| File name: | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe |
| Full analysis: | https://app.any.run/tasks/75eb7784-5aed-4736-bb02-cce51b0f8350 |
| Verdict: | Malicious activity |
| Analysis date: | May 19, 2024, 00:16:02 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| MD5: | 5458EAB2F7D222EF567A13499B28D3F4 |
| SHA1: | 39356932C9E2DE3DC9B7FB72BB017ACBDBF9F6CF |
| SHA256: | F611412721215D3B55F9731860C68FAE7B0B68D25D87FBACEF484ED229C0E597 |
| SSDEEP: | 98304:AJQj16Klu1DdYfKOwMiBy2Y2z3g6FCr/4IlGwDFx/udUaXddOxAL+iHsu3IdsXjN:wdfOp470n5yiWckJUZ7c |
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:07:02 02:11:15+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 28672 |
| InitializedDataSize: | 150528 |
| UninitializedDataSize: | 2048 |
| EntryPoint: | 0x3ac9 |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.0.6.233 |
| ProductVersionNumber: | 0.0.6.233 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Windows, Chinese (Simplified) |
| Comments: | - |
| CompanyName: | PROXIMA BETA PTE. LIMITED |
| FileDescription: | - |
| FileVersion: | 0.0.6.233 |
| LegalCopyright: | - |
| LegalTrademarks: | - |
| ProductName: | ArenaBreakoutInfiniteMiniloader |
| ProductVersion: | 0.0.6.233 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 328 | session=1 | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\tiny_dl\VersionService.exe | ArenaBreakoutInfiniteMiniloader.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 928 | "C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\ArenaBreakoutInfiniteMiniloader.exe" | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\ArenaBreakoutInfiniteMiniloader.exe | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Arena Breakout Infinite Minidown.exe Exit code: 0 Version: 0.0.6.243 Modules
| |||||||||||||||
| 1936 | "C:\Windows\regedit.exe" /s "C:\Users\admin\AppData\Roaming\arena_breakout_infinite_launcher.reg" | C:\Windows\regedit.exe | — | ArenaBreakoutInfiniteMiniloader.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Editor Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1948 | C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503} | C:\Windows\System32\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2020 | "C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe" | C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe | ArenaBreakoutInfiniteMiniloader.exe | ||||||||||||
User: admin Company: PROXIMA BETA PTE. LIMITED Integrity Level: HIGH Exit code: 1 Version: 0.0.6.764 Modules
| |||||||||||||||
| 2036 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2412 | "C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe" | C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe | — | explorer.exe | |||||||||||
User: admin Company: PROXIMA BETA PTE. LIMITED Integrity Level: MEDIUM Exit code: 3221226540 Version: 0.0.6.764 Modules
| |||||||||||||||
| 2668 | "C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe" | C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe | explorer.exe | ||||||||||||
User: admin Company: PROXIMA BETA PTE. LIMITED Integrity Level: HIGH Version: 0.0.6.764 Modules
| |||||||||||||||
| 2684 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\System32\taskmgr.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3976 | "C:\Users\admin\AppData\Local\Temp\ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe" | C:\Users\admin\AppData\Local\Temp\ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | — | explorer.exe | |||||||||||
User: admin Company: PROXIMA BETA PTE. LIMITED Integrity Level: MEDIUM Exit code: 3221226540 Version: 0.0.6.233 Modules
| |||||||||||||||
| (PID) Process: | (1948) dllhost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: DllHost.exe | |||
| (PID) Process: | (328) VersionService.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\arena_breakout_infinite_launcher.exe |
| Operation: | write | Name: | InstallPath |
Value: C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe | |||
| (PID) Process: | (328) VersionService.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\arena_breakout_infinite_launcher |
| Operation: | write | Name: | UninstallString |
Value: C:\Arena Breakout Infinite\launcher\uninst.exe | |||
| (PID) Process: | (328) VersionService.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\arena_breakout_infinite_launcher |
| Operation: | write | Name: | DisplayName |
Value: Arena Breakout Infinite | |||
| (PID) Process: | (328) VersionService.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\arena_breakout_infinite_launcher |
| Operation: | write | Name: | Publisher |
Value: | |||
| (PID) Process: | (328) VersionService.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\arena_breakout_infinite_launcher |
| Operation: | write | Name: | DisplayIcon |
Value: C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe | |||
| (PID) Process: | (328) VersionService.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\arena_breakout_infinite_launcher |
| Operation: | write | Name: | DisplayVersion |
Value: %version% | |||
| (PID) Process: | (928) ArenaBreakoutInfiniteMiniloader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | delete value | Name: | MiniDown |
Value: | |||
| (PID) Process: | (928) ArenaBreakoutInfiniteMiniloader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (928) ArenaBreakoutInfiniteMiniloader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4088 | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\res.zip | compressed | |
MD5:132F790403980468C033BBE728B2DF01 | SHA256:69B640213E1D147AC44733A4EC0F33899F1AE8C5266E4401B887DB4AC7CFD995 | |||
| 4088 | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\bugreport.ini | text | |
MD5:27EC1E105337C0AD4BDDB8F2A9551F6C | SHA256:ED60CA6895464814F9E5BC132F41645630CC785FAE9FC7DA6362B5690B3A97CD | |||
| 4088 | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\Minidown.xml | binary | |
MD5:F78E002B2148424752E67236B5B01E2A | SHA256:7495B2F94B6B1D22B2C16391AEB3C14E96EDA836B1BDFD664D11385A19137D3F | |||
| 4088 | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\LogConfig.ini | text | |
MD5:1E8CF5946A37D9A084BE613554260815 | SHA256:E8A59173F505DBEDF4DD37EEC210E5E539A243E46F521A8BA8D2EC13FD99D29F | |||
| 928 | ArenaBreakoutInfiniteMiniloader.exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\LocalEncry.xml | binary | |
MD5:B4DB471571B43646FC74E997938F257B | SHA256:2A6D50B6BC3519A8D384FCEFFF6A057361DB4F6FF8A58975F49E8548A564950C | |||
| 4088 | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\ArenaBreakoutInfiniteMiniloader.exe | executable | |
MD5:57071249CC1901683239ED3AC0869CF2 | SHA256:9BD9B558C9604B2C1C777589A11CAC85153B73FEF50158848CB2457B1B39B95E | |||
| 4088 | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\tiny_dl\VersionServiceProxy.dll | executable | |
MD5:84C64681E1946DFA91EFDB3EB37654B1 | SHA256:A8C3C58C9350EB9364683B22230439026519199E7D86799023140BBA9A6A244C | |||
| 4088 | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\icon.ico | image | |
MD5:2F8CEFFB30839715D67FB63279258FC6 | SHA256:72138A9F79E0CDC9D48D6EE2C340AD2A209D64B879BAF0863DDDB18E3E3BE0BE | |||
| 328 | VersionService.exe | C:\Arena Breakout Infinite\launcher\game_install_desc.dat | binary | |
MD5:D071FFFCD41ADB7F5EA164FD06B7CE02 | SHA256:B8C22CE91ACBAF1F97487651A374E17FD76942AFC3A442B0488EA9995B5DF2EA | |||
| 328 | VersionService.exe | C:\Arena Breakout Infinite\launcher\Assistant.ini | ini | |
MD5:2A2D7090764FD95B1CFD9B17D9FD9F40 | SHA256:197B06085058B0C63D34B3D22F41FC3B69E4B38F4C709F63E41539D215990647 | |||
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
928 | ArenaBreakoutInfiniteMiniloader.exe | 54.177.46.191:443 | www.jupiterlauncher.com | AMAZON-02 | US | unknown |
928 | ArenaBreakoutInfiniteMiniloader.exe | 43.134.152.122:443 | sg.jupiterlauncher.com | Tencent Building, Kejizhongyi Avenue | SG | unknown |
928 | ArenaBreakoutInfiniteMiniloader.exe | 54.183.178.142:443 | na.fleetlogd.com | AMAZON-02 | US | unknown |
328 | VersionService.exe | 43.134.152.122:443 | sg.jupiterlauncher.com | Tencent Building, Kejizhongyi Avenue | SG | unknown |
328 | VersionService.exe | 43.152.26.151:443 | cdn-client.arenabreakoutinfinite.com | ACE | DE | unknown |
928 | ArenaBreakoutInfiniteMiniloader.exe | 54.183.140.198:443 | na.fleetlogd.com | AMAZON-02 | US | unknown |
Domain | IP | Reputation |
|---|---|---|
www.jupiterlauncher.com |
| unknown |
sg.jupiterlauncher.com |
| unknown |
na.fleetlogd.com |
| unknown |
cdn-client.arenabreakoutinfinite.com |
| unknown |
pc.bugly.qcloud.com |
| unknown |
Process | Message |
|---|---|
ArenaBreakoutInfiniteMiniloader.exe | {"result":{"error_code":0,"error_message":"COMM_SUCC"}} |
ArenaBreakoutInfiniteMiniloader.exe | {"result":{"error_code":0,"error_message":"COMM_SUCC"}} |
ArenaBreakoutInfiniteMiniloader.exe | {"result":{"error_code":0,"error_message":"COMM_SUCC"}} |
ArenaBreakoutInfiniteMiniloader.exe | {"result":{"error_code":0,"error_message":"COMM_SUCC"}} |
arena_breakout_infinite_launcher.exe | |
arena_breakout_infinite_launcher.exe | [2024-05-19 01:18:00 904] | Info | [GCloudCore] |1900| Logger.mm:129|LogCreateThread| CreateThread RemoveOldLogFilesThread:0000017C |
arena_breakout_infinite_launcher.exe | [2024-05-19 01:18:00 904] | Info | [GCloudCore] |1900| Logger.mm:634|ABase::Logger::Init| log init module GCloudCore, logMode 0, sync:1, use mmap:1, mmap cost 0 us |
arena_breakout_infinite_launcher.exe | [2024-05-19 01:18:00 904] | Info | [GCloudCore] |1900| EncryptedIniFileImp.cpp:128|ABase::EncryptedIniFileImpl::Load| config file C:\Arena Breakout Infinite\launcher/Cache\RemoteConfig.config is not exist |
arena_breakout_infinite_launcher.exe | |
arena_breakout_infinite_launcher.exe | [2024-05-19 01:18:00 904] | Info | [GCloudCore] |1900| IniFileImp.cpp:81|ABase::CIniFileImpl::CIniFileImpl| load config file cost 0 us |