File name:

wt_launcher_1.0.3.397-74occu37b.exe

Full analysis: https://app.any.run/tasks/ead2948a-df27-417b-9500-070a72ba40be
Verdict: Malicious activity
Analysis date: January 24, 2024, 19:41:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

6D02B7C8C55071DABC760FA76C0378A5

SHA1:

F95A25B2711CA0AFD1028F1A9984A54A0F106EA9

SHA256:

2B3DA1BD4946258FBFB271A9B3FF5F5D0DFAD616CCE13A322AAEE33F4E5C78BF

SSDEEP:

196608:qnma7+AUIFMuiDh5TmXoH2akkWKnjfFRz:qnm2+AUIozyBakkWKpRz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • wt_launcher_1.0.3.397-74occu37b.exe (PID: 2640)
      • wt_launcher_1.0.3.397-74occu37b.tmp (PID: 984)
      • launcher.exe (PID: 2024)
      • gaijin_downloader.exe (PID: 764)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • wt_launcher_1.0.3.397-74occu37b.exe (PID: 2640)
      • wt_launcher_1.0.3.397-74occu37b.tmp (PID: 984)
      • launcher.exe (PID: 2024)
      • gaijin_downloader.exe (PID: 764)

    • Reads the Windows owner or organization settings

      • wt_launcher_1.0.3.397-74occu37b.tmp (PID: 984)

    • Reads settings of System Certificates

      • wt_launcher_1.0.3.397-74occu37b.tmp (PID: 984)
      • launcher.exe (PID: 2024)

    • Process drops legitimate windows executable

      • wt_launcher_1.0.3.397-74occu37b.tmp (PID: 984)
      • gaijin_downloader.exe (PID: 764)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • wt_launcher_1.0.3.397-74occu37b.tmp (PID: 984)

    • Reads the Internet Settings

      • launcher.exe (PID: 2024)

    • Reads security settings of Internet Explorer

      • launcher.exe (PID: 2024)

    • Checks Windows Trust Settings

      • launcher.exe (PID: 2024)

    • Connects to unusual port

      • launcher.exe (PID: 2024)

  • INFO

    • Checks supported languages

      • wt_launcher_1.0.3.397-74occu37b.tmp (PID: 984)
      • wt_launcher_1.0.3.397-74occu37b.exe (PID: 2640)
      • wmpnscfg.exe (PID: 2404)
      • launcher.exe (PID: 2024)
      • gaijin_downloader.exe (PID: 764)
      • gjagent.exe (PID: 2572)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2404)
      • wt_launcher_1.0.3.397-74occu37b.tmp (PID: 984)
      • launcher.exe (PID: 2024)
      • gaijin_downloader.exe (PID: 764)
      • gjagent.exe (PID: 2572)

    • Create files in a temporary directory

      • wt_launcher_1.0.3.397-74occu37b.exe (PID: 2640)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2404)

    • Reads the machine GUID from the registry

      • wt_launcher_1.0.3.397-74occu37b.tmp (PID: 984)
      • launcher.exe (PID: 2024)
      • gaijin_downloader.exe (PID: 764)
      • gjagent.exe (PID: 2572)

    • Creates files or folders in the user directory

      • wt_launcher_1.0.3.397-74occu37b.tmp (PID: 984)
      • launcher.exe (PID: 2024)
      • gaijin_downloader.exe (PID: 764)
      • gjagent.exe (PID: 2572)

    • Creates files in the program directory

      • launcher.exe (PID: 2024)

    • Process checks computer location settings

      • launcher.exe (PID: 2024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (57.2)
.exe | Win32 Executable (generic) (18.2)
.exe | Win16/32 Executable Delphi generic (8.3)
.exe | Generic Win/DOS Executable (8)
.exe | DOS Executable Generic (8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:06 16:39:04+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 197632
UninitializedDataSize: -
EntryPoint: 0x117dc
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Gaijin Network
FileDescription: War Thunder Launcher Setup
FileVersion:
LegalCopyright: 2014-2023 Gaijin Games KFT
ProductName: War Thunder Launcher
ProductVersion:
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
91
Monitored processes
30
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wt_launcher_1.0.3.397-74occu37b.exe wt_launcher_1.0.3.397-74occu37b.tmp wmpnscfg.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs launcher.exe gaijin_downloader.exe gjagent.exe

Process information

PID
CMD
Path
Indicators
Parent process
680"C:\Windows\system32\netsh.exe" firewall add allowedprogram "C:\Users\admin\AppData\Local\WarThunder\launcher.exe" "War Thunder launcher" ENABLE ALLC:\Windows\System32\netsh.exe—wt_launcher_1.0.3.397-74occu37b.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
764"C:\Users\admin\AppData\Local\WarThunder\gaijin_downloader.exe" -appid WarThunderLauncherZip -localversion 1.0.3.397 -execpath launcher.exe -notify_user_about_failure -conditional_gui_app_restartC:\Users\admin\AppData\Local\WarThunder\gaijin_downloader.exe
launcher.exe
User:
admin
Company:
Gaijin
Integrity Level:
MEDIUM
Description:
Gaijin Downloader
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\warthunder\gaijin_downloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
980"C:\Windows\system32\netsh.exe" firewall add allowedprogram "C:\Users\admin\AppData\Local\WarThunder\bpreport.exe" "War Thunder Crash Reporter" ENABLE ALLC:\Windows\System32\netsh.exe—wt_launcher_1.0.3.397-74occu37b.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
984"C:\Users\admin\AppData\Local\Temp\is-UBG1N.tmp\wt_launcher_1.0.3.397-74occu37b.tmp" /SL5="$B017A,11136341,265216,C:\Users\admin\AppData\Local\Temp\wt_launcher_1.0.3.397-74occu37b.exe" C:\Users\admin\AppData\Local\Temp\is-UBG1N.tmp\wt_launcher_1.0.3.397-74occu37b.tmp
wt_launcher_1.0.3.397-74occu37b.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ubg1n.tmp\wt_launcher_1.0.3.397-74occu37b.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1696"C:\Windows\system32\netsh" firewall add portopening protocol = TCP port = 20443 name = "War Thunder"C:\Windows\System32\netsh.exe—wt_launcher_1.0.3.397-74occu37b.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2024"C:\Users\admin\AppData\Local\WarThunder\launcher.exe"C:\Users\admin\AppData\Local\WarThunder\launcher.exe
wt_launcher_1.0.3.397-74occu37b.tmp
User:
admin
Company:
Gaijin
Integrity Level:
MEDIUM
Description:
Gaijin Smart Launcher
Exit code:
0
Version:
1.0.3.397
Modules
Images
c:\users\admin\appdata\local\warthunder\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2404"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2408"C:\Windows\system32\netsh.exe" firewall add allowedprogram "C:\Users\admin\AppData\Local\WarThunder\win64\aces.exe" "War Thunder Game Client" ENABLE ALLC:\Windows\System32\netsh.exe—wt_launcher_1.0.3.397-74occu37b.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2516"C:\Windows\system32\netsh.exe" firewall add allowedprogram "C:\Users\admin\AppData\Local\WarThunder\ForceSingleGPU.exe" "War Thunder Game Client for disabled CrossFire\SLI" ENABLE ALLC:\Windows\System32\netsh.exe—wt_launcher_1.0.3.397-74occu37b.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2572"C:\Users\admin\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe" C:\Users\admin\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe
launcher.exe
User:
admin
Company:
Gaijin
Integrity Level:
MEDIUM
Description:
Gaijin.Net Updater
Exit code:
0
Version:
1.0.43
Modules
Images
c:\users\admin\appdata\local\gaijin\program files (x86)\netagent\gjagent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
20 537
Read events
19 390
Write events
1 140
Delete events
7

Modification events

(PID) Process:(984) wt_launcher_1.0.3.397-74occu37b.tmpKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(680) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(980) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2788) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2408) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3400) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3564) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3072) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2972) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3040) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
23
Suspicious files
18
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
984wt_launcher_1.0.3.397-74occu37b.tmpC:\Users\admin\AppData\Local\WarThunder\bpreport.exeexecutable
MD5:31911C6EA459F516D1DA0A12EC677BEA
SHA256:44C1DB6B7BF4103B2C4D3A1F014A1EA8FAFBBEBA19CD028525D494E3E390A896
984wt_launcher_1.0.3.397-74occu37b.tmpC:\Users\admin\AppData\Local\WarThunder\is-PVKOU.tmpexecutable
MD5:31911C6EA459F516D1DA0A12EC677BEA
SHA256:44C1DB6B7BF4103B2C4D3A1F014A1EA8FAFBBEBA19CD028525D494E3E390A896
984wt_launcher_1.0.3.397-74occu37b.tmpC:\Users\admin\AppData\Local\WarThunder\is-GAMMQ.tmpexecutable
MD5:89E87C16DB08268DC57A1B27DBA96934
SHA256:E2235530973C4C298C532D5FD1A84476C58D9D2D343D22364822D11BF0037086
984wt_launcher_1.0.3.397-74occu37b.tmpC:\Users\admin\AppData\Local\WarThunder\launcher.exeexecutable
MD5:0FF1F5E9F86B3F8827C7DFC8FC927459
SHA256:0DA9B2364BA37F2C633162C8CA55768FC0EC4AC3F22C20EDED0404913A0FCC12
2640wt_launcher_1.0.3.397-74occu37b.exeC:\Users\admin\AppData\Local\Temp\is-UBG1N.tmp\wt_launcher_1.0.3.397-74occu37b.tmpexecutable
MD5:89E87C16DB08268DC57A1B27DBA96934
SHA256:E2235530973C4C298C532D5FD1A84476C58D9D2D343D22364822D11BF0037086
984wt_launcher_1.0.3.397-74occu37b.tmpC:\Users\admin\AppData\Local\WarThunder\icon.icoimage
MD5:945B144169D97344B11E182F773DBB67
SHA256:FAC97A96962BE6B9347FE414AACD99B02A0DE63D79BA6E49D8690506A3C96EE4
984wt_launcher_1.0.3.397-74occu37b.tmpC:\Users\admin\AppData\Local\WarThunder\is-JUPL9.tmpexecutable
MD5:148423FDBC7F0B07D8D166414C95B8AB
SHA256:72877FB0AF03745E2A78414DDAA05F1871703AD4C0D16D43D4AE62971FF52F0B
984wt_launcher_1.0.3.397-74occu37b.tmpC:\Users\admin\AppData\Local\WarThunder\launcherr.datcompressed
MD5:744F5A680031C3D75BF6E3C29924D3FE
SHA256:0144227A81021517E9E247F6BF21D4E843067C1634729CF4CFCB0D545C32637D
984wt_launcher_1.0.3.397-74occu37b.tmpC:\Users\admin\AppData\Local\WarThunder\is-P645L.tmptext
MD5:1E32496378E8FEE43CB01B0689963A67
SHA256:5B47AEE36F594B7737E00990C9922A87252729B74CC2F1A83C0FCEED9816BDB9
984wt_launcher_1.0.3.397-74occu37b.tmpC:\Users\admin\AppData\Local\WarThunder\ca-bundle.crttext
MD5:1E32496378E8FEE43CB01B0689963A67
SHA256:5B47AEE36F594B7737E00990C9922A87252729B74CC2F1A83C0FCEED9816BDB9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2 227
DNS requests
22
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2024
launcher.exe
GET
—
185.40.154.13:80
http://04-warthunder-cdnnow.cdn.gaijin.net/warthunder/2.33.0.77/3c972228dbee3f912a437e187d9004c90f82abcb/win64/tools64.zip
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
984
wt_launcher_1.0.3.397-74occu37b.tmp
188.42.61.240:443
launcher-bq.gaijin.net
SERVERS-COM
LU
unknown
764
gaijin_downloader.exe
54.171.93.221:443
yupmaster.gaijinent.com
AMAZON-02
IE
unknown
764
gaijin_downloader.exe
95.211.246.178:20010
client-stats.gaijin.net
—
—
unknown
2024
launcher.exe
95.211.246.178:20011
client-stats.gaijin.net
—
—
unknown
2024
launcher.exe
54.171.93.221:443
yupmaster.gaijinent.com
AMAZON-02
IE
unknown
2024
launcher.exe
188.42.61.240:443
launcher-bq.gaijin.net
SERVERS-COM
LU
unknown
2024
launcher.exe
104.20.83.98:443
warthunder.com
CLOUDFLARENET
—
shared

DNS requests

Domain
IP
Reputation
launcher-bq.gaijin.net
  • 188.42.61.240
unknown
client-stats.gaijin.net
  • 95.211.246.178
unknown
client-stats.warthunder.com
  • 95.211.246.178
unknown
yupmaster.gaijinent.com
  • 54.171.93.221
  • 52.210.115.34
unknown
seeder.gaijin.lan
  • —
unknown
warthunder.com
  • 104.20.83.98
  • 104.20.82.98
whitelisted
aws-yup-distr-02.gaijinent.com
  • 52.84.49.232
unknown
aws-yup-distr-04.gaijinent.com
  • 13.32.20.73
unknown
aws-yup-distr-03.gaijinent.com
  • 18.245.66.198
unknown
dht.libtorrent.org
  • 185.157.221.247
unknown

Threats

PID
Process
Class
Message
2024
launcher.exe
Potential Corporate Privacy Violation
ET P2P BitTorrent DHT ping request
2024
launcher.exe
Potential Corporate Privacy Violation
ET P2P Vuze BT UDP Connection (5)
2024
launcher.exe
Potential Corporate Privacy Violation
ET P2P BitTorrent peer sync
2024
launcher.exe
Potential Corporate Privacy Violation
ET P2P BitTorrent peer sync
2024
launcher.exe
Potential Corporate Privacy Violation
ET P2P BitTorrent DHT announce_peers request
Process
Message
launcher.exe
Log path C:\Users\admin\AppData\Local\WarThunder\.launcher_log\2024_01_24_19_42_29_2024.txt
launcher.exe
launcher.exe
0.31 [D] TIMER freq: ticks/usec=3 ticks/msec=3579
launcher.exe
BUILD TIMESTAMP: Dec 27 2023 11:05:04
launcher.exe
---$01 (null) --- 0.32 [D] $01 Thread "Watchdog thread" started
launcher.exe
0.31 [D] Creating thread "Watchdog thread"...
launcher.exe
0.32 [D] Mounting C:\Users\admin\AppData\Local\WarThunder\launcherr.dat...
launcher.exe
0.34 [D] launcherr.dat sign match
launcher.exe
0.34 [D] Mounted card_caps.json
launcher.exe
0.34 [D] Mounted build_html.nut
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wt_launcher_1.0.3.397-74occu37b.exe