URL:

https://cdn.gxx.garenanow.com/gxx/pc/installer/Garena-v2.0.exe

Full analysis: https://app.any.run/tasks/5efd5df1-bfb2-41ad-80f0-4458f00b9b57
Verdict: Malicious activity
Analysis date: February 16, 2024, 17:32:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

BB99ACD2A33C4635E65F3CCAD6057855

SHA1:

9AA7C7FDA74AEF51178542D970E0854CA4FB1AB2

SHA256:

C7AF7E2D5B054EBB047C35C630368A8FFBD7727958E9B69FEF53FABE7BE62D06

SSDEEP:

3:N8cGJHQYobyRgOXKQ9TXLhN:2cQHSGgOXrbhN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Garena-v2.0.exe (PID: 552)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • Garena-v2.0.exe (PID: 552)

    • Executable content was dropped or overwritten

      • Garena-v2.0.exe (PID: 552)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Garena-v2.0.exe (PID: 552)

    • Process drops legitimate windows executable

      • Garena-v2.0.exe (PID: 552)

    • Executes as Windows Service

      • gxxsvc.exe (PID: 392)

    • Creates a software uninstall entry

      • Garena-v2.0.exe (PID: 552)

    • The process drops C-runtime libraries

      • Garena-v2.0.exe (PID: 552)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3668)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3668)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3348)

    • Checks supported languages

      • Garena-v2.0.exe (PID: 552)
      • gxxsvc.exe (PID: 2740)
      • gxxsvc.exe (PID: 3768)
      • gxxsvc.exe (PID: 392)
      • Garena.exe (PID: 120)

    • Reads the computer name

      • Garena-v2.0.exe (PID: 552)
      • gxxsvc.exe (PID: 2740)
      • gxxsvc.exe (PID: 392)
      • gxxsvc.exe (PID: 3768)
      • Garena.exe (PID: 120)

    • Manual execution by a user

      • WINWORD.EXE (PID: 3072)
      • WINWORD.EXE (PID: 2756)
      • WINWORD.EXE (PID: 2240)
      • Garena.exe (PID: 120)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3348)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3668)

    • Create files in a temporary directory

      • Garena-v2.0.exe (PID: 552)

    • Creates files in the program directory

      • Garena-v2.0.exe (PID: 552)
      • gxxsvc.exe (PID: 2740)
      • Garena.exe (PID: 120)

    • Reads the machine GUID from the registry

      • Garena.exe (PID: 120)
      • Garena-v2.0.exe (PID: 552)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
12
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winword.exe no specs winword.exe no specs winword.exe no specs PhotoViewer.dll no specs garena-v2.0.exe no specs garena-v2.0.exe gxxsvc.exe no specs gxxsvc.exe no specs gxxsvc.exe no specs garena.exe

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Program Files\Garena\Garena\Garena.exe" -lang en -firstlaunchC:\Program Files\Garena\Garena\Garena.exe
explorer.exe
User:
admin
Company:
Garena Online
Integrity Level:
MEDIUM
Description:
Garena Platform
Exit code:
0
Version:
2019.09.26.1823
Modules
Images
c:\program files\garena\garena\garena.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
392"C:\Program Files\Garena\Garena\2.0.1909.2618\gxxsvc.exe" runC:\Program Files\Garena\Garena\2.0.1909.2618\gxxsvc.exe—services.exe
User:
SYSTEM
Company:
Garena Online
Integrity Level:
SYSTEM
Description:
Garena platform service
Exit code:
0
Version:
2019.09.26.1824
Modules
Images
c:\program files\garena\garena\2.0.1909.2618\gxxsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
480"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Garena-v2.0.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Garena-v2.0.exe—iexplore.exe
User:
admin
Company:
Garena
Integrity Level:
MEDIUM
Description:
Garena Installer
Exit code:
3221226540
Version:
2.0.1909.2618
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\garena-v2.0.exe
c:\windows\system32\ntdll.dll
552"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Garena-v2.0.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Garena-v2.0.exe
iexplore.exe
User:
admin
Company:
Garena
Integrity Level:
HIGH
Description:
Garena Installer
Exit code:
1
Version:
2.0.1909.2618
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\garena-v2.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2176C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2240"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\sellbook.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2740"C:\Program Files\Garena\Garena\2.0.1909.2618\gxxsvc.exe" uninstallC:\Program Files\Garena\Garena\2.0.1909.2618\gxxsvc.exe—Garena-v2.0.exe
User:
admin
Company:
Garena Online
Integrity Level:
HIGH
Description:
Garena platform service
Exit code:
0
Version:
2019.09.26.1824
Modules
Images
c:\program files\garena\garena\2.0.1909.2618\gxxsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2756"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\publishingbest.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3072"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\xmlie.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3348"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3668 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
43 244
Read events
41 663
Write events
604
Delete events
977

Modification events

(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
856759376
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31088894
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31088894
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
Executable files
98
Suspicious files
95
Text files
147
Unknown types
40

Dropped files

PID
Process
Filename
Type
3668iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:DBC2B99EE8F91ED3892126D3DA54AAB4
SHA256:23BF92ADCBB38E38071BA3388C52C279A7288228C5C35314AD594791972AF0EF
3348iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:6C234D7D9A7CB5CC6D7F3F8132581814
SHA256:56B6E2399CD702830C9869D26156CF6F436187A8C1826AD0AC91A47E0DE3639A
3348iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:89775095205084716FA74327A76FA884
SHA256:04BC275D60C2D4EB83BE961AA8BCE1E08E7743986FBA309E0BF1C2E77B0C79D9
3668iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xmlxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
3668iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:0D63EA152076F1330611F78545C56CDB
SHA256:97E3D231D2E59243BA5FE7D80AF472C1C44F14E31433DA0D2D42E9A6146E0DCD
3668iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver6BB5.tmpxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
3348iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_D813440494A195256BD8324FC506AE99binary
MD5:8EF3B01728094B2D2E9BDA3EEE7EB952
SHA256:797D959CAC9A6A2C6AE37879604B494042399D12BE7F5B3A3209286208878D60
3348iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:CAB6225B861674F37BA35D7241B4D9D6
SHA256:07AA9F1727174FFF61ED1F695EB071AD1113190CF02A7FEBC878E38B8C38941A
3348iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\Garena-v2.0[1].exeexecutable
MD5:B4AB4F5EE78642383C0902D723189DBB
SHA256:B17BA97EE403D50F0548E266485EFCE4027B844DD79A2711E87060AC46A1EE2E
3668iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF9FACF5D589B1EFD3.TMPbinary
MD5:CCAFC64ECD96FE46EA5224EBAA32DC5D
SHA256:3F0FA365F00FFF256DBC51152E7C5549EE753F01D0CF05BF6504637AD9427EC7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
34
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3348
iexplore.exe
GET
304
184.24.77.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f78d505714a595e3
unknown
—
—
unknown
3348
iexplore.exe
GET
304
184.24.77.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?545e1839169dd0e6
unknown
—
—
unknown
3348
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
binary
471 b
unknown
3348
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAkrZJnbtHSw4BDBj7VHN8Q%3D
unknown
binary
471 b
unknown
3668
iexplore.exe
GET
304
173.222.108.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b0be6f4ad90be2e5
unknown
—
—
unknown
3668
iexplore.exe
GET
304
173.222.108.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?70d85e3b0e586cab
unknown
—
—
unknown
3668
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
200
173.222.108.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e90c163b6659448e
unknown
compressed
65.2 Kb
unknown
3668
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
unknown
binary
471 b
unknown
3668
iexplore.exe
GET
304
173.222.108.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e55f0cb727843010
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3348
iexplore.exe
2.21.20.146:443
cdn.gxx.garenanow.com
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3348
iexplore.exe
184.24.77.201:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3348
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3668
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
EDGECAST
US
whitelisted
3668
iexplore.exe
173.222.108.201:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3668
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1080
svchost.exe
173.222.108.201:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown

DNS requests

Domain
IP
Reputation
cdn.gxx.garenanow.com
  • 2.21.20.146
  • 2.21.20.134
whitelisted
ctldl.windowsupdate.com
  • 184.24.77.201
  • 184.24.77.174
  • 184.24.77.205
  • 184.24.77.172
  • 184.24.77.178
  • 184.24.77.207
  • 184.24.77.208
  • 184.24.77.175
  • 184.24.77.177
  • 173.222.108.201
  • 173.222.108.179
  • 173.222.108.195
  • 173.222.108.210
  • 173.222.108.241
  • 173.222.108.226
  • 173.222.108.203
  • 173.222.108.147
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 23.32.186.57
whitelisted
www.msn.com
  • 204.79.197.203
whitelisted
statscollection.garenanow.com
  • 203.117.172.231
unknown
udp.gxx.garenanow.com
  • 103.247.205.11
  • 103.247.205.12
  • 103.247.205.13
unknown

Threats

No threats detected
Process
Message
Garena-v2.0.exe
{"id":"gxx","action":"0","data":{"ver":"2.0.1909.2618", "patch":"0", "stage":"init"}}
Garena-v2.0.exe
SVCHOST.EXE
Garena-v2.0.exe
SVCHOST.EXE
Garena-v2.0.exe
IMEDICTUPDATE.EXE
Garena-v2.0.exe
SVCHOST.EXE
Garena-v2.0.exe
TASKHOST.EXE
Garena-v2.0.exe
TASKENG.EXE
Garena-v2.0.exe
DWM.EXE
Garena-v2.0.exe
EXPLORER.EXE
Garena-v2.0.exe
CTFMON.EXE
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cdn.gxx.garenanow.com/gxx/pc/installer/Garena-v2.0.exe