File name:

game.exe

Full analysis: https://app.any.run/tasks/b4efa5ab-8a8b-446e-a3e1-529329a7c501
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: March 06, 2020, 08:18:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

C95B850D3046E9009E479E6F104400CF

SHA1:

D2F20F0478E2D933A2701883A6D7849EC352D6A8

SHA256:

9C77C6FBA4FF582067D42105104959293ED3BB4CAAD5B13762702E2F578DBF4D

SSDEEP:

393216:JHXxdH2eoxb9ggrQen9QFwERsFbUZrt3v0Lh1:JbIxhgznFxKFVd1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to CnC server

      • game.exe (PID: 3724)
      • game.exe (PID: 3324)

    • Changes settings of System certificates

      • game.exe (PID: 3324)

  • SUSPICIOUS

    • Starts itself from another location

      • game.exe (PID: 2960)

    • Creates files in the Windows directory

      • game.exe (PID: 3724)

    • Executable content was dropped or overwritten

      • game.exe (PID: 2960)
      • game.exe (PID: 3324)

    • Application launched itself

      • game.exe (PID: 3724)

    • Reads Internet Cache Settings

      • game.exe (PID: 3724)
      • game.exe (PID: 3324)

    • Reads internet explorer settings

      • game.exe (PID: 3324)

    • Connects to unusual port

      • game.exe (PID: 3324)

    • Creates files in the user directory

      • game.exe (PID: 3324)

    • Executed via COM

      • netsh.exe (PID: 3748)
      • netsh.exe (PID: 3424)
      • netsh.exe (PID: 852)
      • netsh.exe (PID: 2296)
      • netsh.exe (PID: 1196)
      • netsh.exe (PID: 664)

    • Adds / modifies Windows certificates

      • game.exe (PID: 3324)

  • INFO

    • Reads settings of System Certificates

      • game.exe (PID: 3324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (28.6)
.exe | UPX compressed Win32 Executable (28)
.exe | Win32 EXE Yoda's Crypter (27.5)
.dll | Win32 Dynamic Link Library (generic) (6.8)
.exe | Win32 Executable (generic) (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:09:07 21:07:44+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 3682304
InitializedDataSize: 8192
UninitializedDataSize: 7106560
EntryPoint: 0xa49f90
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.61.2032.230
ProductVersionNumber: 2.61.2032.230
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 2.61.2032.230
FileDescription: 传奇登陆器
ProductName: 传奇登陆器
ProductVersion: 2.61.2032.230
CompanyName: Gameofmir
LegalCopyright: Copyright ? 2019 All Rights Reserved
Comments: 2.61.2032.230

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 07-Sep-2019 19:07:44
Detected languages:
  • Chinese - PRC
FileVersion: 2.61.2032.230
FileDescription: 传奇登陆器
ProductName: 传奇登陆器
ProductVersion: 2.61.2032.230
CompanyName: Gameofmir
LegalCopyright: Copyright ? 2019 All Rights Reserved
Comments: 2.61.2032.230

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 07-Sep-2019 19:07:44
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x006C7000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x006C8000
0x00383000
0x00382C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99995
.rsrc
0x00A4B000
0x00002000
0x00001C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.79944
.lvdlq
0x00A4D000
0x009F2B20
0x009F2B20
7.997

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.88295
466
Latin 1 / Western European
UNKNOWN
RT_MANIFEST
2
2.18858
296
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
3.00862
744
Latin 1 / Western European
UNKNOWN
RT_ICON
4
6.92644
180
Latin 1 / Western European
Chinese - PRC
RT_CURSOR
127
3.4183
12
Latin 1 / Western European
Chinese - PRC
RT_MENU
150
6.67046
152
Latin 1 / Western European
Chinese - PRC
RT_DIALOG
286
7.47421
378
Latin 1 / Western European
Chinese - PRC
RT_DIALOG
554
7.19511
250
Latin 1 / Western European
Chinese - PRC
RT_DIALOG
1031
7.63881
584
Latin 1 / Western European
Chinese - PRC
RT_BITMAP
1032
4.32193
20
Latin 1 / Western European
Chinese - PRC
RT_GROUP_CURSOR

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.DLL
OLEAUT32.dll
RASAPI32.dll
SHELL32.dll
USER32.dll
WININET.dll
WINMM.dll
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
10
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start game.exe game.exe game.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs game.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664netsh advfirewall firewall add rule name="svchost - IPv6 (IPv6-In)" dir=in action=allow program="C:\Windows\system32\svchost.exe" enable=yesC:\Windows\system32\netsh.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
852netsh interface ip set dns name="Connection" static 114.114.114.114 validate=noC:\Windows\system32\netsh.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1196netsh interface ip add dns name="Connection" 8.8.8.8 valid=noC:\Windows\system32\netsh.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1444"C:\Users\admin\AppData\Local\Temp\game.exe" C:\Users\admin\AppData\Local\Temp\game.exe—explorer.exe
User:
admin
Company:
Gameofmir
Integrity Level:
MEDIUM
Description:
传奇登陆器
Exit code:
3221226540
Version:
2.61.2032.230
Modules
Images
c:\users\admin\appdata\local\temp\game.exe
c:\systemroot\system32\ntdll.dll
2296netsh advfirewall firewall add rule name="svchost - IPv6 (IPv6-Out)" dir=out action=allow program="C:\Windows\system32\svchost.exe" enable=yesC:\Windows\system32\netsh.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\gdi32.dll
2960"C:\Users\admin\AppData\Local\Temp\game.exe" C:\Users\admin\AppData\Local\Temp\game.exe
explorer.exe
User:
admin
Company:
Gameofmir
Integrity Level:
HIGH
Description:
传奇登陆器
Exit code:
0
Version:
2.61.2032.230
Modules
Images
c:\users\admin\appdata\local\temp\game.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\gdi32.dll
3324C:\game\game.exe [lAWbzGU1eUdnDWUBGiSxEoEuiHYIyM/vnrV2SNY0Sdh6kUPy5jehEYsjE+oYk9Jt5HloCKai5RjiVYla5PBB4LV2rzhsGS0ZJNG3tHv8o4mjN8n/4qYuIzuYCg==]C:\game\game.exe
game.exe
User:
admin
Company:
Gameofmir
Integrity Level:
HIGH
Description:
传奇登陆器
Exit code:
0
Version:
2.61.2032.230
Modules
Images
c:\game\game.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3424netsh advfirewall firewall delete rule name="svchost - IPv6 (IPv6-In)"C:\Windows\system32\netsh.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
3724C:\game\game.exe |C:\Users\admin\AppData\Local\Temp\game.exeC:\game\game.exe
game.exe
User:
admin
Company:
Gameofmir
Integrity Level:
HIGH
Description:
传奇登陆器
Exit code:
0
Version:
2.61.2032.230
Modules
Images
c:\game\game.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\gdi32.dll
3748netsh advfirewall firewall delete rule name="svchost - IPv6 (IPv6-Out)"C:\Windows\system32\netsh.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
Total events
2 128
Read events
369
Write events
1 759
Delete events
0

Modification events

(PID) Process:(3724) game.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3724) game.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3724) game.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3724) game.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3724) game.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3724) game.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3724) game.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3324) game.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3324) game.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3324) game.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
Executable files
2
Suspicious files
6
Text files
16
Unknown types
4

Dropped files

PID
Process
Filename
Type
3724game.exeC:\game\map\c95b850d3046e9009e479e6f104400cf234.exe —
MD5:—
SHA256:—
3324game.exeC:\game\Patch0.d3d —
MD5:—
SHA256:—
3324game.exeC:\game\RX176\data\Prguse.Pak —
MD5:—
SHA256:—
3324game.exeC:\game\RX176\Map\3.map —
MD5:—
SHA256:—
3324game.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C —
MD5:—
SHA256:—
3324game.exeC:\Users\admin\AppData\Local\Temp\CabB81D.tmp —
MD5:—
SHA256:—
3324game.exeC:\Users\admin\AppData\Local\Temp\TarB81E.tmp —
MD5:—
SHA256:—
3324game.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\AMJS6FOX.txt —
MD5:—
SHA256:—
3324game.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\QLQ1XMVL.txt —
MD5:—
SHA256:—
3324game.exeC:\Users\admin\AppData\Local\Temp\zthkvjf —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
52
TCP/UDP connections
17
DNS requests
13
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3324
game.exe
GET
—
15.164.83.206:80
http://www.cq994.com/Link.htm
US
—
—
malicious
3324
game.exe
GET
200
125.77.154.35:80
http://tiebapic.baidu.com/tieba/pic/item/8694a4c27d1ed21b22bc8b9aba6eddc451da3f53.png
CN
image
408 Kb
malicious
3324
game.exe
GET
200
151.101.2.133:80
http://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8EJH
US
der
1.49 Kb
whitelisted
3324
game.exe
GET
200
125.124.255.25:5599
http://125.124.255.25:5599/tong_ji88.txt
CN
text
5.79 Kb
malicious
3324
game.exe
GET
200
125.77.154.35:80
http://tiebapic.baidu.com/tieba/pic/item/b219ebc4b74543a9d5615fb309178a82b9011452.png
CN
image
408 Kb
malicious
3324
game.exe
GET
200
151.101.2.133:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDDgHcwPJHmvTnYYYUg%3D%3D
US
der
1.54 Kb
whitelisted
3324
game.exe
GET
200
125.77.154.35:80
http://tiebapic.baidu.com/tieba/pic/item/91529822720e0cf34e8ceb841d46f21fbe09aa52.png
CN
image
408 Kb
malicious
3324
game.exe
GET
200
151.101.2.133:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDDgHcwPJHmvTnYYYUg%3D%3D
US
der
1.54 Kb
whitelisted
3324
game.exe
GET
200
125.77.154.35:80
http://tiebapic.baidu.com/tieba/pic/item/e1fe9925bc315c60c0eece909ab1cb1349547752.png
CN
image
408 Kb
malicious
3324
game.exe
GET
200
125.77.154.35:80
http://tiebapic.baidu.com/tieba/pic/item/78310a55b319ebc4e20dd3e69526cffc1e171653.png
CN
image
408 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3724
game.exe
104.160.168.98:80
www.pay298.com
Sharktech
US
malicious
3324
game.exe
125.124.255.25:21553
abc.lvdlq.com
No.31,Jin-rong Street
CN
malicious
3324
game.exe
103.235.46.191:443
hm.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
suspicious
592
svchost.exe
125.124.255.79:12309
www.w15773.com
No.31,Jin-rong Street
CN
unknown
592
svchost.exe
125.124.255.79:12310
www.w15773.com
No.31,Jin-rong Street
CN
unknown
1052
svchost.exe
114.114.114.114:53
—
Cogent Communications
CN
malicious
592
svchost.exe
125.77.154.35:80
tiebapic.baidu.com
No.31,Jin-rong Street
CN
malicious
592
svchost.exe
125.124.255.81:12315
www.w15773.com
No.31,Jin-rong Street
CN
unknown
3324
game.exe
15.164.83.206:80
www.cq994.com
Hewlett-Packard Company
US
malicious
3324
game.exe
103.235.46.191:80
hm.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
suspicious

DNS requests

Domain
IP
Reputation
www.pay298.com
  • 104.160.168.98
malicious
abc.lvdlq.com
  • 125.124.255.25
malicious
www.cq994.com
  • 15.164.83.206
malicious
hm.baidu.com
  • 103.235.46.191
whitelisted
ocsp.globalsign.com
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted
ocsp2.globalsign.com
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted
tiebapic.baidu.com
  • 125.77.154.35
malicious
www.baidu.com
  • 103.235.46.39
whitelisted
www.w15773.com
  • 125.124.255.79
  • 125.124.255.81
  • 125.124.255.83
unknown

Threats

PID
Process
Class
Message
3724
game.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
3724
game.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.Win32.Renaz.czjehx
3324
game.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
3324
game.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.Win32.Renaz.czjehx
592
svchost.exe
A Network Trojan was detected
ET MALWARE klm123.com Spyware User Agent
592
svchost.exe
A Network Trojan was detected
ET MALWARE klm123.com Spyware User Agent
592
svchost.exe
A Network Trojan was detected
ET MALWARE klm123.com Spyware User Agent
592
svchost.exe
A Network Trojan was detected
ET MALWARE klm123.com Spyware User Agent
592
svchost.exe
A Network Trojan was detected
ET MALWARE klm123.com Spyware User Agent
592
svchost.exe
A Network Trojan was detected
ET MALWARE klm123.com Spyware User Agent
2 ETPRO signatures available at the full report
Process
Message
game.exe
C:\game\game.exe [lAWbzGU1eUdnDWUBGiSxEoEuiHYIyM/vnrV2SNY0Sdh6kUPy5jehEYsjE+oYk9Jt5HloCKai5RjiVYla5PBB4LV2rzhsGS0ZJNG3tHv8o4mjN8n/4qYuIzuYCg==]
game.exe
wsocket.pas initialization section
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
game.exe