File name: | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe |
Full analysis: | https://app.any.run/tasks/75eb7784-5aed-4736-bb02-cce51b0f8350 |
Verdict: | Malicious activity |
Analysis date: | May 19, 2024, 00:16:02 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
MD5: | 5458EAB2F7D222EF567A13499B28D3F4 |
SHA1: | 39356932C9E2DE3DC9B7FB72BB017ACBDBF9F6CF |
SHA256: | F611412721215D3B55F9731860C68FAE7B0B68D25D87FBACEF484ED229C0E597 |
SSDEEP: | 98304:AJQj16Klu1DdYfKOwMiBy2Y2z3g6FCr/4IlGwDFx/udUaXddOxAL+iHsu3IdsXjN:wdfOp470n5yiWckJUZ7c |
.exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
---|---|---|
.exe | | | Win64 Executable (generic) (37.3) |
.dll | | | Win32 Dynamic Link Library (generic) (8.8) |
.exe | | | Win32 Executable (generic) (6) |
.exe | | | Generic Win/DOS Executable (2.7) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2023:07:02 02:11:15+00:00 |
ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
PEType: | PE32 |
LinkerVersion: | 6 |
CodeSize: | 28672 |
InitializedDataSize: | 150528 |
UninitializedDataSize: | 2048 |
EntryPoint: | 0x3ac9 |
OSVersion: | 4 |
ImageVersion: | 6 |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
FileVersionNumber: | 0.0.6.233 |
ProductVersionNumber: | 0.0.6.233 |
FileFlagsMask: | 0x0000 |
FileFlags: | (none) |
FileOS: | Win32 |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | Chinese (Simplified) |
CharacterSet: | Windows, Chinese (Simplified) |
Comments: | - |
CompanyName: | PROXIMA BETA PTE. LIMITED |
FileDescription: | - |
FileVersion: | 0.0.6.233 |
LegalCopyright: | - |
LegalTrademarks: | - |
ProductName: | ArenaBreakoutInfiniteMiniloader |
ProductVersion: | 0.0.6.233 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
328 | session=1 | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\tiny_dl\VersionService.exe | ArenaBreakoutInfiniteMiniloader.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
928 | "C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\ArenaBreakoutInfiniteMiniloader.exe" | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\ArenaBreakoutInfiniteMiniloader.exe | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Arena Breakout Infinite Minidown.exe Exit code: 0 Version: 0.0.6.243 Modules
| |||||||||||||||
1936 | "C:\Windows\regedit.exe" /s "C:\Users\admin\AppData\Roaming\arena_breakout_infinite_launcher.reg" | C:\Windows\regedit.exe | — | ArenaBreakoutInfiniteMiniloader.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Editor Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1948 | C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503} | C:\Windows\System32\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2020 | "C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe" | C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe | ArenaBreakoutInfiniteMiniloader.exe | ||||||||||||
User: admin Company: PROXIMA BETA PTE. LIMITED Integrity Level: HIGH Exit code: 1 Version: 0.0.6.764 Modules
| |||||||||||||||
2036 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2412 | "C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe" | C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe | — | explorer.exe | |||||||||||
User: admin Company: PROXIMA BETA PTE. LIMITED Integrity Level: MEDIUM Exit code: 3221226540 Version: 0.0.6.764 Modules
| |||||||||||||||
2668 | "C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe" | C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe | explorer.exe | ||||||||||||
User: admin Company: PROXIMA BETA PTE. LIMITED Integrity Level: HIGH Version: 0.0.6.764 Modules
| |||||||||||||||
2684 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\System32\taskmgr.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3976 | "C:\Users\admin\AppData\Local\Temp\ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe" | C:\Users\admin\AppData\Local\Temp\ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | — | explorer.exe | |||||||||||
User: admin Company: PROXIMA BETA PTE. LIMITED Integrity Level: MEDIUM Exit code: 3221226540 Version: 0.0.6.233 Modules
|
(PID) Process: | (1948) dllhost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
Operation: | write | Name: | Name |
Value: DllHost.exe | |||
(PID) Process: | (328) VersionService.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\arena_breakout_infinite_launcher.exe |
Operation: | write | Name: | InstallPath |
Value: C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe | |||
(PID) Process: | (328) VersionService.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\arena_breakout_infinite_launcher |
Operation: | write | Name: | UninstallString |
Value: C:\Arena Breakout Infinite\launcher\uninst.exe | |||
(PID) Process: | (328) VersionService.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\arena_breakout_infinite_launcher |
Operation: | write | Name: | DisplayName |
Value: Arena Breakout Infinite | |||
(PID) Process: | (328) VersionService.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\arena_breakout_infinite_launcher |
Operation: | write | Name: | Publisher |
Value: | |||
(PID) Process: | (328) VersionService.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\arena_breakout_infinite_launcher |
Operation: | write | Name: | DisplayIcon |
Value: C:\Arena Breakout Infinite\launcher\arena_breakout_infinite_launcher.exe | |||
(PID) Process: | (328) VersionService.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\arena_breakout_infinite_launcher |
Operation: | write | Name: | DisplayVersion |
Value: %version% | |||
(PID) Process: | (928) ArenaBreakoutInfiniteMiniloader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
Operation: | delete value | Name: | MiniDown |
Value: | |||
(PID) Process: | (928) ArenaBreakoutInfiniteMiniloader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (928) ArenaBreakoutInfiniteMiniloader.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
4088 | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\install_script.dat | binary | |
MD5:371B8AA322670F3DB28995DAE3D58D7E | SHA256:D7130E4C76E1EFFFB6D60F083E5A241BD9CA454B1227E92A876FAA65B50C05E4 | |||
328 | VersionService.exe | C:\Arena Breakout Infinite\launcher\.tiny_cache\Game_7000020.local | binary | |
MD5:E1627810DEDA2DC9AB18E1B1E2931552 | SHA256:5C837FD136429D8C48F4698716CBA8663DECCBA6DC710CE97A3AF0C2ED1D09C2 | |||
4088 | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\ArenaBreakoutInfiniteMiniloader.exe | executable | |
MD5:57071249CC1901683239ED3AC0869CF2 | SHA256:9BD9B558C9604B2C1C777589A11CAC85153B73FEF50158848CB2457B1B39B95E | |||
4088 | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\LogConfig.ini | text | |
MD5:1E8CF5946A37D9A084BE613554260815 | SHA256:E8A59173F505DBEDF4DD37EEC210E5E539A243E46F521A8BA8D2EC13FD99D29F | |||
328 | VersionService.exe | C:\Arena Breakout Infinite\launcher\game_install_desc.dat | binary | |
MD5:D071FFFCD41ADB7F5EA164FD06B7CE02 | SHA256:B8C22CE91ACBAF1F97487651A374E17FD76942AFC3A442B0488EA9995B5DF2EA | |||
328 | VersionService.exe | C:\Arena Breakout Infinite\launcher\service\webview_bitmap\dark\font.json | binary | |
MD5:B44CDB9BE56C70F6908E44E300A059A4 | SHA256:DF75AE2222EC161F210A53D5DBB5585FC6D553CE4564F104B5502892CC4EA7D1 | |||
4088 | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\icon.ico | image | |
MD5:2F8CEFFB30839715D67FB63279258FC6 | SHA256:72138A9F79E0CDC9D48D6EE2C340AD2A209D64B879BAF0863DDDB18E3E3BE0BE | |||
4088 | ArenaBreakoutInfiniteMiniloader0.0.6.233(sg).exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\Minidown.xml | binary | |
MD5:F78E002B2148424752E67236B5B01E2A | SHA256:7495B2F94B6B1D22B2C16391AEB3C14E96EDA836B1BDFD664D11385A19137D3F | |||
928 | ArenaBreakoutInfiniteMiniloader.exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\LocalEncry.xml | binary | |
MD5:B4DB471571B43646FC74E997938F257B | SHA256:2A6D50B6BC3519A8D384FCEFFF6A057361DB4F6FF8A58975F49E8548A564950C | |||
928 | ArenaBreakoutInfiniteMiniloader.exe | C:\Users\admin\AppData\Local\ArenaBreakoutInfiniteMiniloader\Local.xml | xml | |
MD5:A6619BCB25F8D87E384689967797A176 | SHA256:10ACEE66F9297D9BF3242473F54FE7362B34D078BFF67A5870216954E4C1AD03 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | unknown |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
928 | ArenaBreakoutInfiniteMiniloader.exe | 54.177.46.191:443 | www.jupiterlauncher.com | AMAZON-02 | US | unknown |
928 | ArenaBreakoutInfiniteMiniloader.exe | 43.134.152.122:443 | sg.jupiterlauncher.com | Tencent Building, Kejizhongyi Avenue | SG | unknown |
928 | ArenaBreakoutInfiniteMiniloader.exe | 54.183.178.142:443 | na.fleetlogd.com | AMAZON-02 | US | unknown |
328 | VersionService.exe | 43.134.152.122:443 | sg.jupiterlauncher.com | Tencent Building, Kejizhongyi Avenue | SG | unknown |
328 | VersionService.exe | 43.152.26.151:443 | cdn-client.arenabreakoutinfinite.com | ACE | DE | unknown |
928 | ArenaBreakoutInfiniteMiniloader.exe | 54.183.140.198:443 | na.fleetlogd.com | AMAZON-02 | US | unknown |
Domain | IP | Reputation |
---|---|---|
www.jupiterlauncher.com |
| unknown |
sg.jupiterlauncher.com |
| unknown |
na.fleetlogd.com |
| unknown |
cdn-client.arenabreakoutinfinite.com |
| unknown |
pc.bugly.qcloud.com |
| unknown |
Process | Message |
---|---|
ArenaBreakoutInfiniteMiniloader.exe | {"result":{"error_code":0,"error_message":"COMM_SUCC"}} |
ArenaBreakoutInfiniteMiniloader.exe | {"result":{"error_code":0,"error_message":"COMM_SUCC"}} |
ArenaBreakoutInfiniteMiniloader.exe | {"result":{"error_code":0,"error_message":"COMM_SUCC"}} |
ArenaBreakoutInfiniteMiniloader.exe | {"result":{"error_code":0,"error_message":"COMM_SUCC"}} |
arena_breakout_infinite_launcher.exe | |
arena_breakout_infinite_launcher.exe | [2024-05-19 01:18:00 904] | Info | [GCloudCore] |1900| Logger.mm:129|LogCreateThread| CreateThread RemoveOldLogFilesThread:0000017C |
arena_breakout_infinite_launcher.exe | [2024-05-19 01:18:00 904] | Info | [GCloudCore] |1900| Logger.mm:634|ABase::Logger::Init| log init module GCloudCore, logMode 0, sync:1, use mmap:1, mmap cost 0 us |
arena_breakout_infinite_launcher.exe | [2024-05-19 01:18:00 904] | Info | [GCloudCore] |1900| EncryptedIniFileImp.cpp:128|ABase::EncryptedIniFileImpl::Load| config file C:\Arena Breakout Infinite\launcher/Cache\RemoteConfig.config is not exist |
arena_breakout_infinite_launcher.exe | |
arena_breakout_infinite_launcher.exe | [2024-05-19 01:18:00 904] | Info | [GCloudCore] |1900| IniFileImp.cpp:81|ABase::CIniFileImpl::CIniFileImpl| load config file cost 0 us |