File name:

ArmouryCrateInstaller.exe

Full analysis: https://app.any.run/tasks/e33a0e57-292b-42bf-828f-924984e9df0d
Verdict: Malicious activity
Analysis date: July 23, 2024, 20:07:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (console) x86-64, for MS Windows
MD5:

363769A37B55839971D893CDC9E1B881

SHA1:

BEEA1942853E03A52954E599E0C57A6E2E39A264

SHA256:

04C94126555FC301587D09E83990E43092136E2EA372D33B65A1F31824CCAF75

SSDEEP:

98304:kyNUmqSyGl2BnAuSM1ytX7X7JKR7jLVW0Whm9T5etUqbBiKhOFYMLlt1DMbADJEF:O/+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ArmouryCrateInstaller.exe (PID: 5632)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • ArmouryCrateInstaller.exe (PID: 5632)

    • Reads security settings of Internet Explorer

      • ArmouryCrateInstaller.exe (PID: 5632)
      • Armoury Crate Installer.exe (PID: 5532)
      • Armoury Crate Installer.exe (PID: 4552)
      • ShellExperienceHost.exe (PID: 6888)

    • Executable content was dropped or overwritten

      • ArmouryCrateInstaller.exe (PID: 5632)

    • Executes as Windows Service

      • AsusROGLSLService.exe (PID: 1504)

  • INFO

    • Creates files in the program directory

      • ArmouryCrateInstaller.exe (PID: 5632)
      • AsusROGLSLService.exe (PID: 5276)
      • AsusROGLSLService.exe (PID: 1504)
      • Armoury Crate Installer.exe (PID: 5532)
      • Armoury Crate Installer.exe (PID: 4552)

    • Reads the computer name

      • ArmouryCrateInstaller.exe (PID: 5632)
      • AsusROGLSLService.exe (PID: 5276)
      • AsusROGLSLService.exe (PID: 4880)
      • AsusROGLSLService.exe (PID: 1504)
      • Armoury Crate Installer.exe (PID: 5532)
      • Armoury Crate Installer.exe (PID: 4552)
      • ShellExperienceHost.exe (PID: 6888)

    • Checks supported languages

      • ArmouryCrateInstaller.exe (PID: 5632)
      • AsusROGLSLService.exe (PID: 5276)
      • Armoury Crate Installer.exe (PID: 4552)
      • AsusROGLSLService.exe (PID: 4880)
      • AsusROGLSLService.exe (PID: 1504)
      • Armoury Crate Installer.exe (PID: 5532)
      • ShellExperienceHost.exe (PID: 6888)

    • Process checks computer location settings

      • ArmouryCrateInstaller.exe (PID: 5632)

    • Reads the software policy settings

      • slui.exe (PID: 1148)

    • Checks proxy server information

      • slui.exe (PID: 1148)

    • Reads the machine GUID from the registry

      • Armoury Crate Installer.exe (PID: 4552)
      • Armoury Crate Installer.exe (PID: 5532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (49.3)
.exe | Win64 Executable (generic) (32.7)
.dll | Win32 Dynamic Link Library (generic) (7.8)
.exe | Win32 Executable (generic) (5.3)
.exe | Generic Win/DOS Executable (2.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:09:12 10:55:20+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.16
CodeSize: 212992
InitializedDataSize: 3700736
UninitializedDataSize: -
EntryPoint: 0x14174
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 3.2.9.1
ProductVersionNumber: 3.2.9.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral 2
CharacterSet: Unicode
CompanyName: ASUS
FileDescription: The installer for Armoury Crate and Aura Creator.
FileVersion: 3.2.9.1
LegalCopyright: Copyright (C) 2019
OriginalFileName: ArmouryCrateInstaller.exe
ProductVersion: 3.2.9.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
13
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start armourycrateinstaller.exe conhost.exe no specs asusroglslservice.exe no specs conhost.exe no specs asusroglslservice.exe no specs conhost.exe no specs asusroglslservice.exe armoury crate installer.exe no specs slui.exe no specs slui.exe armoury crate installer.exe no specs shellexperiencehost.exe no specs armourycrateinstaller.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ArmouryCrateInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1148C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1504"C:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe" -runserviceC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe
services.exe
User:
SYSTEM
Company:
ASUS
Integrity Level:
SYSTEM
Exit code:
0
Version:
2.3.7.2
Modules
Images
c:\program files (x86)\asus\asusroglslservice\asusroglslservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3140"C:\Users\admin\AppData\Local\Temp\ArmouryCrateInstaller.exe" C:\Users\admin\AppData\Local\Temp\ArmouryCrateInstaller.exe—explorer.exe
User:
admin
Company:
ASUS
Integrity Level:
MEDIUM
Description:
The installer for Armoury Crate and Aura Creator.
Exit code:
3221226540
Version:
3.2.9.1
Modules
Images
c:\users\admin\appdata\local\temp\armourycrateinstaller.exe
c:\windows\system32\ntdll.dll
4180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AsusROGLSLService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4552"C:\Program Files (x86)\ASUS\AsusROGLSLService\Armoury Crate Installer.exe" -roglsloaderstart -win armourycrate -networkerrorC:\Program Files (x86)\ASUS\AsusROGLSLService\Armoury Crate Installer.exe—AsusROGLSLService.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Armoury Crate Installer
Exit code:
21865
Version:
2.3.9.1
Modules
Images
c:\program files (x86)\asus\asusroglslservice\armoury crate installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4880"C:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe" -installC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe—ArmouryCrateInstaller.exe
User:
admin
Company:
ASUS
Integrity Level:
HIGH
Exit code:
0
Version:
2.3.7.2
Modules
Images
c:\program files (x86)\asus\asusroglslservice\asusroglslservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5276"C:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe" -removeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe—ArmouryCrateInstaller.exe
User:
admin
Company:
ASUS
Integrity Level:
HIGH
Exit code:
0
Version:
2.3.7.2
Modules
Images
c:\program files (x86)\asus\asusroglslservice\asusroglslservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5532"C:\Program Files (x86)\ASUS\AsusROGLSLService\Armoury Crate Installer.exe" -roglsloaderstart -win armourycrate -acinstallerC:\Program Files (x86)\ASUS\AsusROGLSLService\Armoury Crate Installer.exe—AsusROGLSLService.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Armoury Crate Installer
Exit code:
21859
Version:
2.3.9.1
Modules
Images
c:\program files (x86)\asus\asusroglslservice\armoury crate installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5632"C:\Users\admin\AppData\Local\Temp\ArmouryCrateInstaller.exe" C:\Users\admin\AppData\Local\Temp\ArmouryCrateInstaller.exe
explorer.exe
User:
admin
Company:
ASUS
Integrity Level:
HIGH
Description:
The installer for Armoury Crate and Aura Creator.
Exit code:
0
Version:
3.2.9.1
Modules
Images
c:\users\admin\appdata\local\temp\armourycrateinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
6 248
Read events
6 228
Write events
18
Delete events
2

Modification events

(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:ACInstallPath
Value:
C:\Users\admin\AppData\Local\Temp
(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:InstallFinish
Value:
0
(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:delete valueName:aaiu
Value:
(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:delete valueName:InstallerSilentMode
Value:
(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4880) AsusROGLSLService.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:aaiu
Value:
0
(PID) Process:(5532) Armoury Crate Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\CUAS\DefaultCompositionWindow
Operation:writeName:Left
Value:
0
Executable files
9
Suspicious files
0
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
5632ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsZip.exeexecutable
MD5:9131A40E5770D1170C3093FB0D2F6F63
SHA256:FCF8D154E6B37985434F991B048CEF457DE123DD5A553EF3C6B28A67FB8A3987
5632ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsZip.dllexecutable
MD5:964068210EDCB3631F02E45856EB291E
SHA256:4CF079D4D7A154CD93F65934B5D115F07AF8F25EE24930E6CC606DFB0AEA2A4E
5632ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\QueryUWP.exeexecutable
MD5:040D1F9B8554F4452473F655C0898A12
SHA256:E96FC05448DEE664BD0CC011E983E98ECF7AB2904AAB25BE401B1EE994141EF9
5632ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusGCGridServiceSetup.exeexecutable
MD5:242C0332DB5EBA361CC3628DFAB5CE56
SHA256:BCC843B036C22AD4A1485E62C2ED5CA88F33688FA919C73276B93D4CDBE83347
5632ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exeexecutable
MD5:86E566859931EB59E740ACD08F9747C8
SHA256:D3F85929507CB5B8D38B90BE7A49DCE0266071DCECAD11619674152B0AEDE293
1504AsusROGLSLService.exeC:\ProgramData\ASUS\ALL\ACLoader\ACSE.initext
MD5:4F026ECA5B14DF508C82CD572C847F01
SHA256:85BCDF4D34A5DF7C28C0C506A861936E7077D57CFF632C7B9CFDD609BCBB4380
5276AsusROGLSLService.exeC:\ProgramData\ASUS\ALL\ACLoader\AsusROGLSLService.logtext
MD5:DC7A87483870EB6EFB7DBE6CE61C9BBF
SHA256:C918FE217F8B637E9E6F25F1FB20B45141E977F513F30D7032A8B6F12EF7D94A
5632ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\Newtonsoft.Json.dllexecutable
MD5:081D9558BBB7ADCE142DA153B2D5577A
SHA256:B624949DF8B0E3A6153FDFB730A7C6F4990B6592EE0D922E1788433D276610F3
5532Armoury Crate Installer.exeC:\ProgramData\ASUS\ALL\ACLoader\ROGLSLoaderUI.Util_Util_20240723200714.logtext
MD5:A5EFD44CCED473503D8D3C9CB7DDE84C
SHA256:E05F83D56A8D593388C506153578145FA26516E23BD6E46E12CEED48AD559C37
5532Armoury Crate Installer.exeC:\ProgramData\ASUS\ALL\ACLoader\ROGLSLoaderUI_ACInstallerDialog_20240723200714.logtext
MD5:90A12218714964CAAFB8D3FD1B56E39A
SHA256:F3DDBB6A31AE378B50AB763370A04126466EE15E4D54243C176A7359480602E5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
39
DNS requests
16
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1256
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6012
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3204
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4204
svchost.exe
4.209.32.198:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4424
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1148
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5368
SearchApp.exe
92.123.104.47:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.142
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
www.bing.com
  • 92.123.104.47
  • 92.123.104.30
  • 92.123.104.18
  • 92.123.104.65
  • 92.123.104.52
  • 92.123.104.61
  • 92.123.104.21
  • 92.123.104.59
  • 92.123.104.43
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.0
  • 40.126.31.67
  • 20.190.159.73
  • 20.190.159.64
  • 20.190.159.75
  • 20.190.159.71
  • 40.126.31.71
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted

Threats

No threats detected
Process
Message
AsusROGLSLService.exe
Failed to get baseboard manufacturer via WMI, get via registry.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ArmouryCrateInstaller.exe