analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe

Full analysis: https://app.any.run/tasks/b7941540-c9ad-4ca6-ba6c-978a7a5be55c
Verdict: Malicious activity
Analysis date: March 31, 2023, 23:45:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

2CFF3887C7DA60C8EB27F5B1A80B2D1A

SHA1:

D4C82FCB81C8E04EB72C5C1AF57682D93C386DFE

SHA256:

151668EDF7A10B2A3E0C03D7373FE0BC891F75BB524CE33563B4E919EF2A22A6

SSDEEP:

196608:kS/gAzmxslo9GXzu7/72qe/zscv6WRR0dtt+wR3DhQnRqtoGZg70bQDxvfHjl:kcCCo7/Re/wK6WRudtt+gQnRXgsDx3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • GameCenter.exe (PID: 3232)

  • SUSPICIOUS

    • Detected use of alternative data streams (AltDS)

      • BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe (PID: 2640)
      • GameCenter.exe (PID: 3232)

    • Reads settings of System Certificates

      • BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe (PID: 2640)

    • Reads the Internet Settings

      • BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe (PID: 2640)
      • GameCenter.exe (PID: 3232)

    • Checks Windows Trust Settings

      • BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe (PID: 2640)

    • Reads security settings of Internet Explorer

      • BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe (PID: 2640)

    • Executable content was dropped or overwritten

      • BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe (PID: 2640)

    • Searches for installed software

      • GameCenter.exe (PID: 3232)

    • Connects to unusual port

      • GameCenter.exe (PID: 3232)

  • INFO

    • Reads the machine GUID from the registry

      • BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe (PID: 2640)
      • GameCenter.exe (PID: 3232)
      • wmpnscfg.exe (PID: 3228)

    • The process checks LSA protection

      • BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe (PID: 2640)
      • GameCenter.exe (PID: 3232)
      • wmpnscfg.exe (PID: 3228)

    • Checks supported languages

      • GameCenter.exe (PID: 3232)
      • BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe (PID: 2640)
      • wmpnscfg.exe (PID: 3228)

    • Checks proxy server information

      • BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe (PID: 2640)

    • Reads the computer name

      • BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe (PID: 2640)
      • GameCenter.exe (PID: 3232)
      • wmpnscfg.exe (PID: 3228)

    • Creates files or folders in the user directory

      • GameCenter.exe (PID: 3232)
      • BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe (PID: 2640)

    • Process checks computer location settings

      • GameCenter.exe (PID: 3232)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3228)

    • [YARA] Network interface manipulation strings were found

      • GameCenter.exe (PID: 3232)

    • Create files in a temporary directory

      • BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe (PID: 2640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (64.2)
.dll | Win32 Dynamic Link Library (generic) (15.6)
.exe | Win32 Executable (generic) (10.6)
.exe | Generic Win/DOS Executable (4.7)
.exe | DOS Executable Generic (4.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:03:29 07:32:03+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 12423168
InitializedDataSize: 28672
UninitializedDataSize: 25886720
EntryPoint: 0x24892f0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 4.0.1714.63306
ProductVersionNumber: 4.0.1714.63306
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: VK Play LLC
FileDescription: GameCenter
FileVersion: 4.0.1714.63306
LegalCopyright: Copyright (C) 2023 VK Play LLC
OriginalFileName: GameCenter.exe
ProductName: GameCenter
ProductVersion: 4.0.1714.63306

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 29-Mar-2023 07:32:03
Detected languages:
  • English - United States
CompanyName: VK Play LLC
FileDescription: GameCenter
FileVersion: 4.0.1714.63306
LegalCopyright: Copyright (C) 2023 VK Play LLC
OriginalFilename: GameCenter.exe
ProductName: GameCenter
ProductVersion: 4.0.1714.63306

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 29-Mar-2023 07:32:03
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x018B0000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x018B1000
0x00BD9000
0x00BD9000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99999
.rsrc
0x0248A000
0x00007000
0x00006C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.48593

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.33982
1376
Latin 1 / Western European
English - United States
RT_MANIFEST
2
7.7275
1067
Latin 1 / Western European
English - United States
RT_ICON
3
7.78984
1592
Latin 1 / Western European
English - United States
RT_ICON
4
7.88551
2520
Latin 1 / Western European
English - United States
RT_ICON
5
7.88677
3468
Latin 1 / Western European
English - United States
RT_ICON
6
7.92774
6786
Latin 1 / Western European
English - United States
RT_ICON
7
7.80665
5123
Latin 1 / Western European
English - United States
RT_ICON
4088
7.07276
212
Latin 1 / Western European
UNKNOWN
RT_STRING
4089
7.74417
744
Latin 1 / Western European
UNKNOWN
RT_STRING
4090
7.74084
824
Latin 1 / Western European
UNKNOWN
RT_STRING

Imports

KERNEL32.DLL
advapi32.dll
crypt32.dll
netapi32.dll
ntdll.dll
ole32.dll
oleaut32.dll
psapi.dll
shell32.dll
user32.dll

Exports

Title
Ordinal
Address
dbkFCallWrapperAddr
1
0x0007D628
__dbk_fcall_wrapper
2
0x0000BDC8
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start battleteams2loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe gamecenter.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2640"C:\Users\admin\AppData\Local\Temp\BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe" C:\Users\admin\AppData\Local\Temp\BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe
explorer.exe
User:
admin
Company:
VK Play LLC
Integrity Level:
MEDIUM
Description:
GameCenter
Exit code:
0
Version:
4.0.1714.63306
Modules
Images
c:\users\admin\appdata\local\temp\battleteams2loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
3232"C:\Users\admin\AppData\Local\GameCenter\GameCenter.exe" -startedbysetup "installer=C:\Users\admin\AppData\Local\Temp\BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe" game=0.2016988 -removeifinstallcanceledC:\Users\admin\AppData\Local\GameCenter\GameCenter.exe
BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe
User:
admin
Company:
VK Play LLC
Integrity Level:
MEDIUM
Description:
GameCenter.exe
Version:
4.0.1714.63306
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\local\gamecenter\gamecenter.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\d3d9.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3228"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
25 642
Read events
25 534
Write events
102
Delete events
6

Modification events

(PID) Process:(2640) BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2640) BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2640) BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2640) BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2640) BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2640) BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2640) BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3232) GameCenter.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Explorer.EXE
(PID) Process:(2640) BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2640) BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
24
Suspicious files
28
Text files
34
Unknown types
34

Dropped files

PID
Process
Filename
Type
2640BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeC:\Users\admin\AppData\Local\GameCenter\icudtl.dat —
MD5:—
SHA256:—
2640BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeC:\Users\admin\AppData\Local\GameCenter\bigup2.dllexecutable
MD5:386C2F67BC56D07E7D9718346A174F4A
SHA256:ACB411488EE5553344AAFF488A82C5C0355B7D248179B5E8CEB72340CC53F1A9
2640BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeC:\Users\admin\AppData\Local\GameCenter\GameIcon0.2016988.icoimage
MD5:5F7C3B5821E9758E783E0E0912D5E060
SHA256:805B4C1CAB106CAF2F33D15FB7C8849436DD2535457E8225938982EDB667D5F3
2640BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeC:\Users\admin\AppData\Local\GameCenter\main.logtext
MD5:ADBEB2997E74F91AF516122678AFC49B
SHA256:98444B8342E8FE2D91EE53C5EFDCA2C491EFC6F39C5E7201C64E46203524BD1A
2640BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeC:\Users\admin\AppData\Local\GameCenter\writefiletest_2640_2588binary
MD5:0D61F8370CAD1D412F80B84D143E1257
SHA256:6B23C0D5F35D1B11F9B683F0B0A617355DEB11277D91AE091D399C655B87940D
2640BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeC:\Users\admin\AppData\Local\GameCenter\HG64.exeexecutable
MD5:DE4C4FE9BD067A4775D9F1DA45DA59E9
SHA256:B329AC0B239741D8D88F651F04164D679B1552FD08D9299BE65E01572C0E13BC
2640BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeC:\Users\admin\AppData\Local\GameCenter\GameCenter.exeexecutable
MD5:AC7638544BFEF6832C819314180CD7A9
SHA256:6EEAB692FD601FE5694746B6F53444F09BF3BB0973234BCF33E39519DF7A8B97
2640BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeC:\Users\admin\AppData\Local\GameCenter\gclay.dllexecutable
MD5:809F4E8BE1D450DD040008B965FF55BE
SHA256:1D8BFB3C89CAFB01F10F4863964AFA01EA4A0544D0BF4AF66C7DF85CB854CB05
2640BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeC:\Users\admin\AppData\Local\GameCenter\GCLay64.dllexecutable
MD5:20E098AC84A110DC02D8787A2F8D59DD
SHA256:44A3E7EB6CF7BCEB2E18634709FEA8AD46F6B6836B0884537F3238F17354C56C
2640BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exeC:\Users\admin\AppData\Local\GameCenter\lightupdate.dll.sigpi2
MD5:EDDC41798DA3BFE4C655D10CFA1DCFF4
SHA256:8A22AEA625BD496B84A2A9AC78B61FCCD1041C2A98BE702B8FB38324EA489741
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
51
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3232
GameCenter.exe
GET
—
188.93.63.21:80
http://p2p.dl.mail.ru/announce.php?info_hash=%8d%c8%e4dC%94D%98T%8f%f5%5c%20%a6%19%d00%d6%60%0b&peer_id=-BU12M0-AvlLWNlUUFDd&port=6881&uploaded=0&downloaded=0&left=100312&corrupt=0&key=CC976340&event=started&numwant=200&compact=1&no_peer_id=1&redundant=0&ip=192.168.100.51
RU
—
—
suspicious
3232
GameCenter.exe
GET
200
185.30.176.134:80
http://static.gc.my.com/trnts/repository.xml?_c_635000241
NL
xml
1.67 Kb
suspicious
3232
GameCenter.exe
GET
200
185.30.176.134:80
http://static.gc.my.com/trnts/mirrors.xml?_c_523514630
NL
xml
1.44 Kb
suspicious
3232
GameCenter.exe
GET
200
188.93.63.180:80
http://static.gc.vkplay.ru/torrents/mirrors.xml?_c_1452055330
RU
xml
528 b
suspicious
3232
GameCenter.exe
GET
200
185.30.176.134:80
http://static.gc.my.com/trnts/mcsettings.xml?_c_184448122
NL
xml
967 b
suspicious
3232
GameCenter.exe
GET
200
185.30.176.134:80
http://static.gc.my.com/trnts/ipspec.xml?_c_1383098787
NL
xml
10.0 Kb
suspicious
3232
GameCenter.exe
GET
200
185.30.176.134:80
http://static.gc.my.com/trnts/revision.txt?_c_2143985715
NL
text
6 b
suspicious
2640
BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe
GET
200
23.37.41.57:80
http://x1.c.lencr.org/
NL
der
717 b
whitelisted
2640
BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe
GET
200
2.16.241.12:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgMoYfBVif0Eq0AUSUQfepl0Hw%3D%3D
unknown
der
503 b
shared
2640
BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe
GET
200
8.241.9.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b89213b921b34c56
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
95.163.217.22:443
r.my.com
LLC VK
RU
unknown
2640
BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe
178.22.88.34:443
stat.gc.my.games
LLC VK
RU
suspicious
—
—
94.25.183.90:6881
—
PJSC MegaFon
RU
unknown
2640
BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe
8.241.9.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
3232
GameCenter.exe
178.22.88.34:443
stat.gc.my.games
LLC VK
RU
suspicious
2640
BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe
2.16.241.12:80
r3.o.lencr.org
Akamai International B.V.
DE
suspicious
2640
BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe
23.37.41.57:80
x1.c.lencr.org
AKAMAI-AS
DE
suspicious
—
—
68.102.225.53:6881
—
ASN-CXA-ALL-CCI-22773-RDC
US
unknown
3232
GameCenter.exe
178.22.89.26:443
authdl.vkplay.ru
LLC VK
RU
unknown
3232
GameCenter.exe
178.22.89.40:443
games.mail.ru
LLC VK
RU
unknown

DNS requests

Domain
IP
Reputation
stat.gc.my.games
  • 178.22.88.34
suspicious
authdl.vkplay.ru
  • 178.22.89.26
unknown
ctldl.windowsupdate.com
  • 8.241.9.254
  • 67.27.235.126
  • 8.248.131.254
  • 8.238.191.126
  • 67.27.234.126
whitelisted
x1.c.lencr.org
  • 23.37.41.57
whitelisted
r3.o.lencr.org
  • 2.16.241.12
  • 2.16.241.8
shared
games.mail.ru
  • 178.22.89.40
unknown
stat.gc.vkplay.ru
  • 178.22.88.34
unknown
router.utorrent.com
  • 82.221.103.244
whitelisted
router.bittorrent.com
  • 67.215.246.10
shared
dht.transmissionbt.com
  • 212.129.33.59
  • 87.98.162.88
suspicious

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET P2P BitTorrent DHT ping request
3232
GameCenter.exe
Potential Corporate Privacy Violation
GPL P2P BitTorrent transfer
6 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
BattleTeams2Loader_c9b3eb225e44fdfbf17869a4a04fb47f.exe