
cdn.gametop.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
cds.z2k8t7p3.hwcdn.net |
| malicious |
a1089.dscd.akamai.net |
| whitelisted |
search.services.mozilla.com |
| whitelisted |
search.r53-2.services.mozilla.com |
| whitelisted |
push.services.mozilla.com |
| whitelisted |
autopush.prod.mozaws.net |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
cs9.wac.phicdn.net |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
1048 | svchost.exe | Potentially Bad Traffic | ET INFO Observed DNS Query to .cloud TLD |
1048 | svchost.exe | Potentially Bad Traffic | ET INFO Observed DNS Query to .cloud TLD |