URL:

http://cdn.gxx.garenanow.com/gxx/pc/installer/Garena-v2.0.exe

Full analysis: https://app.any.run/tasks/e852f97e-ba9a-4d82-b7db-a7b0cb4db713
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 28, 2020, 10:00:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

6E36899140E567FA7C5C96391DE825FE

SHA1:

81950CCCED3A1C3BA9198146A43B5924FD38D7E5

SHA256:

1D4F6E412B51568237576D73653DFB829152E4A9A76C16FB86E0AC88F213437D

SSDEEP:

3:N1KdBL6JHQYobyRgOXKQ9TXLhN:CXsHSGgOXrbhN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Garena-v2.0.exe (PID: 3932)
      • Garena-v2.0.exe (PID: 3200)
      • Garena-v2.0.exe (PID: 3464)
      • Garena-v2.0.exe (PID: 3832)
      • gxxsvc.exe (PID: 2428)
      • gxxsvc.exe (PID: 2552)
      • gxxsvc.exe (PID: 2540)
      • Garena.exe (PID: 1840)

    • Downloads executable files from the Internet

      • chrome.exe (PID: 2748)

    • Loads dropped or rewritten executable

      • Garena-v2.0.exe (PID: 3932)
      • Garena-v2.0.exe (PID: 3464)
      • gxxsvc.exe (PID: 2552)
      • gxxsvc.exe (PID: 2540)
      • gxxsvc.exe (PID: 2428)
      • Garena.exe (PID: 1840)

    • Loads the Task Scheduler COM API

      • gxxsvc.exe (PID: 2540)
      • gxxsvc.exe (PID: 2552)
      • gxxsvc.exe (PID: 2428)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3164)
      • Garena-v2.0.exe (PID: 3932)
      • Garena-v2.0.exe (PID: 3464)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3164)

    • Creates files in the program directory

      • gxxsvc.exe (PID: 2552)
      • Garena.exe (PID: 1840)
      • Garena-v2.0.exe (PID: 3464)

    • Executed as Windows Service

      • gxxsvc.exe (PID: 2428)

    • Creates a software uninstall entry

      • Garena-v2.0.exe (PID: 3464)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 3164)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 3164)

    • Reads the hosts file

      • chrome.exe (PID: 3164)
      • chrome.exe (PID: 2748)
      • Garena.exe (PID: 1840)

    • Manual execution by user

      • Garena-v2.0.exe (PID: 3832)
      • explorer.exe (PID: 1456)
      • Garena-v2.0.exe (PID: 3464)
      • Garena.exe (PID: 1840)

    • Dropped object may contain Bitcoin addresses

      • Garena-v2.0.exe (PID: 3464)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
83
Monitored processes
35
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs garena-v2.0.exe no specs garena-v2.0.exe explorer.exe no specs garena-v2.0.exe no specs garena-v2.0.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs gxxsvc.exe no specs gxxsvc.exe no specs gxxsvc.exe no specs garena.exe

Process information

PID
CMD
Path
Indicators
Parent process
272"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,17345928665436654335,2427945480675629373,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=6482628217240027656 --mojo-platform-channel-handle=4428 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
376"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,17345928665436654335,2427945480675629373,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=4169067947615361089 --mojo-platform-channel-handle=3744 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
880"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,17345928665436654335,2427945480675629373,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=5534159363865306802 --mojo-platform-channel-handle=4668 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1348"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,17345928665436654335,2427945480675629373,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=7664245566787942919 --mojo-platform-channel-handle=3028 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1440"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,17345928665436654335,2427945480675629373,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=8679838926305376661 --mojo-platform-channel-handle=3808 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1456"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1516"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,17345928665436654335,2427945480675629373,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14678340922523905673 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1688"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,17345928665436654335,2427945480675629373,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=6540134815918403643 --mojo-platform-channel-handle=4736 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1840"C:\Program Files\Garena\Garena\Garena.exe" -lang en -firstlaunchC:\Program Files\Garena\Garena\Garena.exe
explorer.exe
User:
admin
Company:
Garena Online
Integrity Level:
MEDIUM
Description:
Garena Platform
Exit code:
0
Version:
2019.09.26.1823
Modules
Images
c:\program files\garena\garena\garena.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1844"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,17345928665436654335,2427945480675629373,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=2372676374412853863 --mojo-platform-channel-handle=3732 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
1 709
Read events
1 607
Write events
97
Delete events
5

Modification events

(PID) Process:(3164) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3164) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3164) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3164) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3088) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:3164-13232541640971750
Value:
259
(PID) Process:(3164) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3164) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3164) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3164) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3120-13213713943555664
Value:
0
(PID) Process:(3164) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
101
Suspicious files
95
Text files
588
Unknown types
22

Dropped files

PID
Process
Filename
Type
3164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5EA7FEC9-C5C.pma —
MD5:—
SHA256:—
3164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\0ab6ea80-266e-4254-9bd5-8c3362434e98.tmp —
MD5:—
SHA256:—
3164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
3164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
3164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RFa6f3bf.TMPtext
MD5:—
SHA256:—
3164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RFa6f3ed.TMPtext
MD5:—
SHA256:—
3164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
3164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
3164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
3164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RFa6f5c2.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
29
DNS requests
21
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3932
Garena-v2.0.exe
POST
—
203.117.172.231:80
http://statscollection.garenanow.com/gginst/
SG
—
—
unknown
2748
chrome.exe
GET
200
159.148.69.142:80
http://r3---sn-a5uoxu-gpme.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjY5QUFXTEQwc2RPVXhRY3picjhxblh1dw/7619.603.0.2_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mh=Qx&mip=159.148.186.246&mm=28&mn=sn-a5uoxu-gpme&ms=nvh&mt=1588068139&mv=m&mvi=2&pl=24&shardbypass=yes
LV
crx
816 Kb
whitelisted
2748
chrome.exe
GET
302
172.217.22.78:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
527 b
whitelisted
3464
Garena-v2.0.exe
POST
—
203.117.172.231:80
http://statscollection.garenanow.com/gginst/
SG
—
—
unknown
2748
chrome.exe
GET
302
172.217.22.78:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjY5QUFXTEQwc2RPVXhRY3picjhxblh1dw/7619.603.0.2_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
532 b
whitelisted
1840
Garena.exe
HEAD
200
92.123.77.24:80
http://cdn.gxx.garenanow.com/gxx/gamecenter/app/0000/010/001/home_banner/10001-banner-assets-1488534080.jpg
unknown
—
—
whitelisted
2748
chrome.exe
GET
200
92.123.77.24:80
http://cdn.gxx.garenanow.com/gxx/pc/installer/Garena-v2.0.exe
unknown
executable
69.7 Mb
whitelisted
2748
chrome.exe
GET
200
159.148.69.143:80
http://r4---sn-a5uoxu-gpme.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx?cms_redirect=yes&mh=QJ&mip=159.148.186.246&mm=28&mn=sn-a5uoxu-gpme&ms=nvh&mt=1588068139&mv=m&mvi=3&pl=24&shardbypass=yes
LV
crx
293 Kb
whitelisted
3464
Garena-v2.0.exe
POST
200
203.117.172.231:80
http://statscollection.garenanow.com/gginst/
SG
text
4 b
unknown
3464
Garena-v2.0.exe
POST
200
203.117.172.231:80
http://statscollection.garenanow.com/gginst/
SG
text
4 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2748
chrome.exe
172.217.16.173:443
accounts.google.com
Google Inc.
US
whitelisted
2748
chrome.exe
92.123.77.24:80
cdn.gxx.garenanow.com
Akamai International B.V.
—
suspicious
2748
chrome.exe
172.217.18.164:443
www.google.com
Google Inc.
US
whitelisted
2748
chrome.exe
172.217.23.99:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2748
chrome.exe
172.217.22.46:443
sb-ssl.google.com
Google Inc.
US
whitelisted
2748
chrome.exe
216.58.206.3:443
www.gstatic.com
Google Inc.
US
whitelisted
2748
chrome.exe
216.58.207.46:443
clients1.google.com
Google Inc.
US
whitelisted
3932
Garena-v2.0.exe
203.117.172.231:80
statscollection.garenanow.com
StarHub Internet Exchange
SG
unknown
2748
chrome.exe
172.217.22.14:443
clients2.google.com
Google Inc.
US
whitelisted
2748
chrome.exe
172.217.22.78:80
redirector.gvt1.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
cdn.gxx.garenanow.com
  • 92.123.77.24
  • 92.123.77.57
whitelisted
clientservices.googleapis.com
  • 216.58.207.35
whitelisted
accounts.google.com
  • 172.217.16.173
shared
www.google.com
  • 172.217.18.164
malicious
ssl.gstatic.com
  • 172.217.23.99
whitelisted
sb-ssl.google.com
  • 172.217.22.46
whitelisted
www.gstatic.com
  • 216.58.206.3
whitelisted
clients1.google.com
  • 216.58.207.46
whitelisted
statscollection.garenanow.com
  • 203.117.172.231
unknown
clients2.google.com
  • 172.217.22.14
whitelisted

Threats

PID
Process
Class
Message
2748
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2748
chrome.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
2748
chrome.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
Process
Message
Garena-v2.0.exe
{"id":"gxx","action":"0","data":{"ver":"2.0.1909.2618", "patch":"0", "stage":"init"}}
Garena-v2.0.exe
LSM.EXE
Garena-v2.0.exe
SYSTEM
Garena-v2.0.exe
CreateToolhelp32Snapshot done
Garena-v2.0.exe
WININIT.EXE
Garena-v2.0.exe
WINLOGON.EXE
Garena-v2.0.exe
SPOOLSV.EXE
Garena-v2.0.exe
CSRSS.EXE
Garena-v2.0.exe
SVCHOST.EXE
Garena-v2.0.exe
CHROME.EXE
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://cdn.gxx.garenanow.com/gxx/pc/installer/Garena-v2.0.exe