URL:

https://www.wargaming.net

Full analysis: https://app.any.run/tasks/2f5e1594-ec9a-4408-aa0d-e185e22a0a2e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 14, 2021, 20:16:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

D8FBC7755C9A1E137B71AA44C3B5040A

SHA1:

4F2A0ADEEE9D54B4E4D4024DF7577CEB5C630962

SHA256:

BE2965B263F922A686DB5D62B61D45345A093E9F2EDF27957686CF76700C8C4B

SSDEEP:

3:N8DSLHIKCLo:2OLHIZLo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • world_of_warplanes_ww_install_eu_c9xcnl915num.exe (PID: 2148)
      • wgc_renderer_host.exe (PID: 752)
      • wgc_renderer_host.exe (PID: 3188)
      • WargamingErrorMonitor.exe (PID: 4016)
      • wgc_renderer_host.exe (PID: 3856)
      • wgc_helper_host.exe (PID: 3240)
      • wgc.exe (PID: 3116)
      • wgc.exe (PID: 1448)
      • wgc_renderer_host.exe (PID: 3032)
      • WargamingErrorMonitor.exe (PID: 2424)
      • dxwebsetup.exe (PID: 1576)
      • 1516810735_dx9.0c_light.exe (PID: 4072)
      • dxwsetup.exe (PID: 3520)

    • Drops executable file immediately after starts

      • world_of_warplanes_ww_install_eu_c9xcnl915num.tmp (PID: 2348)
      • dxwebsetup.exe (PID: 1576)
      • dxwsetup.exe (PID: 3520)

    • Adds new firewall rule via NETSH.EXE

      • world_of_warplanes_ww_install_eu_c9xcnl915num.tmp (PID: 2348)

    • Loads dropped or rewritten executable

      • wgc.exe (PID: 1448)
      • wgc_renderer_host.exe (PID: 752)
      • wgc_helper_host.exe (PID: 3240)
      • wgc_renderer_host.exe (PID: 3856)
      • wgc_renderer_host.exe (PID: 3188)
      • wgc_renderer_host.exe (PID: 3032)
      • dxwsetup.exe (PID: 3520)

    • Changes the autorun value in the registry

      • wgc.exe (PID: 1448)
      • dxwebsetup.exe (PID: 1576)

    • Changes settings of System certificates

      • dxwsetup.exe (PID: 3520)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2880)
      • world_of_warplanes_ww_install_eu_c9xcnl915num.exe (PID: 2148)
      • world_of_warplanes_ww_install_eu_c9xcnl915num.tmp (PID: 2348)
      • 7za.exe (PID: 3784)
      • wgc.exe (PID: 1448)
      • dxwebsetup.exe (PID: 1576)
      • 1516810735_dx9.0c_light.exe (PID: 4072)
      • dxwsetup.exe (PID: 3520)

    • Reads Windows owner or organization settings

      • world_of_warplanes_ww_install_eu_c9xcnl915num.tmp (PID: 2348)

    • Reads the Windows organization settings

      • world_of_warplanes_ww_install_eu_c9xcnl915num.tmp (PID: 2348)

    • Drops a file with too old compile date

      • world_of_warplanes_ww_install_eu_c9xcnl915num.tmp (PID: 2348)
      • 7za.exe (PID: 3784)
      • 1516810735_dx9.0c_light.exe (PID: 4072)
      • dxwsetup.exe (PID: 3520)

    • Drops a file that was compiled in debug mode

      • world_of_warplanes_ww_install_eu_c9xcnl915num.tmp (PID: 2348)
      • 7za.exe (PID: 3784)
      • wgc.exe (PID: 1448)
      • 1516810735_dx9.0c_light.exe (PID: 4072)
      • dxwebsetup.exe (PID: 1576)
      • dxwsetup.exe (PID: 3520)

    • Drops a file with a compile date too recent

      • 7za.exe (PID: 3784)
      • wgc.exe (PID: 1448)

    • Uses NETSH.EXE for network configuration

      • world_of_warplanes_ww_install_eu_c9xcnl915num.tmp (PID: 2348)

    • Creates files in the program directory

      • wgc.exe (PID: 3116)
      • wgc.exe (PID: 1448)
      • WargamingErrorMonitor.exe (PID: 2424)
      • WargamingErrorMonitor.exe (PID: 4016)
      • wgc_renderer_host.exe (PID: 3188)
      • wgc_renderer_host.exe (PID: 3856)

    • Changes default file association

      • world_of_warplanes_ww_install_eu_c9xcnl915num.tmp (PID: 2348)
      • wgc.exe (PID: 1448)

    • Application launched itself

      • wgc.exe (PID: 3116)

    • Creates files in the user directory

      • world_of_warplanes_ww_install_eu_c9xcnl915num.tmp (PID: 2348)
      • wgc.exe (PID: 1448)

    • Creates a software uninstall entry

      • wgc.exe (PID: 1448)

    • Adds / modifies Windows certificates

      • dxwsetup.exe (PID: 3520)

    • Searches for installed software

      • dxwsetup.exe (PID: 3520)

    • Executed as Windows Service

      • vssvc.exe (PID: 2304)

    • Executed via COM

      • DllHost.exe (PID: 3844)

    • Removes files from Windows directory

      • dxwsetup.exe (PID: 3520)

    • Creates/Modifies COM task schedule object

      • dxwsetup.exe (PID: 3520)

    • Creates files in the Windows directory

      • dxwsetup.exe (PID: 3520)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 2880)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2880)
      • dxwsetup.exe (PID: 3520)

    • Reads the hosts file

      • chrome.exe (PID: 2880)
      • chrome.exe (PID: 2628)
      • wgc.exe (PID: 1448)
      • wgc_renderer_host.exe (PID: 3856)

    • Application was dropped or rewritten from another process

      • 7za.exe (PID: 912)
      • 7za.exe (PID: 3784)
      • world_of_warplanes_ww_install_eu_c9xcnl915num.tmp (PID: 2348)

    • Loads dropped or rewritten executable

      • world_of_warplanes_ww_install_eu_c9xcnl915num.tmp (PID: 2348)

    • Creates files in the program directory

      • world_of_warplanes_ww_install_eu_c9xcnl915num.tmp (PID: 2348)
      • 7za.exe (PID: 3784)

    • Dropped object may contain Bitcoin addresses

      • 7za.exe (PID: 3784)

    • Creates a software uninstall entry

      • world_of_warplanes_ww_install_eu_c9xcnl915num.tmp (PID: 2348)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
83
Monitored processes
34
Malicious processes
14
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs world_of_warplanes_ww_install_eu_c9xcnl915num.exe world_of_warplanes_ww_install_eu_c9xcnl915num.tmp 7za.exe no specs 7za.exe netsh.exe no specs wgc.exe no specs wgc.exe wargamingerrormonitor.exe wargamingerrormonitor.exe wgc_renderer_host.exe wgc_renderer_host.exe wgc_helper_host.exe no specs wgc_renderer_host.exe no specs wgc_renderer_host.exe dxdiag.exe no specs 1516810735_dx9.0c_light.exe dxwebsetup.exe dxwsetup.exe vssvc.exe no specs SPPSurrogate no specs

Process information

PID
CMD
Path
Indicators
Parent process
752"C:\ProgramData\Wargaming.net\GameCenter\dlls\wgc_renderer_host.exe" --type=gpu-process --field-trial-handle=1276,6899340747612527998,10406876570720108393,131072 --disable-features=MimeHandlerViewInCrossProcessFrame --no-sandbox --log-file="C:\ProgramData\Wargaming.net\GameCenter\logs\cef_20210314_201938_858.log" --log-severity=info --product-version="Chrome/78.0.3904.87 WGC/21.01.00.4239" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\ProgramData\Wargaming.net\GameCenter\logs\cef_20210314_201938_858.log" --service-request-channel-token=12633622073802723763 --mojo-platform-channel-handle=1284 /prefetch:2C:\ProgramData\Wargaming.net\GameCenter\dlls\wgc_renderer_host.exe
wgc.exe
User:
admin
Company:
Wargaming.net
Integrity Level:
MEDIUM
Description:
Wargaming.net Game Center
Exit code:
4
Version:
21.01.00.4239
Modules
Images
c:\programdata\wargaming.net\gamecenter\dlls\wgc_renderer_host.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
912"C:\Users\admin\AppData\Local\Temp\is-1K0FD.tmp\7za.exe" t "C:\Users\admin\AppData\Local\Temp\is-1K0FD.tmp\WGCArchive7z0C:\Users\admin\AppData\Local\Temp\is-1K0FD.tmp\7za.exe—world_of_warplanes_ww_install_eu_c9xcnl915num.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Standalone Console
Exit code:
0
Version:
16.04
Modules
Images
c:\users\admin\appdata\local\temp\is-1k0fd.tmp\7za.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1448"C:\ProgramData\Wargaming.net\GameCenter\wgc.exe" --install -g WOWP.WW.PRODUCTION@https://wgus-ru.wargaming.net/ --setLang -l en --session-id 72B8084FE9E8417DA5AD3D38E6A207F4 --event-sequence-number 12 --skipJobCheckC:\ProgramData\Wargaming.net\GameCenter\wgc.exe
wgc.exe
User:
admin
Company:
Wargaming.net
Integrity Level:
MEDIUM
Description:
Wargaming.net Game Center
Exit code:
0
Version:
21.01.00.4239
Modules
Images
c:\programdata\wargaming.net\gamecenter\wgc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1576"C:\Games\World_of_Warplanes\updates\redist\dxwebsetup.exe" /QC:\Games\World_of_Warplanes\updates\redist\dxwebsetup.exe
1516810735_dx9.0c_light.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
DirectX 9.0 Web setup
Exit code:
0
Version:
9.29.1974.0
Modules
Images
c:\games\world_of_warplanes\updates\redist\dxwebsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1960"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,11023472415796012155,6024947416443873472,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5728708644261754466 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2148"C:\Users\admin\Downloads\world_of_warplanes_ww_install_eu_c9xcnl915num.exe" C:\Users\admin\Downloads\world_of_warplanes_ww_install_eu_c9xcnl915num.exe
chrome.exe
User:
admin
Company:
Wargaming.net
Integrity Level:
MEDIUM
Description:
Wargaming.net Game Center
Exit code:
0
Version:
21.01.00.4239
Modules
Images
c:\users\admin\downloads\world_of_warplanes_ww_install_eu_c9xcnl915num.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2304C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2348"C:\Users\admin\AppData\Local\Temp\is-3QUCF.tmp\world_of_warplanes_ww_install_eu_c9xcnl915num.tmp" /SL5="$30190,4614494,797696,C:\Users\admin\Downloads\world_of_warplanes_ww_install_eu_c9xcnl915num.exe" C:\Users\admin\AppData\Local\Temp\is-3QUCF.tmp\world_of_warplanes_ww_install_eu_c9xcnl915num.tmp
world_of_warplanes_ww_install_eu_c9xcnl915num.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-3qucf.tmp\world_of_warplanes_ww_install_eu_c9xcnl915num.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2424"C:\ProgramData\Wargaming.net\GameCenter\WargamingErrorMonitor.exe" --pipe "parent_pid_14483301c2c4-e169-463c-9088-7d9049ab79f2" --superuserid "WGC" --self_crash_handling_folder "C:\ProgramData\Wargaming.net\GameCenter\cat " --self_crash_handling_receiver_url "http://cat.wargaming.net " --logs_folder_path " "C:\ProgramData\Wargaming.net\GameCenter\WargamingErrorMonitor.exe
wgc.exe
User:
admin
Company:
Wargaming.net
Integrity Level:
MEDIUM
Description:
Wargaming.net Error Monitor
Exit code:
0
Version:
03.01.01.2857
Modules
Images
c:\programdata\wargaming.net\gamecenter\wargamingerrormonitor.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
2476"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1000,11023472415796012155,6024947416443873472,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=16203952543806707605 --mojo-platform-channel-handle=1008 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
2 834
Read events
2 094
Write events
721
Delete events
19

Modification events

(PID) Process:(2880) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2880) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2880) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2880) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2880) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3072) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:2880-13260226614533375
Value:
259
(PID) Process:(2880) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2880) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2880) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3252-13245750958665039
Value:
0
(PID) Process:(2880) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
193
Suspicious files
195
Text files
1 546
Unknown types
102

Dropped files

PID
Process
Filename
Type
2880chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-604E6F37-B40.pma —
MD5:—
SHA256:—
2880chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\07a0a40e-fa9d-4a9f-9270-2efa1a63153a.tmp —
MD5:—
SHA256:—
2880chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp —
MD5:—
SHA256:—
2880chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old —
MD5:—
SHA256:—
2880chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
2880chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF14f192.TMPtext
MD5:—
SHA256:—
2880chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
2880chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:—
SHA256:—
2880chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
2880chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF14f49f.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
108
TCP/UDP connections
262
DNS requests
55
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2348
world_of_warplanes_ww_install_eu_c9xcnl915num.tmp
POST
200
92.223.20.10:80
http://wgusst-wgceu.wargaming.net/wgc/client_installation_finished
LU
—
—
whitelisted
2628
chrome.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D
US
der
471 b
whitelisted
2348
world_of_warplanes_ww_install_eu_c9xcnl915num.tmp
POST
200
92.223.20.10:80
http://wgusst-wgceu.wargaming.net/v2/wgc_installer_launch_v1
LU
—
—
whitelisted
2348
world_of_warplanes_ww_install_eu_c9xcnl915num.tmp
POST
200
92.223.20.10:80
http://wgusst-wgceu.wargaming.net/wgc/client_download_started
LU
—
—
whitelisted
2348
world_of_warplanes_ww_install_eu_c9xcnl915num.tmp
POST
200
92.223.20.10:80
http://wgusst-wgceu.wargaming.net/v2/wgc_download_start_v1
LU
—
—
whitelisted
2348
world_of_warplanes_ww_install_eu_c9xcnl915num.tmp
POST
200
92.223.20.10:80
http://wgusst-wgceu.wargaming.net/wgc/successful_client_install_click
LU
—
—
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAWNXRQaLO7zNLUa%2BEDcDk0%3D
US
der
471 b
whitelisted
2628
chrome.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEALO4Yw8%2BofLjvtgWz4Ku2Q%3D
US
der
471 b
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEA6oletf73%2FpUbOiVapyvd4%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2628
chrome.exe
185.12.240.10:443
www.wargaming.net
G-Core Labs S.A.
NL
unknown
2628
chrome.exe
172.217.16.141:443
accounts.google.com
Google Inc.
US
suspicious
—
—
185.12.240.10:443
www.wargaming.net
G-Core Labs S.A.
NL
unknown
2628
chrome.exe
185.12.240.10:80
www.wargaming.net
G-Core Labs S.A.
NL
unknown
2628
chrome.exe
92.223.124.254:443
cdn-cm.gcdn.co
G-Core Labs S.A.
DE
suspicious
2628
chrome.exe
142.250.186.168:443
www.googletagmanager.com
Google Inc.
US
suspicious
2628
chrome.exe
217.69.133.145:443
top-fwz1.mail.ru
Limited liability company Mail.Ru
RU
suspicious
2628
chrome.exe
92.223.20.117:443
cm-ru.wargaming.net
G-Core Labs S.A.
LU
unknown
2628
chrome.exe
142.250.185.142:443
www.google-analytics.com
Google Inc.
US
whitelisted
2628
chrome.exe
204.79.197.200:443
bat.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.wargaming.net
  • 185.12.240.10
  • 185.12.240.13
  • 92.223.17.165
  • 92.223.24.47
  • 92.223.24.46
  • 162.213.62.76
  • 92.223.17.190
  • 162.213.62.79
  • 185.12.240.12
unknown
accounts.google.com
  • 172.217.16.141
shared
ru.wargaming.net
  • 185.12.240.10
  • 185.12.240.12
  • 185.12.240.13
unknown
cdn-cm.gcdn.co
  • 92.223.124.254
suspicious
www.googletagmanager.com
  • 142.250.186.168
whitelisted
cm-ru.wargaming.net
  • 92.223.20.117
unknown
wgsw-ru.gcdn.co
  • 92.223.124.254
suspicious
www.google-analytics.com
  • 142.250.185.142
whitelisted
bat.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
top-fwz1.mail.ru
  • 217.69.133.145
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET P2P BitTorrent DHT ping request
1448
wgc.exe
Potential Corporate Privacy Violation
ET P2P Libtorrent User-Agent
1448
wgc.exe
Potential Corporate Privacy Violation
ET P2P Libtorrent User-Agent
1448
wgc.exe
Potential Corporate Privacy Violation
GPL P2P BitTorrent announce request
1448
wgc.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1448
wgc.exe
Potential Corporate Privacy Violation
ET P2P Libtorrent User-Agent
1448
wgc.exe
Potential Corporate Privacy Violation
GPL P2P BitTorrent announce request
—
—
Potential Corporate Privacy Violation
ET P2P possible torrent download
—
—
Potential Corporate Privacy Violation
ET P2P BitTorrent - Torrent File Downloaded
—
—
Potential Corporate Privacy Violation
ET P2P possible torrent download
Process
Message
wgc_renderer_host.exe
[0314/201941.110:ERROR:gl_surface_egl.cc(612)] EGL Driver message (Critical) eglInitialize: No available renderers.
wgc_renderer_host.exe
[0314/201941.113:ERROR:gl_surface_egl.cc(1057)] eglInitialize D3D11 failed with error EGL_NOT_INITIALIZED, trying next display type
wgc_renderer_host.exe
[0314/201942.303:ERROR:gl_surface_egl.cc(612)] EGL Driver message (Critical) eglInitialize: No available renderers.
wgc_renderer_host.exe
[0314/201942.309:ERROR:gl_surface_egl.cc(1057)] eglInitialize D3D9 failed with error EGL_NOT_INITIALIZED
wgc_renderer_host.exe
[0314/201942.315:ERROR:gl_initializer_win.cc(196)] GLSurfaceEGL::InitializeOneOff failed.
wgc_renderer_host.exe
[0314/201942.354:ERROR:viz_main_impl.cc(176)] Exiting GPU process due to errors during initialization
wgc.exe
[0314/201943.490:WARNING:gpu_process_host.cc(1220)] The GPU process has crashed 1 time(s)
wgc_renderer_host.exe
[0314/201944.266:ERROR:viz_main_impl.cc(176)] Exiting GPU process due to errors during initialization
wgc.exe
[0314/201945.347:WARNING:gpu_process_host.cc(1220)] The GPU process has crashed 2 time(s)
wgc.exe
[0314/201945.351:ERROR:browser_gpu_channel_host_factory.cc(138)] Failed to launch GPU process.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.wargaming.net